{ "Event": { "published": true, "date": "2023-07-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-26", "timestamp": 1690416181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "25f9a5a8-8ef6-4568-9e2f-30a198224b78", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799d7edd-2b97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690364007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364007, "uuid": "3ba615b9-948e-4a93-911c-153d4390095d", "comment": "Malware payload (AgentTesla)", "value": "5f96a11dea0c530ecf43dd7d1139f7ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364007, "uuid": "133e7067-5518-432a-967a-7c7fa9c3e2e4", "comment": "Malware payload (AgentTesla)", "value": "001970c1e2e043a76cacb7b7e0e8e59294262820832b05df8f28e0dd925a45fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364007, "uuid": "0361ad26-72ab-49be-a5a4-7c7fae1e897c", "comment": "Malware payload (AgentTesla)", "value": "445ce22bff09e60a096efb607be40b13227f35eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364007, "uuid": "8ea83e13-fe89-4b19-bd0a-e110e56ed9f3", "comment": "Malware payload (AgentTesla)", "value": "0530927a26257d574a9c5564dd9fff4fa6d971e9c108df35ea8da858544b74b828ab0152536f69153761a962a0e51d38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364007, "uuid": "8c307611-01a6-458b-ad1e-b496a5b6a8bc", "value": "T1EFD41280B3986F2AD93ABBF40C11284457F18A9B5926D3191FC325E7AA37F154EF1E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364007, "uuid": "fd825956-d02f-4a3a-bf2a-08b0a7355b93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364007, "uuid": "cae20e28-cca1-48a3-8812-4a59188e1ced", "value": "12288:kAqJmefaynhUk9RCu6jLgxN3sJ2hTj/8LpcWP4eACuGiBOA1pzJ:kAreCQXUNLqpyqScIDubv1pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690364007, "uuid": "90b2f7eb-42a7-42ae-b869-1f8f813138c8", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690364007, "uuid": "dc32ec69-7b65-40a1-a2bc-fe521cdf019e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364007, "uuid": "2380603f-cbec-4b90-bc4e-e6228022df66", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19735.1634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63056aa-2bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690374927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374927, "uuid": "d6d0bf5e-43ac-4620-8269-0bdc02d00c78", "comment": "Malware payload (AgentTesla)", "value": "9636df09b8a75b6cbd83bc6c3b64e87e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374927, "uuid": "6a067842-ad49-4c43-985b-10efe2a10b75", "comment": "Malware payload (AgentTesla)", "value": "0025b610d65b8bd7d665320167eced413ca374996636a7553550255a198ab265", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374927, "uuid": "488f4117-3c82-4622-b527-85fe8c2426c0", "comment": "Malware payload (AgentTesla)", "value": "23e63f1f47ca730696bdc561226f324a901727b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374927, "uuid": "df3663a6-3928-4b63-b487-f5f1b958f596", "comment": "Malware payload (AgentTesla)", "value": "2b5de5c3f786fb17d92a113caffc6e341e887eb72200f5cf8cb5a20f4e3042f3b2a68d7f7958f6d4436afd76aa7ebdaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374927, "uuid": "797cf338-9adc-459a-b914-271dbf680c3c", "value": "T1D9A406717ADC34C4E3803A424BBDA1F46BA7F7C58B38460CE560A45C62EED66EC537A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374927, "uuid": "bfe2d8c6-6fde-4ac6-a7fd-f3c913a4b4f4", "value": "6144:Y0vICOTqlwvqefQtAAAAA+AAAAAZmAAAAAIxAAAAAW:LACOTqlwvFfQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374927, "uuid": "355b2382-8c0c-479b-9d1f-16d71b7a83a7", "value": 486660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374927, "uuid": "247ce606-9fd8-41bc-bcb1-c7dfe3182b12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374927, "uuid": "41ee1534-b84a-4194-846b-851cc46219bf", "value": "COTIZACI\u00d3N_20230726001.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153e2343-2bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690384025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384025, "uuid": "c6d51da9-8f5a-4b15-b09a-e81ebd34d7ce", "comment": "Malware payload (RedLineStealer)", "value": "f442839e6bcda7308f85c0d8c9abf2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384025, "uuid": "40e7a5c8-11a0-488e-b055-a2888ca36f98", "comment": "Malware payload (RedLineStealer)", "value": "0273441f60b98b3a269da7b5fefd7a52aff0d13bf934f9690c3d1e0bcd1dcf6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384025, "uuid": "9f0d61d1-033e-482d-938a-75374563721c", "comment": "Malware payload (RedLineStealer)", "value": "74550347b6b59c8824dc4918bc6623813966b1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384025, "uuid": "3f67eccf-3c05-480f-9873-7af888d252b4", "comment": "Malware payload (RedLineStealer)", "value": "f02fee2269d91a1519dc4741f5ca85ccf2096790234af78ccf6ffd50f940ab9c9b27f72282595d873e6708ea95d2d6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384025, "uuid": "4d1f0149-b41c-46b7-b4a7-417855d6b535", "value": "T10D840213BBD85032D9B617B068F606831F367DA25C74932F2285D95A1CB3AD5BD32327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384025, "uuid": "c74cb64e-6f0f-48d9-8a22-e6759f442820", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384025, "uuid": "b6ae8469-6a75-4d7f-b9b1-f851ed7ba23b", "value": "6144:KUy+bnr+/p0yN90QE9QyAgz4kW8UKfDeUZ/ErIP4b1p6W1gBZ+t41DSEdyHKgU:EMr3y907QyD6ef64Erp6YgBYC1mESZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384025, "uuid": "dd8bbf82-57bb-422a-be8f-84262f678469", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384025, "uuid": "bd352f45-6344-46df-a9de-36ee16e211d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384025, "uuid": "7684c020-1797-4990-90f6-1697a76b56cf", "value": "0273441f60b98b3a269da7b5fefd7a52aff0d13bf934f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4aa189-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356037, "uuid": "3a5b1070-2e63-4eb3-85c8-da03096019c8", "comment": "Malware payload (Amadey)", "value": "48b6d6db91a645d6ff16ac0772bf4054", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356037, "uuid": "fd561cff-ebf3-483f-9edb-6bf610589d5e", "comment": "Malware payload (Amadey)", "value": "03d020d7919a3225b81f14beb4021de28d98a921b826d7e3107fce2a365403a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356037, "uuid": "681073cf-4b04-4e71-9f31-0c102491e199", "comment": "Malware payload (Amadey)", "value": "7403a7ff2beb97197923d3218ceed9f53cbbb83b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356037, "uuid": "753ef84c-c522-4398-8ff6-92058a18a2bd", "comment": "Malware payload (Amadey)", "value": "761b2258fc46aefb841ddffead9b4252338840390ceacaedf43d70a86c87c4cc0639c73bdf486dec12c1f1b62b537488", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356037, "uuid": "07371545-c2ba-4325-97df-cc4cffeb1876", "value": "T163840102E6ED9033DC7A27B058FB02930B367C919E788B6B3749A85E5C736C1657172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356037, "uuid": "bca49364-5db0-4a97-ae2b-dca038d139a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356037, "uuid": "94856929-aecb-4e82-8436-a3db20b25363", "value": "6144:Kny+bnr+ap0yN90QEP56rNkWt7ZNm8hbs1YAqxm/zJdG84v2C8W0ba+d4+SO5Z:lMr2y90Orvba0x2JI84v2xW0ba+d4CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356037, "uuid": "f50776ba-1e8b-42a7-8d52-4f6ca4cbb520", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356037, "uuid": "a5da08ce-3cf4-4e34-abc5-134259fe03d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356037, "uuid": "02a59090-7789-4275-91a4-80df36e2a833", "value": "48b6d6db91a645d6ff16ac0772bf4054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49efe78b-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690365645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365645, "uuid": "1dd3cd09-5d12-47c4-8100-0b8d1b7dbdb2", "comment": "Malware payload (Loki)", "value": "fa95a3e8bb89c806998a3639d94b45b0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365645, "uuid": "ef0332c6-f95f-4e21-9539-cd801e3508cc", "comment": "Malware payload (Loki)", "value": "03e579e3f843e672873e4bc29cc34d82df9a5aed093cd781050d4bdd8adb7d82", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365645, "uuid": "27d9b904-06cd-43cb-8689-4611ef48cb68", "comment": "Malware payload (Loki)", "value": "d25cb03ab415dfa679bcd759107cfb8292596ceb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365645, "uuid": "f1ae489a-9da9-4e82-b51d-d118a032c83b", "comment": "Malware payload (Loki)", "value": "aa83703ca867dadf80aad20b48a622c3dcd37130bbe2e848461ba8de7bbe7831bc6f46e7b9d2a10f80a377d3162cf9a6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365645, "uuid": "a3115772-edfd-4d47-a40a-a9012e0600a8", "value": "T12892CF3ED90D1125FAB3D732E2504F9CEB1D8093AB6E563F74B25085D0926974B3688D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365645, "uuid": "8d6ffba7-74d8-4b90-96ef-32d5c63578c2", "value": "384:Y6R7KoFOBk3B5WSeTdxUxpioFAd9pSZ1BpOVpfpZLj37JyxjPC6c7z8f:JJ1l3jdeTfIpioadjSH6pRuxjP7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365645, "uuid": "e7e6a1bf-fc4e-43d9-b2d9-acf5c54d32a0", "value": 20503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365645, "uuid": "3c977c8b-66ca-43fb-86c2-5539a8162431", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365645, "uuid": "d72c2ae3-2f31-48d0-887e-39eede77518e", "value": "Order_Specification_Manual.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974d124a-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361480, "uuid": "a1be894f-71f0-44d2-892c-4497d829fcf8", "comment": "Malware payload (RedLineStealer)", "value": "ead071a42df95c65dfc47f54d5e984f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361480, "uuid": "f792a914-72c5-4de5-b55e-f3cb0d9caa6d", "comment": "Malware payload (RedLineStealer)", "value": "041f30f361a0eb6aee9ced5fc912b31aa7caf36c4d097f62e53a50bfa4778d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361480, "uuid": "c3d8fb50-be92-40b3-a627-9b6692ce5efb", "comment": "Malware payload (RedLineStealer)", "value": "3197ebff751d3e7a1e3008a1ac94a6dd4bca5d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361480, "uuid": "2a49400a-2268-4917-bc05-945e962fc59f", "comment": "Malware payload (RedLineStealer)", "value": "a0fdcbcdf244c675114dc3903a256173ca8617a0684adb8eb560d1d067ef62fc9269a9fc37f49908a7c56575ab397866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361480, "uuid": "3d59f920-56b4-4ed2-8ac3-7694176825d6", "value": "T1FAB40257BBD45533DCB417B194FA03A31B367C506DB8872A2B86655A0CB2BC0B876337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361480, "uuid": "df8a534f-6e50-4739-9b26-9a33854f8fa7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361480, "uuid": "48e2bc83-f8ad-43c3-877f-47932c100c69", "value": "12288:FMrDy90KoAUmJ7P+d5ogUlHet3J3EYfJOmSUcLp1ix8:ayemUd2gUJ6Z3EkQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361480, "uuid": "e6d9b5df-fb45-4584-8641-6dbc6ba628b6", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361480, "uuid": "75d317fb-2c48-4cde-bcdb-aff7428a22fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361480, "uuid": "5b102b4d-62c9-46fa-b6b2-c21fe158a894", "value": "ead071a42df95c65dfc47f54d5e984f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb90b6f-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690361487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361487, "uuid": "a61ba0dc-5e46-44ca-8aa7-b65f06766876", "comment": "Malware payload (Stealc)", "value": "f56aa77eb1c9abf22657f9cb54bd9cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361487, "uuid": "047ea3a4-c83d-4d7d-8575-e39764e8b1a6", "comment": "Malware payload (Stealc)", "value": "046d23bc4411e3fe3a0b2440e505a86751897f44c99d9a73bfac15b49dd9b399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361487, "uuid": "c64e0426-d4c9-4b44-937a-2bfb34062cdb", "comment": "Malware payload (Stealc)", "value": "0067f11db251887fb1ed8db7b8225e8425b1041d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361487, "uuid": "a91c830c-d4bd-4dde-b1f0-34f40a1968cc", "comment": "Malware payload (Stealc)", "value": "edcc6a4e123a80a242d8e42b4fd3a190d9dac68986b81d6d2ba30594428a13d717447e1b6c90aed19ec581bed8f081cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361487, "uuid": "9cd16f12-8dfc-4a3c-934c-219937c85b2c", "value": "T11074A4C383A1BD44E9258B729E3FCAE8760DF6518F4D7B66A2289F1F04B51F2D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361487, "uuid": "9a47b13c-e494-407b-b538-9cb3b909062a", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361487, "uuid": "841add90-be96-49c0-ba57-ebd69540d715", "value": "3072:41paeMzF8LJnMKPKIRVO1jZpZf/HAplY+nbf5fwEwlGvPGT1lTsZxOa:Ga5F8LJnMWKIR6vApl7hwEjv+HTza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361487, "uuid": "673b78d1-0700-43c6-b8c2-4d74747332b3", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361487, "uuid": "ae04ea55-85a8-4465-ae0a-02c7df50a948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361487, "uuid": "d5e0b643-83d8-491f-9a82-c5d1725e25b2", "value": "046d23bc4411e3fe3a0b2440e505a86751897f44c99d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eb636e-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385742, "uuid": "f2144484-ca49-4331-b208-8351f6e70fbc", "comment": "Malware payload", "value": "7dc6ec42b16a6c4d68c950de3b3ccda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385742, "uuid": "61f9f3c1-e094-4bf1-a323-5a5668046eba", "comment": "Malware payload", "value": "048f47d900549774eaae49c07ffda5f578515a7320f5436c08ed94faf6fea2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385742, "uuid": "b0ebe309-f140-482c-a1c6-8dcf94a9883f", "comment": "Malware payload", "value": "86a755364aa1e762fea8e3094f413ea697e1ed9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385742, "uuid": "1064cd02-259c-405b-ba58-f7856c945cb9", "comment": "Malware payload", "value": "6f788fa85d5c116400209c85d55608709ae58e08a981e9e9d3dc89e0ce06b3c5351f76d41e1ca23b43af272075643b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385742, "uuid": "26e7bfbf-0b5f-406b-9a5c-c82f5e3df194", "value": "T1E5646C9382A17F54E9255B738E1FCAE876CDF3208F497B6662189A3F04B51F2D173A40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385742, "uuid": "d47dbb3c-8e1a-4f42-98d2-7e8b21e6a404", "value": "bc04db2ad2507103ec76e744e96f25ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385742, "uuid": "352c06f2-84dc-46a0-8ff0-4beda401ee91", "value": "6144:LSRu0OLtncyFDWVwJ34BLmOldig3TGkgnJQfkeVJkZnjvz:mu0O5ncyV5JoBLm4digDGkgnefkeSj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385742, "uuid": "dcb783a5-1996-4479-b43b-004fad61efc9", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385742, "uuid": "6b4b229b-67ef-4ca3-9061-a1d96ce80ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385742, "uuid": "ac84be9c-f1b0-4b87-a229-b4e791335250", "value": "7dc6ec42b16a6c4d68c950de3b3ccda5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b0f79a-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690351493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351493, "uuid": "b6fa60bc-bbc8-4170-83be-9c9a70bd6a3b", "comment": "Malware payload (Formbook)", "value": "b70d63851590892b116849eaaf4c115f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351493, "uuid": "4dbe5f2e-b033-4457-a4b2-4940f06132d4", "comment": "Malware payload (Formbook)", "value": "04e4a4b48cf2444f21c2f9926cab903ade506cc3ea1fe15f6c7eb290a361ab99", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351493, "uuid": "8b78ffab-77fc-49bb-b668-b61940feedba", "comment": "Malware payload (Formbook)", "value": "c194d722f527de89cb0ad4a284ca6548ce895b5f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351493, "uuid": "349e6291-45db-498e-92eb-656b84213757", "comment": "Malware payload (Formbook)", "value": "b5e49f5e26c2388158e57d42d45c5bd2bbbdf1372e8e68d653fc9f1c5c6b9551bee657e08de993e79c2fa576181e3c82", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351493, "uuid": "927db819-82b9-4bdd-a9e4-5755ecdf99f4", "value": "T1FBC423B8D2C278E7585A08D9C2F8FB777E0361D013751E7427EB9C3D11A867BDA860A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351493, "uuid": "68d7fb0a-6db8-4b54-9043-1e077ec29181", "value": "12288:Na+iYESzGoJg0Mc7iUlJzkzEAiRHzbc/rK37gMKQ+8S23Mc51rfMyqZYb:AHlSLu27PfkzERT8+sq+87Z1bMy6Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351493, "uuid": "1b0ad73c-d03e-497d-914a-25ddd5b8d3cd", "value": 550752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351493, "uuid": "4ad13b0a-3577-4e66-8a77-78500bdfaf4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351493, "uuid": "ed8dd081-a6c8-45c6-9f18-1572778a13ba", "value": "KIEFEL Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cca9fb-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690356664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356664, "uuid": "e5a75fab-3066-4ad8-ac70-66ddf806caee", "comment": "Malware payload (Stealc)", "value": "73882fafbc9b1f7835447a6c1879d1fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356664, "uuid": "cecd5e6d-c56c-468e-85e5-918e1e634458", "comment": "Malware payload (Stealc)", "value": "04f0be09da2edb51f4606ecb15b9d09703c0659c9c842bcd42ccc81f20836be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356664, "uuid": "a69a8246-6c53-48fe-b624-a62d04bb0da9", "comment": "Malware payload (Stealc)", "value": "953e22398f88cfb01ae6da016cdc7a7aaae0e83f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356664, "uuid": "a95bd3a6-bbda-4140-9fe5-c526900cf62f", "comment": "Malware payload (Stealc)", "value": "11910fe9fc99739c0a3a28ecaffac238be9e9a6c30de4c62e53c79bb5065ce0eeb165075bb821842784ad2726614ced2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356664, "uuid": "19e28593-e5b1-4f36-a480-6447e98d14d2", "value": "T12F74C64383A1BD54E9258B729E2FCAF87A0DF6518F4D3B76A2289F1F04B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356664, "uuid": "1aef71d3-5292-4fd9-a0e8-f755a20e4486", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356664, "uuid": "5c3e0366-f2bf-4fae-b19a-2cbfb26c3324", "value": "6144:cZ9FXL5xuz+NKaXS1Oz7xfAcML48Ywjv+HTz:c7FXNxuz+LXVzVxMSwjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356664, "uuid": "e2b96d62-6ccf-42ed-a3ff-5eaf0bf5769b", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356664, "uuid": "974b9139-e916-4046-a24f-6467d2aec69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356664, "uuid": "cbbc5530-5f2b-4f0c-b55a-bb039143cfd8", "value": "73882fafbc9b1f7835447a6c1879d1fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd20f599-2bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690391232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391232, "uuid": "fcde9775-2cec-40e4-a1de-e33bce541f3c", "comment": "Malware payload (IcedID)", "value": "d5d442ab883025eeafcc8b845029f966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391232, "uuid": "c48f7374-683c-48ce-bfdc-1b43f73fb036", "comment": "Malware payload (IcedID)", "value": "06956229eabbb9c29367d8876ddc67a1766e6d05bb0f7ff043f96fac30d793c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391232, "uuid": "68f48396-13be-4e3f-87e7-0494d2c4a948", "comment": "Malware payload (IcedID)", "value": "340e9d48b2ba927074cae4c2361972fc701a0ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391232, "uuid": "3c1a4ca7-3620-4729-b82f-a7f29f177490", "comment": "Malware payload (IcedID)", "value": "7c02f3aaa3492ed4122ffcf1a51abea39521a9d2d22ee5b87852270c2af95f7c10cf8b0a4b1c4ff46f6bd3ebf69fce28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391232, "uuid": "cac6966b-4810-4415-a9d9-f67d03e6d918", "value": "T1E5A4F10AD26516F3CD32C53F88D14646DA783C836E62DA1F131882297FB76714F6AB78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391232, "uuid": "68aabc2c-3a47-44d8-9047-1f11e3c15e85", "value": "122ad25046a6ae342251fe184815d102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391232, "uuid": "23dc352f-6e11-4997-922f-86624505687d", "value": "12288:CLElyP05mITlnW8XDETokqyeHPbqObcKXBFBxT:CLGuIpWeRTbc8XBxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690391232, "uuid": "965de702-3fb8-47b2-bda7-9c6e8ba8e21c", "value": 477360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690391232, "uuid": "620ee06f-48d2-4833-aaba-ea205a2e6003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391232, "uuid": "9ae65b8d-5122-4925-abf2-f923add4166c", "value": "Scan_Doc_07-26(116).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af7beb6-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407764, "uuid": "850965b6-57a8-4a09-9089-7d45d5390ba8", "comment": "Malware payload (RedLineStealer)", "value": "cdb9f33e3db3faea925260edf3aeb4c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407764, "uuid": "2e5b43fa-2550-49c2-b921-35562a537315", "comment": "Malware payload (RedLineStealer)", "value": "06ca8c24aac1dfc98dcff3632bd9a2a735d5a57c7e634d8c9100f6446b5423f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407764, "uuid": "6b803a24-7184-4a40-ac83-cd67a78be4ca", "comment": "Malware payload (RedLineStealer)", "value": "f5c2a6b9bf59a9901d79f6b3c123140433def0ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407764, "uuid": "0720833a-7cff-4f31-9d87-2e488c74983f", "comment": "Malware payload (RedLineStealer)", "value": "12fee08cce0d405de909a94424c70a351f854744d69dcfbb5ecff00b6dbc8c27750a61451be27686be9162f6c348d6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407764, "uuid": "c00e0026-5fe8-443f-9e40-fe7c87b09e3b", "value": "T110840256AAD88433EDB517B058F607830B36BEA19D38829F33469D5F1C73680A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407764, "uuid": "462f2cba-a512-45a9-94b7-987fa5c7880b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407764, "uuid": "f7452792-648c-4c28-97c9-063fb8cab112", "value": "6144:Kny+bnr+5p0yN90QEfWKctyhWbGhdlACOpb6xtV6LcfkvlsVAAxuL:hMr9y90AfMlwpWwLcfb9x8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407764, "uuid": "07b2da7e-af2c-4632-9897-708d5089028a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407764, "uuid": "bd4bd574-dd01-4260-b751-a1060f698371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407764, "uuid": "d4fda3ff-494c-4e5d-b311-54ca0af7ae81", "value": "cdb9f33e3db3faea925260edf3aeb4c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e52638-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407749, "uuid": "5ccb1ba0-efe9-4297-b7a9-18924e81e1c9", "comment": "Malware payload (RedLineStealer)", "value": "6cc4bdb159a49bee438d01af5c3bcb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407749, "uuid": "29a795a6-aa7b-4a8e-8a7f-40468b805fcc", "comment": "Malware payload (RedLineStealer)", "value": "074dfa8168d74a7af03ded4012ec5fb0d12a03280903bd5c7fde7f842172670e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407749, "uuid": "d635b082-0877-4515-9a91-59e13afcdf7c", "comment": "Malware payload (RedLineStealer)", "value": "4961e9d69a8b3c2927e27aa128daf5a8090de4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407749, "uuid": "63545413-9809-4648-a238-edbe92b1808f", "comment": "Malware payload (RedLineStealer)", "value": "3bb441ce077232af3182ccdb1655dd3f45a2adf6a9406529ea41a6051f0604a66f34acb3542f80b516c1651c8158bc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407749, "uuid": "4976adb4-0879-4be6-bded-a94ee4486876", "value": "T1EF840153F7D88032DCB523B058FA42830B367CA19D78965B2755A96E4CB32C4A97273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407749, "uuid": "52aee0b1-603a-4e0a-bf8a-ee0271483087", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407749, "uuid": "a2e47913-ecf7-4bc4-9b1f-0e306dae8e81", "value": "12288:vMrty90SNJxEr1wrH+N1ZBbgBYCYbR3kKX:iyxJcqrHUqzqR0KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407749, "uuid": "52652a2e-b432-463a-824d-8fd601237e0f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407749, "uuid": "bb28b84b-456c-409d-8510-f0fe259a4c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407749, "uuid": "9056ab89-61ff-495f-9c01-9b1a3d25b75a", "value": "6cc4bdb159a49bee438d01af5c3bcb4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cec46d-2be9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690399332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399332, "uuid": "26d26136-3d14-40f0-8f82-c2f1c682c4e4", "comment": "Malware payload (RedLineStealer)", "value": "007acbfd7c0c5ab2284de7810202099a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399332, "uuid": "47d55d20-9b0d-4d9a-be8c-c040254d5808", "comment": "Malware payload (RedLineStealer)", "value": "07848d1371573bd363365d85b1b6e2b77ae2f2096a74b0b98cec1bc1128875b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399332, "uuid": "ba84f181-3a02-4f9c-b7e1-9c71aecffa54", "comment": "Malware payload (RedLineStealer)", "value": "d9d11ae21f431bd74182825a89d76295056d73bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399332, "uuid": "bfe2a717-ff4a-4a2e-bd0e-c42a29fae332", "comment": "Malware payload (RedLineStealer)", "value": "7038803b5afbd80502451973e1133bdfbd9e2bf32cf973f14bac451d1be741a156029baace3b75dec9f399ae9ea80bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399332, "uuid": "09bf295c-7aa9-46e5-aa5a-48fffb64373e", "value": "T126F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399332, "uuid": "011038a2-ebe4-48ef-bf9a-00510c0b734a", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690399332, "uuid": "a4eba899-730a-4721-88e9-bf31b83c14ab", "value": 35214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690399332, "uuid": "a08a3ebf-d686-46ac-a0a4-cbf63790dcba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399332, "uuid": "60eeea8a-b370-4433-92f2-d0b44656a107", "value": "007acbfd7c0c5ab2284de7810202099a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad73e8ee-2b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690354216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354216, "uuid": "5924d054-1ce3-4317-b356-65678a744947", "comment": "Malware payload (RedLineStealer)", "value": "a3336fcf021e1fb4a7465b4294e4baa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354216, "uuid": "2c4d7079-81a0-45d7-a094-5f542e9d8d63", "comment": "Malware payload (RedLineStealer)", "value": "07bf07e777b5169d8335c08731a01880db26549c66165ec92b123d3161de4de2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354216, "uuid": "0c0aca39-787f-4ad7-bc34-71d5be165b38", "comment": "Malware payload (RedLineStealer)", "value": "ef59aff9f8fd20c55c88f183d1410aba11de36e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354216, "uuid": "8c2a6b70-7fe6-4eeb-a06b-46dc7ebecf15", "comment": "Malware payload (RedLineStealer)", "value": "044ee88ca37218130d29f1a77687a8e1856d2e1111d12343da9ba255a27eadeaaf4c7ad60a4dc179482354875ba89a71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354216, "uuid": "5907c4f6-42fb-4043-80fd-21fa8de4385d", "value": "T17104D598324BA57EC96F483D9C700CE16A7CAC675246A7079C8EF4E43D3B781AB151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354216, "uuid": "a21dd07f-4d67-4830-aa07-f810c1ee1f88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354216, "uuid": "f9277cf3-01b6-407b-9e39-7f90b8dc5656", "value": "1536:+JV0RZIv36sv0W7TBTfkrHgWDxWQgKuYxNYTYQLTbucB2xRMBU0GkRn8e8h9:QGRudBJWVZuYxNVqfuRMBU08e8h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690354216, "uuid": "8a255e89-9164-4094-a4ef-91c57877bbdd", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690354216, "uuid": "492662b7-8589-4c85-9011-67b7c40dad45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354216, "uuid": "496fa5c2-cf91-4837-944b-c1e408dd4deb", "value": "a3336fcf021e1fb4a7465b4294e4baa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aad457-2bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690381266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381266, "uuid": "341cfffe-bf11-45bd-972a-b76f247a4c4f", "comment": "Malware payload (StrelaStealer)", "value": "0737e75bcdf29db8555873139e0ad21e", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381266, "uuid": "91b95a20-eb7b-4318-a447-311dc4ded6c6", "comment": "Malware payload (StrelaStealer)", "value": "07d8121a53eae13bd461822abbd0a68611cb107535a52d39ed12f34e2bb087d7", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381266, "uuid": "b186b2bb-c1ae-4fd1-a7ba-f2cbd6e1cd79", "comment": "Malware payload (StrelaStealer)", "value": "fa767150a4e31d84f935259f578d6ea4f8023679", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381266, "uuid": "3d7922dd-e0f9-4362-a2b9-12562432ca0d", "comment": "Malware payload (StrelaStealer)", "value": "7bae8c7e3b9dcd986bf2ad10c1671b0acf6cc284e59e16ef22163752d41258a511a6c80a8764edaf1b0144c574f69f49", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381266, "uuid": "f4ba8687-e22d-4064-a1ae-d4e8c1142a48", "value": "T1E9C41ABD65EB654AFE629C302FFCBBA0C77724A9C657C7F145E9A03024204A3DC16927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381266, "uuid": "cb53aa12-e886-42e0-88ff-7e6aca450749", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381266, "uuid": "0b97a72c-52c2-409a-8353-3cc1da50599d", "value": "6144:jlg6H1TpXyrc/EOnmoF06b1/n3ITTPU/YlHLyohIcRTKVf:RgGzj/EiFtn3ITTPU/g1/Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381266, "uuid": "b8e61a60-8a78-4554-81aa-c4610f317513", "value": 563893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381266, "uuid": "16c1ee64-b64a-4d2d-b444-2806fb18e85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381266, "uuid": "4b6ab96c-6bfb-4d55-a755-59b844d6fa5c", "value": "irxxttstentawzydlpuubytljjtkumaetlosuovwgmncloltee.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6030f6-2b7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690352955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "66e8d960-443f-42a8-8b80-ed7005d38ba7", "comment": "Malware payload", "value": "09260a6bd9dbe615c79d6c3d95f7894e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "8279ed6c-61f2-48e7-8f67-fa7e8d06f9d0", "comment": "Malware payload", "value": "07f24365aa3413a018ea5b1eeb7fd059790616009ac9a85527516ec57673da7f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "d01b4aef-d7c2-4c9d-a822-3f9ea00337b4", "comment": "Malware payload", "value": "719049da6b990531e16acee19d32f566020c8d13", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "91c86097-73c6-4f65-a2c6-dc99412e7851", "comment": "Malware payload", "value": "b597f9a85b9b894ef7e275b40e5d6a7081a16a6b019040c607ba55e7b183251a9eaace138cfce5b7e2b781ec53ae2cbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "7d8c0877-a6a0-4e00-a7ff-15449a7765ad", "value": "T155428E3ADE474DBADF8B2BB44ACB691E4A11A91589880071CF330C89BC95377F14B5C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "65073722-66ca-4165-9a1d-8c48c67da35a", "value": "6b2143eb6bf3b6b18e23ff7de66e6891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "3d47a8d3-a36c-480c-a7ee-028c6ec6c965", "value": "192:wcABVONtmUVX1cpxmHxmamgqP++RPOdL4O2oFB3zvfXDIws0:wVCyqlGOxmM1+4pF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690352955, "uuid": "9a6486f6-a2ee-4c7b-ac40-3a794b4db0ec", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690352955, "uuid": "c67de940-8394-4e31-97f8-fe9121f8d66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "cf33a9f9-0f5d-4fe6-a0f8-73010ac3af0c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.15265.28764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081034c1-2c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690411061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411061, "uuid": "97f680a9-9ce2-4162-91a0-445cbb13b11f", "comment": "Malware payload (Amadey)", "value": "2b4fcfb0f2ae522aa294a88b8c2b93cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411061, "uuid": "6dc25df0-318f-40a3-9182-4229bcd46fb8", "comment": "Malware payload (Amadey)", "value": "082abd50bc322e65df7b85b918d5bc248c652483544b6e4c453e9531969df172", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411061, "uuid": "91a284ce-86e8-4a5b-8a3a-f64fe2dc5a79", "comment": "Malware payload (Amadey)", "value": "55641e78c33b0eada8f3dd92dd81089902bcc4ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411061, "uuid": "ef9cbcf2-8c01-4069-8411-91d561642a0d", "comment": "Malware payload (Amadey)", "value": "924a12089dd6b7c9eebfec9e663ea86e6a37a1af46156933450914bb90c5f62595692fce6843f95aa93d7e765c9cd810", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411061, "uuid": "5f41c8d7-48bc-47cc-a604-f45c5c4b91da", "value": "T1E5840253A7F98036EDB517B018F602830F3A7DA65C34925B2349A98E0DB36D4E97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411061, "uuid": "39fc965a-c028-4312-9357-a89afe9ae37d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411061, "uuid": "2e4077ac-bb79-4b15-997d-3a00213d6cfe", "value": "6144:Kzy+bnr+np0yN90QEJAR3Z0skWcnZNbQR51uTrfrDMSxlP+mzNFe7gHa0O:xMrXy90XC3Z0Msrf0Sxp5Fe7gpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690411061, "uuid": "9175c539-207d-4f04-9eb3-35e54f6ab1e2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690411061, "uuid": "4b47da0e-174b-4e99-b6b5-dabac46e40b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411061, "uuid": "713a4ee6-22d6-4ef8-a916-a3b50dd4278e", "value": "082abd50bc322e65df7b85b918d5bc248c652483544b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9020b1-2c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690414268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414268, "uuid": "2bb15b5f-1397-4956-91bb-ddc4633b97f8", "comment": "Malware payload", "value": "5de11f47e6ac88c69c3f6b5e517bf6db", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414268, "uuid": "6c6ada4a-3c45-4875-b75b-763291878659", "comment": "Malware payload", "value": "087fb94dc34cb66d30105933b33ab6517996e8dfd07fac4fa17e47900d3cd33c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414268, "uuid": "84d432a9-f4ed-419c-8a4f-b3482c419021", "comment": "Malware payload", "value": "ed3ae75e03e88d6397f22e311b9c5fd4f6628c37", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414268, "uuid": "a2f5beec-0c47-45e3-a83d-250f39c5a80a", "comment": "Malware payload", "value": "7488a0a9464a936203049dc5781b0d91d5360873fbf5a329decc64fa1c8883c3d54d6fc0c951b06fea371a46e886786e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414268, "uuid": "9c200904-137d-4d35-9558-792fbc5ee80c", "value": "T1BFD58B86F359996BC8F3933345F61631515B4C668F83D6876928F23C28BB5E40F89BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414268, "uuid": "c0c7172a-2762-4fed-a398-3c09e1b6e695", "value": "49152:JnK/2fSEKmzO1kkDwVqoqEKHUlTH5d2ofrHX9ZlO82zbXVfIDvm3l:xAmSGzxkDQWEJd2ofrHX9ZlO82zbFg7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690414268, "uuid": "310cf770-b679-4745-ab1b-23a1a092d081", "value": 2928907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690414268, "uuid": "61a34a1d-b502-4442-be46-6888215ec675", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414268, "uuid": "507a5f0a-13c1-4d4b-9074-022e75f92e12", "value": "\u0633\u0647\u0627\u0645 \u0645\u0646.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63021a56-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690386732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386732, "uuid": "1c8e4f7e-09d5-4552-aa04-4fc35a06c518", "comment": "Malware payload (RedLineStealer)", "value": "a9bc09327259df739c8c8313cae3e80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386732, "uuid": "84565b66-dfcb-4f45-9388-84cacff2c703", "comment": "Malware payload (RedLineStealer)", "value": "08bcf771d7339fdf71eb91b064d71f382571af729c8b656295847f2b30f33e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386732, "uuid": "ca4b463c-38ce-4563-8aec-0a25bf931763", "comment": "Malware payload (RedLineStealer)", "value": "f34be5c857160933e4760c71d03888295b4554d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386732, "uuid": "686029da-fd51-41c5-8e3b-2a549fbff757", "comment": "Malware payload (RedLineStealer)", "value": "e630b8b794d8dc8483c92afedee07bb4313e3573dcc6780f385839a84b53c9bcc5e3e10bf59f751ae41f24ee51ea393c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386732, "uuid": "df6d4d43-1064-4636-b0fb-ab216ae0cadd", "value": "T183B41242AADC5473C9B21BB028F707A71E32BCA16974932B3355A85B5CB35C0E57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386732, "uuid": "074c6e48-4ae7-4f46-984e-28d8591e0f2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386732, "uuid": "287e3ea0-1bda-4f4f-b201-f9f3754cb36b", "value": "12288:OMr5y900Zh24rmE4/TcJ8zaqXPyMlFKOl6cAf0:/yDZr6TcJpMPyMXlJa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386732, "uuid": "691d9f0b-ad81-4661-a0e1-39825ae28b02", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386732, "uuid": "81edc81a-036d-4665-b67c-12d438e1c128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386732, "uuid": "fb869648-1f3a-44dd-a665-7a045f78d548", "value": "a9bc09327259df739c8c8313cae3e80d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e332745-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690381624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381624, "uuid": "3b630fb9-c19e-449c-b3a9-5a4c253fbb30", "comment": "Malware payload (RedLineStealer)", "value": "339f77051ed7a27ce31a667f63c2dc12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381624, "uuid": "f1f86675-dd8a-435f-bd7f-b9a7bd9d2cef", "comment": "Malware payload (RedLineStealer)", "value": "08f23a63ab237519a016a80df4b329a08fe4a1d243215be22758b0fa6abfa20b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381624, "uuid": "9e66fc4b-93f9-4546-baa3-b297fa1d9f4d", "comment": "Malware payload (RedLineStealer)", "value": "8147a3b016a5349676e31b0c3c5ea834f56f16f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381624, "uuid": "eac158e9-5320-41bc-8be5-99a8da1dee46", "comment": "Malware payload (RedLineStealer)", "value": "04587c04f4abe26bfa31444e6c65a3a5af3f8ff67d9e980914106ed55db74f78f1690a6e8e47ed639f86c1df07e8efea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381624, "uuid": "b200ffb0-b5c7-4a7a-817a-7c11e4e95229", "value": "T163B40242F7E99033D9B967B00CF613930E357CA1AD78435B3785699E4CB2694A0327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381624, "uuid": "4f271ab9-fedf-47f4-9301-f5280d498e11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381624, "uuid": "313f6414-aa01-426f-a05b-c1f06ec8ad6a", "value": "12288:EMrVy90R1aDUkCSDmiFrLiLUji13BRGrU:Rygw0UFrLJjk3B8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381624, "uuid": "35328783-46d1-4c47-97e9-b741e2696790", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381624, "uuid": "1cbcd5e3-42c7-4922-bf74-bfa0f52d065a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381624, "uuid": "d7f36c2c-ef2f-4975-b2c2-95bfdac81981", "value": "08f23a63ab237519a016a80df4b329a08fe4a1d243215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd2d864-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690362081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362081, "uuid": "0af7d53b-1ea8-42dc-96b5-c83626e4f8d7", "comment": "Malware payload (Mirai)", "value": "f679458f5649f1ed728d7b2b078abb30", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362081, "uuid": "ec73b7cf-7a8d-4a2c-be29-0f0e8d3a89d4", "comment": "Malware payload (Mirai)", "value": "096d2df1f360eabb632e90fb468552a71b36099f4dda0ada3fc4eafb6bb9c035", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362081, "uuid": "81dcdae2-32c0-48c8-89bf-aa0fe07c63fd", "comment": "Malware payload (Mirai)", "value": "6b89234da2e19b090caebc623462c13c941a1e32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362081, "uuid": "14ce861a-9754-4971-8e4e-be89d87dbd11", "comment": "Malware payload (Mirai)", "value": "c8e1693c945fe56d21ad87c2a0772a63ad1f3b1926113e70dabbd38a55426972639f4fbb61dbec32a94dd7deddbc3cd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362081, "uuid": "909492cf-91a0-4cff-93b7-09394cf4151e", "value": "T16DE33B46EB408B13C0D22779B6DB42563323AB54D7EB73059928BFF43F8269E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362081, "uuid": "a7916d94-ef0e-4820-be29-f5936b0d85dd", "value": "3072:JOAHpMrnJralml14s4syc5SScVrJR8axyQ08M/9Z160ZnA:JOYp8Jralml1xypS2/8axyv8M/9ZY0ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362081, "uuid": "cc99cef6-0c7f-41c2-a08d-a22697250036", "value": 153861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362081, "uuid": "f371aaa5-e6a7-4f5d-83f5-f652882835a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362081, "uuid": "238347a8-28b0-4d00-814b-7a8d139c7f45", "value": "arm7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4862d54-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690365072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365072, "uuid": "f7b0bedc-80d9-4567-a702-b4bff03d5b82", "comment": "Malware payload (RedLineStealer)", "value": "a6236cdcf98f7092fe0871354ba10e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365072, "uuid": "fdcc3112-ac28-426c-b65a-1cc7e6a7e091", "comment": "Malware payload (RedLineStealer)", "value": "09a034bcfc787a9ce5d2fce8a331f1e577c0c1b40a7a0bdf5e89e0ad1ac2fd44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365072, "uuid": "b4caa892-7c58-4d4b-8dea-c1c193057599", "comment": "Malware payload (RedLineStealer)", "value": "8a93d14d878e4b07b1ade91207f5c41e31e6b88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365072, "uuid": "523f9478-51f0-440f-bc9f-728a00ac7939", "comment": "Malware payload (RedLineStealer)", "value": "85c5afda20e29d1d34c4c4802ef4fadad68188960205bc4814d7708827d4cf950b7feb5b69e99a391886c9424217d0e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365072, "uuid": "23ec5f35-4671-4f81-8c49-9a6215d565a9", "value": "T14D840253F7E88572DDB52770A8F607831B367DA15D38832F2786686E4C726D1A83132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365072, "uuid": "03367d76-6db2-4347-878d-c2aa1d38bf72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365072, "uuid": "74ff5852-9640-4521-8136-32327648ada1", "value": "6144:K+y+bnr+up0yN90QE8S6sEgaYnOiARAtkpKbcvfkG0okFgQWgfat//cwgk:qMryy90+dsEcdKpnfXDkyQRfS8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365072, "uuid": "31e4428b-c18a-4794-aac8-bd565078f954", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365072, "uuid": "3bec4562-f763-42e3-a602-9db094062c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365072, "uuid": "80ec73ff-8489-43b2-82cc-12fb15448878", "value": "a6236cdcf98f7092fe0871354ba10e1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c2eb0d-2b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690347408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347408, "uuid": "0f5b68c4-190b-4cdd-9160-458b1478f3ac", "comment": "Malware payload (Formbook)", "value": "e30b322c2c288f32bca17d8e7c74c2a4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347408, "uuid": "076656fe-fed4-4af0-bd3a-b04d2a7ddded", "comment": "Malware payload (Formbook)", "value": "0a9fc37c5b5c74d7d823f9d22317f5675faf8fb5a8fb97272138c1593ee5f518", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347408, "uuid": "cd0fb33c-0ec5-4b09-a6fe-619156bf9fd1", "comment": "Malware payload (Formbook)", "value": "0896f748f445da30e45e5cf127f2fc97114a65c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347408, "uuid": "1bb8eec1-3657-439f-8020-3d04133c8d02", "comment": "Malware payload (Formbook)", "value": "69e5c930ce007db1cb677d41a2cd73634d045ed9d94a77fe017aea0169d19acde993c5310d113716ae99148e616e4ee8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347408, "uuid": "ec0da047-8eab-4779-91f2-3799f76e1019", "value": "T1CCC433B8AF4AF93825E968914F4FB5740A02CDF5502F5F72509136A138A36FF99B4F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347408, "uuid": "1ac04a01-7815-425b-8986-6161d08a3469", "value": "12288:4pcGDlgd/MOPkTPhVScZ9Okxdaf/EaKFzg9+ECFLJfeKKtEGDYCn:ctGd/xkTPhkmgycfV4E9+EI2KrGDbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347408, "uuid": "3e995514-19a9-4156-9877-03624a88f7bf", "value": 572120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347408, "uuid": "55826669-e512-4e65-a13a-23bc0de142d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347408, "uuid": "44d8ab0a-20ea-4ddf-86fe-61936a85aa71", "value": "DEL-25-7-23 COS-HWB NO 65534423333.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e4d7e8-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690377105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377105, "uuid": "c426206b-99cf-4751-ac99-81ef65a9a657", "comment": "Malware payload (Amadey)", "value": "408244158a42c19fd383e1571338385b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377105, "uuid": "3dc2d132-a416-4db6-94aa-26e93a522577", "comment": "Malware payload (Amadey)", "value": "0aaee74a22926e077529acd2ccea6d77e86bc5bf9cf870794da6a111b45c1494", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377105, "uuid": "51572cc8-80f7-4557-b73e-951407023aff", "comment": "Malware payload (Amadey)", "value": "02390aac1bca5f18552d59f881afcab85179124a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377105, "uuid": "c7207de0-14b2-4375-aa12-2b263b2b935a", "comment": "Malware payload (Amadey)", "value": "f0f293909e0f6373fbdac6ee498e0d8f3da7753bb8a6c687cb0a9357ff811b7e08f61de168ccf3770b63632124986b7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377105, "uuid": "39ab7f62-28db-43f2-ae44-7670debb94d3", "value": "T1BDF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377105, "uuid": "59e6f8c1-8c2e-4cb7-b06b-43afcbb3e3a9", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377105, "uuid": "1f5046f4-e12b-403e-826c-b998dd5d6183", "value": 34361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377105, "uuid": "580ca24b-cafa-4a57-b2b8-f38ef1f357d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377105, "uuid": "1d66488f-ab66-45e9-a6f6-f0e0443145ba", "value": "408244158a42c19fd383e1571338385b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff005761-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690380122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380122, "uuid": "9c536baa-cbd2-445a-bf55-e7e6b975b931", "comment": "Malware payload", "value": "7453109daabfd4326ea85cdf4a473a96", "object_relation": "md5", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380122, "uuid": "0142dc0c-cfcd-4018-acd3-076c64f4c06c", "comment": "Malware payload", "value": "0b5122e7b87002704d1eb7524fb9b7c07252cd2b6976d82a6e310374bc7df5ab", "object_relation": "sha256", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380122, "uuid": "ddadf11b-8fbd-448a-994f-ba56640843c6", "comment": "Malware payload", "value": "e63590c3218a012ab3d71db8b76379ce44243a6d", "object_relation": "sha1", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380122, "uuid": "4aab9a6e-9128-4799-8f37-04b965d354f8", "comment": "Malware payload", "value": "f79410cc8325d1c59faa8489b07bd8bd8d5af04d34b506124aaa6b2d537ebf61e280ef215586238e15f67af76d332de2", "object_relation": "sha3-384", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380122, "uuid": "308757ec-de80-4e43-9098-ea06bcf60633", "value": "T1B856330B3AC99775C6DD077286DB876B8762B8621623C413239D520E3FE261563BB3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380122, "uuid": "c4d01751-2d9f-4694-827d-7641191885f8", "value": "98304:NY5AEyqGijhLij/3vwdm7hVC/Ai6/tVQZAN1f/5Sc+eVALrJtshbFoi/aSsrD2Z/:IyqGi0zh8YR/tVQ+ff/U9OALr4bFoitJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380122, "uuid": "d4ef6c49-58af-4afc-8313-88dc6d60692f", "value": 6291456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380122, "uuid": "8f6ee801-f18c-4ac7-9fd9-2a0a2a295bc1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380122, "uuid": "4b6e9fdd-02d8-47fe-a283-d05e36139fdf", "value": "ifisca12354.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923a2d6e-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690351593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351593, "uuid": "ba3624c7-75af-495b-b3ab-d626dfb75dc1", "comment": "Malware payload (StrelaStealer)", "value": "fdb29029c7ffde2ac7a4badeac0e4528", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351593, "uuid": "60cd62ff-b191-4054-aa6e-d03f69d92f4f", "comment": "Malware payload (StrelaStealer)", "value": "0c4a73af65ca2f4affacff89dc15cf7e0f43365e6d43dca7a7f63aedc2e673ce", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351593, "uuid": "99f1782a-2b73-4e22-b715-3510584183af", "comment": "Malware payload (StrelaStealer)", "value": "9440996150f39f4c69195c0f95aafe3817c1fea5", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351593, "uuid": "d7b1308e-ccee-4743-8971-0c3aa7c82a56", "comment": "Malware payload (StrelaStealer)", "value": "75698eb380ee24f1a326b51c9c0f0badac507116770e4e74ea1c8fd00304562eacbdef77ad3701283926ae8a2819f923", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351593, "uuid": "7b219629-f9cf-4499-8fe9-44df6a790915", "value": "T1CB053BF472D07BC70F79291DB3CE80B23D64B457F0AEAD8636DD091E528025D99EADA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351593, "uuid": "d113fb38-71de-4a8d-9ca5-328692634e04", "value": "12288:DOvKGioiWZbFHoEWIW0u9qs81yMHKXL74hGZQ871nFRVTMeUoIizE:DOyIZbFHo3IWp9bCRKXL74h4b3I2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351593, "uuid": "12fd37b0-b1e4-435d-ad3b-f5692ccc9e6d", "value": 806444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351593, "uuid": "21ef1fac-2d2d-4dc1-a03b-f01793d01365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351593, "uuid": "9aeca625-0962-46f8-b7aa-075cc0e14764", "value": "PDF7077298584081.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbd7d2a-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365091, "uuid": "94b45a23-513d-4f32-b899-69b20b9b0e85", "comment": "Malware payload (Mirai)", "value": "d2f92512aedaca835cdfde825e84939a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365091, "uuid": "515be849-cd95-4945-909d-a598136ea04d", "comment": "Malware payload (Mirai)", "value": "0c769b479e17de017410edbeec6d1b48b5b2a11803dba9ba6244040487319118", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365091, "uuid": "d7f67fdb-a2e6-4990-9750-a0a93bf70386", "comment": "Malware payload (Mirai)", "value": "fe04f905ad013c26dd88bfc93e9765163e362e5e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365091, "uuid": "f382a859-2534-4940-a3e9-5fee6c2188f4", "comment": "Malware payload (Mirai)", "value": "12f1bd82f895e7c803d5fe19fc41a41d38dac286c88549d7ea9853510a63409d8f0c4c477416b46da5f445dc328a12dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365091, "uuid": "fc26459f-5ea9-42bc-a0ba-0ea073357982", "value": "T1FF230271880A9EB525303C72EAD5D793B6E026B1C6673023D6280B3C2F787131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365091, "uuid": "a10575b4-459e-4643-83fa-b2ad56668a9d", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3G9q3UELbUXfi6nVMQHI4vcGpvm:DECFd+A6YHAxrLRQZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365091, "uuid": "525a2f8b-d25a-4550-a74e-c81e26a8871b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365091, "uuid": "74cb7f41-370e-4226-80c1-b21e05f797a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365091, "uuid": "b40fb033-1cbf-43b6-8a56-d2f09aac2b1b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9083e527-2b98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690364475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364475, "uuid": "486021c3-c0f3-4596-85e6-7a65ba3b0330", "comment": "Malware payload (Amadey)", "value": "9de93ce041d7af64e024ca08e7a4ed7d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364475, "uuid": "f0414947-0a3d-4bbc-95fe-13dfce77075c", "comment": "Malware payload (Amadey)", "value": "0ca6fb959ca79706af41e8fb37e623dbcd14773377ad1d9955043b59f19e530d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364475, "uuid": "c75a5804-be44-4077-b0d5-53e20dd22d29", "comment": "Malware payload (Amadey)", "value": "7a3786d35e16b48cef40557d2fcafe51a154f95b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364475, "uuid": "d17d661f-6b8b-4ba3-9738-a90c6cc7bd85", "comment": "Malware payload (Amadey)", "value": "cc46764603c5f0126261b4da165b052c48907a94cf9b1731ce363744a28f0bf95d034e85bb9eb70e145a193d6e15af9b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364475, "uuid": "5c6bdf87-0c2d-452d-8090-89f8dbaf38f3", "value": "T1AE840242A6D88073D8B517F058FA12D30F37BD618C78936B3705A95E2DB26D0B97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364475, "uuid": "73994aad-1ee7-4e52-9f1e-8ad4d3ffe303", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364475, "uuid": "3ea34201-8042-414b-bed9-8bd93951607c", "value": "12288:RMrqy90rBepOSAjeN0ZXLhXigBYCQBhsB2f:DyurS/0ZLhXRz85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690364475, "uuid": "10c936d2-00db-42c3-8616-a7396c771ac2", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690364475, "uuid": "f8499f4e-347a-4371-a468-edbb3cec4b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364475, "uuid": "53000c86-ac82-46e2-9a2c-bca6d2b2f8cd", "value": "9de93ce041d7af64e024ca08e7a4ed7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7870e455-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690381614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381614, "uuid": "528397fd-3170-4ba1-bbba-d99533dfdb79", "comment": "Malware payload (RedLineStealer)", "value": "03ca22509dd0d27c7870a11d815e9ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381614, "uuid": "216c7a1d-0e64-43cb-802a-a7520f9356a6", "comment": "Malware payload (RedLineStealer)", "value": "0cbf9c5b5986e5ea6119fe8fc3da31af9c240982a4a7cfed5ca9fb56c4d768f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381614, "uuid": "6fa9467b-876a-4ad2-be83-8568525bbec2", "comment": "Malware payload (RedLineStealer)", "value": "5cc860e59d6a72f2706b072d31c6cbbb098144e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381614, "uuid": "18b053d1-44b7-4adf-b6b2-5f11deb2d09d", "comment": "Malware payload (RedLineStealer)", "value": "6b45c70511f6f092b6ca7f7d9667ac1f32fdaad8a2501b685ad462e820229af50af4d3169f1c61231fd65634eb70ea85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381614, "uuid": "8fb3a4ca-01f1-42cb-9dab-81b558a2c273", "value": "T1F5B41243A7EC8173DAB127B058F613831B35BC125D7897AB2382A95B0C73984A67177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381614, "uuid": "73a513df-28e0-4969-8242-852b576257b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381614, "uuid": "01cccd36-7bef-4cd0-9f25-f00de6ae903d", "value": "12288:7MrRy90hXdFuD2qtGnRDC2EruoHkM/T6xhFx:+yQZqIn09ruoEM6xDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381614, "uuid": "8fb7ae61-4e2b-479b-b732-087c2d237966", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381614, "uuid": "519e3784-4b63-49da-9bb2-c230555fb56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381614, "uuid": "21b6ebd8-df9c-4b92-a7ed-af56cf0afea4", "value": "0cbf9c5b5986e5ea6119fe8fc3da31af9c240982a4a7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e68b21-2bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690373792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373792, "uuid": "578c3fb8-5048-4989-a2f5-ffbffa09a746", "comment": "Malware payload (Amadey)", "value": "44d901912ea2bbd74ad2b95cd220ecf3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373792, "uuid": "0c997e6e-deaf-4e0e-a833-a5264f22459d", "comment": "Malware payload (Amadey)", "value": "0d2fd19a4c2bc4d71a369bf109143db144be610f4e822f938543cfb6167391b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373792, "uuid": "218fc3b9-dec1-405d-8245-82adf9b4fb19", "comment": "Malware payload (Amadey)", "value": "f9ada2e978542833f4c708b7e36a21b2c641d28a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373792, "uuid": "11327744-cdc8-4199-83e5-382afa93df45", "comment": "Malware payload (Amadey)", "value": "fd60374ea87743f6cf4060c8771ef6472350a8ba34d78835280f882e239123cb12fc019cc602625ef15fb49bc8b7137c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373792, "uuid": "f90b945f-9e6a-4e9d-b266-c170c47d4ef7", "value": "T1BC840142A7E8C473EDF1177008FA13931A36BCA15D38537B2A85A95E0D736D0A87973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373792, "uuid": "341c1a1a-f524-4c19-a864-932c3729fc67", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373792, "uuid": "c5085904-cd48-4ffe-8cc0-c12beba299a2", "value": "6144:KNy+bnr+4p0yN90QEq23vabWiLnqkWcnZNbQR5D/9djZ0it81M4G/WVNf6PkuPuB:DMr4y90Iui1svjZly1WWOkuPHmO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690373792, "uuid": "47df3c74-5e2d-4709-aaac-095b9f7f7e82", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690373792, "uuid": "24b92df9-00e0-4c1a-8a53-92bc9293e5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373792, "uuid": "f661462d-c51e-4299-9425-2adc3564f4c3", "value": "44d901912ea2bbd74ad2b95cd220ecf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2780f04-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690385201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385201, "uuid": "b22cda33-0ea9-451c-81d8-5618543f39c6", "comment": "Malware payload (SnakeKeylogger)", "value": "5e3fd4a75e470e290704becf75b7d664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385201, "uuid": "e5b108f8-c7bf-47bf-9435-88eb30139fb8", "comment": "Malware payload (SnakeKeylogger)", "value": "0dd98033015ba867b676551b1c071ea1e6e9e83d1b9501f3e3c955f21af0088b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385201, "uuid": "31b9ca8f-823f-4cb7-8dc6-2a385c4a882a", "comment": "Malware payload (SnakeKeylogger)", "value": "8751d8255f48c42176e167f08cb2c4b3e81c7bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385201, "uuid": "c4666a37-b5cb-45b1-981f-fcc291ad829c", "comment": "Malware payload (SnakeKeylogger)", "value": "3f29f753a4e84d4d439c751cb45a4128159632c3620f36a80f26c76e0ec72c8e159c233cbce59e56a57c251676cea5c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385201, "uuid": "6e462560-3121-4ee4-87ee-616b5b3efc9c", "value": "T119C41244B27CFF56F6BBABF10616690427F0C9266412D3566FC331D669B8F064BA0E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385201, "uuid": "42674c81-5f09-45b3-ac19-5682b49b7d27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385201, "uuid": "dc8d3176-0d40-402d-b492-5486336ffe56", "value": "12288:ZJmefaynhPaIDQoqtYvzyAsEO+hcS7mrvZ0hdL:GeCQPfmN+xCruhdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385201, "uuid": "e2afd6d5-535c-4e37-a28a-8d864284dda1", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385201, "uuid": "8edeade0-6462-4460-b3ca-6f6d9857192f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385201, "uuid": "b1ff0987-d14c-47a5-bcda-22a05a19bb3d", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7031fa47-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690376017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376017, "uuid": "f27bac44-bf61-4def-9f05-132285c4d9db", "comment": "Malware payload (AgentTesla)", "value": "476693ba6eaa7788e7761c480575be7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376017, "uuid": "d1d90a8f-5251-45b7-9306-9cba03aaf457", "comment": "Malware payload (AgentTesla)", "value": "0df214faf5a5bacc151bac2a04889720a9db05735f8711adbc6909ee1602e243", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376017, "uuid": "512983d5-96c8-4a61-8fbf-67f364db7906", "comment": "Malware payload (AgentTesla)", "value": "dc9b62e39cc946ffd94ab3ac0dd0d45976c5bfa5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376017, "uuid": "c0963a34-4b74-4c33-8027-7dd30c5f83ff", "comment": "Malware payload (AgentTesla)", "value": "f930296e168b43d19b69881454c70757407783f1886e36e349839fb8bf8632a8ee3b7c90cb3cc9dd586d058a3da8946c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376017, "uuid": "f899d822-c3af-4635-b8ff-4d75e034bf5d", "value": "T153E41208F1AC6F66E83AD7F10A9A18955BF0E6633016E3C94FC170D69AA9F5403B0F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376017, "uuid": "535a1115-b139-4b89-856f-038e1cfb31bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376017, "uuid": "307e7bb8-e3ad-42cf-98be-38fc1efe6306", "value": "12288:JJmefaynh3pKjN2zKMXkgG+e8+vJBEzD1nM9mnBsSBnh6YB6Qu1VH1E6+R:WeCQZKJ2+pgsBGBM9uBh6Y7uzbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376017, "uuid": "0c58e13f-1be6-4a5e-aa05-2d96f6d69a2d", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376017, "uuid": "4cf842ba-036d-4fcc-8f29-0956945a494f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376017, "uuid": "8358b455-499b-494c-9042-33987b3fa2b0", "value": "rPI23-00137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4c4fdb-2ba6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690370484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370484, "uuid": "e6897874-2cf4-40e9-bc52-f5683d8c1ed1", "comment": "Malware payload (Amadey)", "value": "339502ab6e803bb14f41192ad1a5f0d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370484, "uuid": "d23bdde5-81a2-4c2e-8e02-9928e6b677d6", "comment": "Malware payload (Amadey)", "value": "0e413fa9690c02a45dc95f1ea020874ed2745670117fed803aea439be9b8683c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370484, "uuid": "2339a628-9ae5-4404-ab5f-e77b705773ce", "comment": "Malware payload (Amadey)", "value": "a4b66d62757242efc3b730e8a408c6c97682de3e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370484, "uuid": "02dedfb8-cd7a-429b-9bf9-07e209544cbc", "comment": "Malware payload (Amadey)", "value": "c526d5ba275d0fb09f9afcfc6f6623e34455798d4e00f6fbe7485801140ab8dc7691ecb14f0a80a38a8b126ac81933bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370484, "uuid": "0952920b-782d-4456-8ef8-2042d3f30340", "value": "T19E840143DBD88433E9B9277098FB02930F75BD909DB9922B2795990B0D726C4E532377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370484, "uuid": "13d2a585-dd5c-4c9b-b06a-2a255517be18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370484, "uuid": "eab68e48-ce88-4d1a-9b53-55f96ed3d34c", "value": "6144:Kjy+bnr+Ep0yN90QELzQhhPWbRIi6yiCcQ/sRZYE9Df8HrENGiM:tMrYy90GPuGOMTGrEpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370484, "uuid": "26262084-f2a9-42e2-9426-72ed6a4031c3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370484, "uuid": "33080951-6c82-4bac-b7c1-70177b14ed33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370484, "uuid": "529799bd-2683-424e-8241-78a7011513a0", "value": "339502ab6e803bb14f41192ad1a5f0d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d215631b-2c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690412259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690412259, "uuid": "11cd9109-24da-430b-a013-9b442b951eff", "comment": "Malware payload (RedLineStealer)", "value": "1a2b0ab54afd2bae94b94b2d8bb128fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690412259, "uuid": "2b3afca3-c283-4ac3-815e-a50f01ed3c82", "comment": "Malware payload (RedLineStealer)", "value": "0ee0b5d6e07273ce4ecc3cc47e76c58075d06380ee210c715f526d035365f221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690412259, "uuid": "278fbbbf-5764-4b9f-8a3b-e3e6d5985976", "comment": "Malware payload (RedLineStealer)", "value": "bfcab4e5dc06bef8d07c82e6e5e49e194fed1146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690412259, "uuid": "4e06e1a8-687b-437a-aaa4-8c979d1e7c96", "comment": "Malware payload (RedLineStealer)", "value": "9a7509e0ae5455f433a066c180e7d4b7e4f3b0ff806f5b2e3ee8dd31b64754d843a2ab4029e1e8401d7b62a2b4e4f50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690412259, "uuid": "557e1ef5-7e9c-4115-8eb3-5f40d5def276", "value": "T1B6F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690412259, "uuid": "94bf2a90-3550-46ee-92ab-a3888f879121", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690412259, "uuid": "9f935e38-cce4-4064-8cca-8a6de04250ad", "value": 35921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690412259, "uuid": "aa49ed6d-e95d-42fb-bfd4-32135ca81508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690412259, "uuid": "31f97549-4f15-47e0-81d1-795b17e1517f", "value": "1a2b0ab54afd2bae94b94b2d8bb128fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9dadf4-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356660, "uuid": "8ba2071d-4bf5-4eea-887c-9c8f284956de", "comment": "Malware payload (Amadey)", "value": "d6e09c27f0a4edd58049a60ec486588c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356660, "uuid": "dfdd169b-6cc6-406e-a0c6-23b57c8b7492", "comment": "Malware payload (Amadey)", "value": "0f2175d649eeec041f218e8d08976177958441e3af0f8bce60205ca963d857e7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356660, "uuid": "b0e693f6-9736-4b4d-a6ed-e297c8a31081", "comment": "Malware payload (Amadey)", "value": "9978872ace6dc374e024394d8f4b5cce6a96b70a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356660, "uuid": "cdaa70d8-2318-45ba-bf7b-99ebec6c0eb7", "comment": "Malware payload (Amadey)", "value": "0e690b48d7dd14c534d19ef859247457121b1da0418e64c53cc8c8989cbaa041a7eff0560197107b4ae006947f2ce6be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356660, "uuid": "916fc234-ac10-42f3-96b2-5bee6d016e8d", "value": "T1D8B41216A6E884B3E9B627B058FA03870B3A7C914978935B3794BD5E0D737C0A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356660, "uuid": "54c1413a-e22f-4955-b3c7-2cc94b3e715c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356660, "uuid": "85d6a154-d493-4f5d-a458-77caea3831ab", "value": "6144:K/y+bnr+5p0yN90QEzmUQf5tkWcnZNkAEpEx3xOasVN2Esnh6AiwH7syZYdNzMwO:5Mrxy90RmUQ3pAnUALH7syZkJMqEHkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356660, "uuid": "663d341e-fa24-411c-9461-a6f168c798c2", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356660, "uuid": "4487bbd1-b26a-450d-824f-8cbc1028d0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356660, "uuid": "de0ca049-4545-4f56-b839-b0e94d5e7d1a", "value": "d6e09c27f0a4edd58049a60ec486588c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cef03bb-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356980, "uuid": "e999e3ec-7956-4532-bbe7-1832308b7321", "comment": "Malware payload (Amadey)", "value": "474932b39373f48c7a530441d8e9709e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356980, "uuid": "309e68d8-181e-4608-b77d-adf72b09ad9d", "comment": "Malware payload (Amadey)", "value": "0f3fc05fe2db9d3b03c0b7d1c6af9353f3d7c1d340577a71dabad5617658cb99", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356980, "uuid": "fe9ebae1-3889-4dc4-ab11-613d4c7c8f35", "comment": "Malware payload (Amadey)", "value": "87e49f87d564dea22fad5eaa488d024492e5d4d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356980, "uuid": "282ae4c9-6498-4527-8c0d-d9d4313adfa8", "comment": "Malware payload (Amadey)", "value": "821372a3d0b3e7e8a6bc927f61eaa9d431f2650eb025c66503fc4feebce42a45eabe943af4409430983aa8c3715989e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356980, "uuid": "5586561d-690e-44a5-b082-01491eeefa2b", "value": "T1398402026BE88537EDB91B705CF617C30B367DA19978536B3789A94B0C73290A431B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356980, "uuid": "7c4ffd03-6f9d-48ad-a141-f5b45b4e9cb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356980, "uuid": "ff52a7f1-edc7-453d-9ebb-84e005bd9142", "value": "6144:Kzy+bnr+ep0yN90QERKGbHP7i7yEfIA+o2hdlQkWglzYEHxeFvm5cLvfK+Kw90Lm:JMr6y90KGD7Oxghh7cEHIVvpWLc6lS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356980, "uuid": "6e26b0e7-373c-47c9-b09f-14e43fe8d409", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356980, "uuid": "bd2fad50-effb-4bfd-9c01-232faea1013c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356980, "uuid": "f7d5d691-94cb-4272-a701-16acb5338bfa", "value": "0f3fc05fe2db9d3b03c0b7d1c6af9353f3d7c1d340577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6cafdd-2b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690358131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358131, "uuid": "7e401a92-e3b8-4ee5-873b-34b49ec9d26f", "comment": "Malware payload (AveMariaRAT)", "value": "50ce1b3739c1772ca93dac7c1590a619", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358131, "uuid": "ddf57256-ecee-4f2f-bd2a-61521d08917d", "comment": "Malware payload (AveMariaRAT)", "value": "0f5eda3aea01010924570df8526316a8a62a39fd6bab4be462b52e74736ed26b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358131, "uuid": "cfb1621f-34d3-4533-a5fd-a408bfd6235b", "comment": "Malware payload (AveMariaRAT)", "value": "adca6a5570edd0be96218fab5067dddd79148c43", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358131, "uuid": "4893b14c-769b-4ad7-beb1-337e29ec3ba6", "comment": "Malware payload (AveMariaRAT)", "value": "0db4a4275ab779b004d0b4dfcdf19318cb9991ef9d905d62370c3ff303af30a4ef023dc81e1fa6f99e8dc695add4c44d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358131, "uuid": "c73bda09-e325-4138-8743-63afbc56c6ad", "value": "T1C014025E9BCC3023C97E12B009F3764BA7316692D90ADE2B34CE1626BF83661ED521D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358131, "uuid": "4e7c2627-f300-42dd-9990-3057edbaed5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358131, "uuid": "610e6f61-ef3c-40bc-ad33-6265e9462b99", "value": "3072:Z+OLRveLpJUPgXFIB3FMx4SzAJwsrBBU97crCbItwmfto:AOLRvUIuBx4vJRBBIYr8I1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690358131, "uuid": "67536375-05ef-4242-8ac4-42e4d0539a32", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690358131, "uuid": "e467f411-1eeb-4143-9c07-97b54c37b004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358131, "uuid": "cb331e33-393e-4647-a0fb-65d679ab3302", "value": "PO.No.1006309834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985ca7ef-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361482, "uuid": "358aab8f-1e2c-4d46-8db5-c6d3d037aac3", "comment": "Malware payload (RedLineStealer)", "value": "fbe11448c95eb3d859b67811a5027ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361482, "uuid": "e14218b7-7ce3-4c5f-ab86-0d87036fb8a1", "comment": "Malware payload (RedLineStealer)", "value": "0f6ce02639d4d4caede8c3432a529ff995f9d50cbfec335bbe9dc19b8f5c9ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361482, "uuid": "084c4fb5-277d-44b6-bed0-36de99ee0acc", "comment": "Malware payload (RedLineStealer)", "value": "f3ad51fdea8d704a2ac80be6fdf81bc1fd99e72b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361482, "uuid": "aa0a2a51-71ec-4e30-ab58-a15187c41ec4", "comment": "Malware payload (RedLineStealer)", "value": "5c3946952aadb54832bde4e3de9588fa510fabfd8d34bbe156be08849998adfa05590f92572ced95a1b09b1ed94f2d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361482, "uuid": "9443b2a8-7c3a-4a90-bfd3-f19cef4ee68d", "value": "T16E84F117EBE88032DDB4277024F603D30E367CA1897496AF2789A9691C737D4A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361482, "uuid": "1f55ff8b-f72d-4f95-8dba-f7f149678e35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361482, "uuid": "af22bcbc-a901-48a4-88fb-4e7b7966d109", "value": "6144:Kny+bnr+Wp0yN90QEa35FPZiqimkWn7ZNjQBLvam3+eYNKV5HJuZMBrCFXkK9xMH:hMr+y90s37PZq+k+v4fJAMdgXACDYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361482, "uuid": "12e4f5cd-a83f-47d3-b70a-b0371c3f5557", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361482, "uuid": "b3459c51-68ab-488b-955e-8fd56e34b399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361482, "uuid": "107b03e9-8bcf-4a24-a84f-a1ba6095d780", "value": "fbe11448c95eb3d859b67811a5027ccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c30c2d-2c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690411962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411962, "uuid": "044942b6-5d72-4a26-a73d-23feba7fa2ee", "comment": "Malware payload (RedLineStealer)", "value": "179e88f3f4839358b6fe822354411e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411962, "uuid": "0289020c-70a4-49f7-97cf-1f95a0573b3d", "comment": "Malware payload (RedLineStealer)", "value": "10038e15cf9800dd40cfd932f541fe0086d58c9a4155be64e533e8dec6166c12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411962, "uuid": "0da2d94f-5283-406b-b4fa-52e55db19744", "comment": "Malware payload (RedLineStealer)", "value": "8f0a08f5ff1e175a8a9705521c26193d22df547e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411962, "uuid": "d5429a8c-a371-4e4d-8eea-cd544b095aeb", "comment": "Malware payload (RedLineStealer)", "value": "61fb12bfd95efe2516d364aa66c7b7d25f304b3573675a2fa13d9ac11294ab81821486636f2527fd0c191da81da5ef73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411962, "uuid": "78da66d4-d873-4803-98c0-2a1809f29f99", "value": "T15574F102E7E98473DCB12B705CF702C31A36BCA19D74836B2791699A1CB35D4AA3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411962, "uuid": "21deccfe-e55e-484c-8eb3-8f7423b82694", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411962, "uuid": "de1fdcb3-7fa7-484d-ade7-d997257806c0", "value": "6144:K3y+bnr++p0yN90QE9NRo9/wS5QRvqDDCGrVZORuRGsV6twpEiQhtj:9MrSy907cvAsCGreIR4twYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690411962, "uuid": "47d17eca-1741-43d1-9dce-0ef73cd2936e", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690411962, "uuid": "bce45691-a3db-47ee-a4d2-e70722835405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411962, "uuid": "aaad5669-5649-4580-952e-44cd74e89cbe", "value": "179e88f3f4839358b6fe822354411e5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab873d8-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690381618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381618, "uuid": "fc96357b-30d2-4e48-8cc5-7b98f47be44b", "comment": "Malware payload (Amadey)", "value": "d765fea7e386e9798a38778deadbd8ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381618, "uuid": "13bac2ff-2841-449f-b66d-b4ddde215906", "comment": "Malware payload (Amadey)", "value": "1061795ec7728529bc5cdedd15a9eda55150ebcc486e744f0278b9a9766f94a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381618, "uuid": "2f247ed4-3cd7-46b5-8c7f-bf813c6ffaea", "comment": "Malware payload (Amadey)", "value": "128ba3eb80a5c3987c39498f702c501ccd5f39b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381618, "uuid": "1d6ce0ed-c4ff-43a0-a0be-f9239280c4e6", "comment": "Malware payload (Amadey)", "value": "0b8ff6de7ea71d8b64dcb590eed04e2ad82f2b0ec2ccbe1ad23ae258d02600b6184dfd73af5e3da43fe5f88251619b34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381618, "uuid": "f6f01094-fcd0-4f58-afb6-eee615ecc176", "value": "T128840152B7E84072D9B6177068FB02C70E3BBDA15934865B33869D4B4CB39D4A83673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381618, "uuid": "879949d1-1219-409f-ba68-bbf2116d9d77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381618, "uuid": "e768c4bc-90fd-47d7-ac01-71ad382d124a", "value": "6144:Kly+bnr+Tp0yN90QE02tBPN8YBL28M8GFXbczR0+4mU7k4R9BkdlGn9lgSj7:XMrXy90vtBlBBgczR0dfk+gSj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381618, "uuid": "6c1ebac4-361e-4c5b-9678-d6b62ecf7456", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381618, "uuid": "8740faa1-a86f-47c7-8ed0-eab9696bbd8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381618, "uuid": "36fdcf89-4718-4cf1-a211-689834bd30e7", "value": "1061795ec7728529bc5cdedd15a9eda55150ebcc486e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0b28d4-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408357, "uuid": "ca117e1a-73cf-43dc-9846-88594ee2469c", "comment": "Malware payload (Amadey)", "value": "f66ede1e06a086d548beab7306b19c2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408357, "uuid": "bbaa9c3a-3234-4d48-af8c-5e09fdef23a0", "comment": "Malware payload (Amadey)", "value": "10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408357, "uuid": "24c73598-cb72-496f-a1f7-995baf8b742e", "comment": "Malware payload (Amadey)", "value": "e3473b146cbe237f60308ded64136d2e0d0e0138", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408357, "uuid": "dc54d6d0-a5fd-47d1-9645-3f9dd354f4a2", "comment": "Malware payload (Amadey)", "value": "aab562d205bdecaec5023acf1ce99c8506b25b3cc07a687efcaf2f27673a6ee0e3b2f24a9d80ac88416b2657e536775c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408357, "uuid": "94410275-d236-4518-bb9e-02505abe2692", "value": "T106840107A7DC9072D8B527B018F712831A35BCE29C38965B7786A94E0DB26D0E57273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408357, "uuid": "4bfb623b-e13b-41da-b03f-9ae6e073ae3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408357, "uuid": "03f22f6b-2d9c-454e-8709-10214e768ca3", "value": "12288:EMrZy90J4zMV/aGuDCQsgBYCpxsHJKBCs7:tyc4xHDCQzzzsHJKb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408357, "uuid": "96d3ebf4-ef61-4fb7-9242-5ea8f9be70b0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408357, "uuid": "1818e189-3b21-4829-91e2-28094c04ebab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408357, "uuid": "73b88e22-3405-4a8b-8dcd-c5cab8c32242", "value": "10893005755e760cedfd88c67f168c3e2f1e26fafad63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a20922-2bb4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690376501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376501, "uuid": "3f7bb45f-5f13-440d-9d90-1a6af65c6186", "comment": "Malware payload (RedLineStealer)", "value": "a0ca6912e574833240194ec4fe31f631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376501, "uuid": "46a1f860-f3a2-4af9-aebf-a5553f0aca9c", "comment": "Malware payload (RedLineStealer)", "value": "10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376501, "uuid": "ee7bd8fa-784e-41fc-b296-0d4ebfcc1053", "comment": "Malware payload (RedLineStealer)", "value": "8755f22d65a895e74cfc8675410f24e255f0827b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376501, "uuid": "d750f115-3af3-4856-a04a-47e7cbbe0510", "comment": "Malware payload (RedLineStealer)", "value": "7d6da39b512bc429f0bc00d1afe28799e7667409a8e88786667e20023eff9994cae215bfd1edd7c38f2944a3584e5a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376501, "uuid": "1cb09b03-00ab-47bc-8b6a-4b14efa11f2d", "value": "T1C1840153BBE88032EDB1273058F606C31A3ABDA25D3C976B2344685A1D739D4E93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376501, "uuid": "ce8e593c-ae51-4d7e-843d-e885df19d498", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376501, "uuid": "06cd5c2e-cc38-4569-8518-68df7d5a8943", "value": "6144:KFy+bnr+Wp0yN90QEMMHTfcOSn1XrkWGjZNJ2h74Tj98p881bbZKgTDUONPu/:7Mriy90BzfcOS112Tj9g1RKgDUqm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376501, "uuid": "d84c14d7-110a-46a7-bfbe-caf87724ce99", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376501, "uuid": "02d011b7-776f-4458-b403-d4681b515374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376501, "uuid": "6d2276e2-452b-4a1c-908a-a143f17c2fc6", "value": "a0ca6912e574833240194ec4fe31f631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b2bc63-2b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690347384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347384, "uuid": "da945c78-a012-4a6a-b3d8-f6cf48036a9e", "comment": "Malware payload", "value": "5c4f9fa495e8b0bdea430778a5054ec7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347384, "uuid": "d975079d-7a3b-4472-ab92-de51c4d7c632", "comment": "Malware payload", "value": "11032cc7378fd6e95942c0a37f0fc41103e7ca548554c4977ba0574ad13027db", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347384, "uuid": "05faeaa9-e99e-4687-9129-214c47bf87f9", "comment": "Malware payload", "value": "771c9a49d9294200a411184e232e4ac0aae79223", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347384, "uuid": "418e3286-2c30-4135-bde6-4e32bc6f5cac", "comment": "Malware payload", "value": "25317fe83b10de4e9d19bd726ec8202899f13ec20a81ab3f59f12918ffecf0bd7f35775fec2d74e87d97172ca031f03b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347384, "uuid": "047bc70e-5ecd-48c7-a9f2-c7c56ebcf20e", "value": "T119D16D45B5A61928CA65A070C8581D3A015799D38E2CB12FF8F8F73C6587CF9637F835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347384, "uuid": "89b37cb8-56b9-4a37-bd6e-1fac7426e0e5", "value": "96:nsBnRe94BbO2awm0dJx04FZS9Mzsl9yDHHV1Dy/1NbxdmrshtHWc:nsnRsNUm0Pxhm1gVMgQjHWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347384, "uuid": "0e70dd9e-0c8d-408e-8c2d-92ed7c2a190a", "value": 6574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347384, "uuid": "eb801d1b-dada-4121-89d4-06971553b428", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347384, "uuid": "0c0031c1-d35e-4381-8d3c-b81765bc14a7", "value": "Braemar MTM Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09afc6e-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690379212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379212, "uuid": "e406db1b-6d68-4eeb-8922-1d9f10f68b73", "comment": "Malware payload (Amadey)", "value": "89958b073773829bcf009d9a8fb666c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379212, "uuid": "493d4fcc-5f23-4f4c-912e-265e59ff353a", "comment": "Malware payload (Amadey)", "value": "118cd0bfd632c0577f17f5c3658bf9aa28e49965bf25d1164dd4cacf1e753f9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379212, "uuid": "ea93c9e0-ae27-4fd3-ab79-0c02cdfca876", "comment": "Malware payload (Amadey)", "value": "12450acebaf78a47d5f0eff0109dd7c854f48e64", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379212, "uuid": "61fd67d5-3622-498b-be41-7d589a74e3e3", "comment": "Malware payload (Amadey)", "value": "347f8b7d30ff80beffe35e34f603d9a2d63ca3f0ccc8cc08445462b40e0f4f6f71732f4ad0e5c07f714ef39add9eff88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379212, "uuid": "03382a74-5084-44d6-ab3a-84f30ff33cb5", "value": "T1B6840212A7E85432D9B61B701CFB0BD30E367D959D78836B2385A89E4CB36D4A43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379212, "uuid": "bf4d0bc0-ea9d-41b6-8c11-bb8ee25a1e1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379212, "uuid": "e552c025-1509-455f-82d9-758ede460f46", "value": "6144:KDy+bnr+hp0yN90QEXBs+ZDajgyT+oC3UeI6laJJlxHLsbzEbS:tMrhy90jzCmjlOHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379212, "uuid": "9c59f3a0-ebbc-4793-90e4-ead668404514", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379212, "uuid": "9663731a-7ecd-454a-a5b9-1270f57395c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379212, "uuid": "6a5c3570-27ac-48ff-9131-d8e0aa8f3f8d", "value": "118cd0bfd632c0577f17f5c3658bf9aa28e49965bf25d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08a675f-2b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690354221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354221, "uuid": "20faa910-14a3-4336-ae34-41fcf89e5d2c", "comment": "Malware payload (RedLineStealer)", "value": "97b1b260abb2e35d57edcca826c9ba9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354221, "uuid": "68f67ef4-6621-48b0-b2d2-83423e77556c", "comment": "Malware payload (RedLineStealer)", "value": "11b6a605fd5eef9a3906901c6bff84d798f1bf70f7432bea6a32a5f330cbfb35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354221, "uuid": "563fb700-940c-4698-a98a-179e52ded7cf", "comment": "Malware payload (RedLineStealer)", "value": "a4081f4baf9cdb6b22b72ec722720ab08e9697fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354221, "uuid": "34795f46-d3fd-46c3-8a3a-9130f16f1d8d", "comment": "Malware payload (RedLineStealer)", "value": "c2f4b0c80365237d1eb28dd5165b9ad9b23e118f3e75846e3d4ff797620bab3a1dfe94ae3cb0111c234f42ae37f3d513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354221, "uuid": "330dc2f9-2506-4927-b523-2b8e04b56e18", "value": "T11A157C7039808172DDE220B646ECB9240E6DE7B04B2747C71AC857EED62F9D16B325B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354221, "uuid": "20397e58-7c29-4bfc-942d-eff247a36e0e", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354221, "uuid": "28486a34-d0a6-44ee-9a9e-0a46d957fc02", "value": "12288:Xety0hpIPoS5PMZ67bEC0Iup3mzrgSyszQuU2ikDBduzzo74HW5u8VkyhX3X+ddh:Ot1hpIgS5PMZ6EgQuU2ZBz4HyV9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690354221, "uuid": "ed810a2d-14d9-4a53-8ac3-0da09d75d5dc", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690354221, "uuid": "43e38652-24ce-4c2a-b64c-d2588a98e9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354221, "uuid": "129aa662-f21b-42b7-bc59-623a8881ca8a", "value": "97b1b260abb2e35d57edcca826c9ba9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aede5d2c-2c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690409623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409623, "uuid": "46bd308e-e5df-4802-aa31-46cb14e084e8", "comment": "Malware payload", "value": "9cd94c8ac5c05061bcd4edb8c1e7f8f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409623, "uuid": "63bb38de-9fc9-4daa-b701-c5a0315c4127", "comment": "Malware payload", "value": "11cbb0233aff83d54e0d9189d3a08d02a6bbb0ffa5c3b161df462780e0ee2d2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409623, "uuid": "c9355a37-b87e-4544-a3bb-cc1b576ed7d6", "comment": "Malware payload", "value": "d722c153c9ea0b627b09346f1e9e6deec4c3cbe0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409623, "uuid": "cfc8a63c-b715-407d-921a-682d10cae043", "comment": "Malware payload", "value": "a2fa32085ac42c3a5fbec6f35856ed2e0bbd995d1287b61ab2bd02760e2a046d320dee4ed772effd20a07bf9b72af251", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409623, "uuid": "8419b45e-6a2a-4708-96a7-dc1aaa568897", "value": "T152033A01E2C1D0FAF1E618BDB4419D91E4FA9C784DAC4DA29BD16E0FA09B8DC9079733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409623, "uuid": "1941d20f-c95e-48ac-a2c9-de1a88549d63", "value": "768:gGiEEBGU4Ly9RWFaoF4Vcps8etdvAgV1N:JiLBWLAWFad8eT4u1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690409623, "uuid": "3a70dd0a-e8d5-48f7-ad1d-88aa14ada34e", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690409623, "uuid": "6641cc69-6b6d-4705-bd7b-565d6c1879af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409623, "uuid": "550adb3d-4cbf-4e91-ac62-46ec4bd5a531", "value": "pikabot_core.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3fe594-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690356307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356307, "uuid": "35561be0-c253-495b-a713-c9ab76abc2ba", "comment": "Malware payload", "value": "01a774a0857334782f38f9d42ddf9b9a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356307, "uuid": "6d01eeb7-d2b9-4cef-b377-3e14525d0f29", "comment": "Malware payload", "value": "1257f67976396a010da1ae647718220a80fbf10db2361622522251b621e2220e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356307, "uuid": "423c2532-9c09-4b7f-a3ce-d6c784bd090d", "comment": "Malware payload", "value": "463cafcfdfe1204839f8d55a8b56c7cf0b7ce55d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356307, "uuid": "4edb32b4-2bc5-4ae9-93f0-30bec3b98cf9", "comment": "Malware payload", "value": "a90107625359006f96fea4ec59e8e60ea91729ffaedde71a57af17e3e32ffd549783262912cb38b854065ea9f372a825", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356307, "uuid": "55508a2f-3aaf-4bf4-aa53-5d1eab311124", "value": "T15375F113F820AF83C50C83F4BE2319D55F0A6F06E455ADDF01123FAB3AB6762995A61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356307, "uuid": "f7c69a2f-200d-4cd4-a86a-4fe898ec8d17", "value": "49152:wOuPR6V9EF+6VuiNhv3tG3DTKWgWW5R1:wO4m9tmuMh+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356307, "uuid": "70befcb3-bcd7-41ee-9e34-da1d4697bf8f", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356307, "uuid": "c75bdf04-bcef-4aa8-be6f-c8d5dfc52051", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356307, "uuid": "60ac96a5-01a7-43dd-943c-718c15e98bf7", "value": "PO23007014.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb43df6-2c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690414664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414664, "uuid": "01d75758-ad68-4523-a125-9a27970f75fc", "comment": "Malware payload (Amadey)", "value": "a0570c03b2992062f9d7c88983ec0531", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414664, "uuid": "67a12638-d5c0-4ebd-9d64-4cc6a99a284a", "comment": "Malware payload (Amadey)", "value": "12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414664, "uuid": "4426e3c1-99ea-427b-82b5-4c88d0e00144", "comment": "Malware payload (Amadey)", "value": "ef7a037d1215d81b892aeefd6108df59ccd2167b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414664, "uuid": "309f19cf-5b3c-4f6f-9d3a-c2c191395dce", "comment": "Malware payload (Amadey)", "value": "b509466697d4493cf390cbaf3f001cb9341b5bdfbe41b2b4c7cfd0053a650b7340dbf6594b40af2ab27acf702b4f3049", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414664, "uuid": "0dcd83fb-caca-4425-aec8-4c6f6d7796a7", "value": "T113840102E2E48037E8B417B05CFB03C71A357CA1997943AB3795A86F5C73A94E93572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414664, "uuid": "b01a87ad-1ed9-4f84-9ec4-286fc355532f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414664, "uuid": "86c66472-c481-497d-a5ff-3e744f6ed481", "value": "6144:KYy+bnr+jp0yN90QElD2DJ37wIsWV673NgHi406Yp5EeO2ufKu/:YMrny90rD2DJ372DmB06i5k2uCu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690414664, "uuid": "2609538b-36bb-48e5-97d3-c0f582aae154", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690414664, "uuid": "970a922e-4a80-4acd-be64-c60b7ccef9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414664, "uuid": "084d9b09-c024-4074-8627-e2a39762cb90", "value": "a0570c03b2992062f9d7c88983ec0531.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0f3b4a-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690385543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385543, "uuid": "f70053cd-38d7-440b-8cc5-6aaf4440594d", "comment": "Malware payload (Fabookie)", "value": "8d90cb681f371e5b12ab0df85be3f757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385543, "uuid": "3d18ccb4-f229-431d-b39e-34dd1b763540", "comment": "Malware payload (Fabookie)", "value": "131c6a3cac7b3d42184052e11af0df0d727c00bb9cfa5f343444adbdfb3dd529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385543, "uuid": "b737c55a-301e-4ffd-bd2f-eea99df39986", "comment": "Malware payload (Fabookie)", "value": "66cec7c7760b6a926007843b1660d39998b454ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385543, "uuid": "0c57250d-288b-494a-9e11-b0fec89b8efe", "comment": "Malware payload (Fabookie)", "value": "6205c7dcbda1d39e20cd696e4c6f5f2404884619d283993b923b835efb6f6099c7c9a183321317fc470c6feb9257f24c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385543, "uuid": "69e1d87d-5480-4849-b00b-22639a81533e", "value": "T1CED47C51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385543, "uuid": "b8de9a97-9ae1-4526-b5f8-41361c6f50b4", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385543, "uuid": "5669b51e-3039-456f-b609-05885084537a", "value": "12288:Te79CNmn1yjvZvHTJBxPTXzGPDJcyMuGEPnW:q79imn16FJBxPTjGPSyMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385543, "uuid": "faf3d961-32e1-463f-8c25-ecdeeb8a9a6f", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385543, "uuid": "6b46588c-58cd-4353-ba11-8428d0082ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385543, "uuid": "87a2484f-0749-4367-a5b3-88a961c68629", "value": "8d90cb681f371e5b12ab0df85be3f757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bc60ca-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690385026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385026, "uuid": "0c7cd953-21dd-4490-a49a-d510a2bc52e9", "comment": "Malware payload (LummaStealer)", "value": "e28caeb7f200cb9e09493e31c3946e3a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385026, "uuid": "51a02970-2a6f-4318-a140-76c889e9908a", "comment": "Malware payload (LummaStealer)", "value": "134162ed5422ce094f4c36c11e97ea4357b88ac0bc1d42e0a30777489c41f1d0", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385026, "uuid": "1f019005-fd83-4d20-b64c-4447c5412496", "comment": "Malware payload (LummaStealer)", "value": "ef70e96878268de3d6174d7c772ca3db4a82c470", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385026, "uuid": "4249514a-adbd-4219-8211-bba0c640b76a", "comment": "Malware payload (LummaStealer)", "value": "6d7dfb59df0a9d1843e65922e15baef13d11be71abf4bb4f5d179404eb4221d1d45d7584afb57bb57e656fb827b82abe", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385026, "uuid": "108b55e8-9b69-4f2f-ad58-77d020e04f3d", "value": "T1DCE5330D1D27D23AC69A4F35A7F50E4CBBF5B39618243A99FC58121FAC728E19C9C325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385026, "uuid": "919753fa-d5c7-4bac-8561-9d30a1e573c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385026, "uuid": "7dbcb295-a090-4e58-9f7e-19ef798e6163", "value": "98304:pRseyJEgrFWTMY5BlcpYpXJKo9ZkqEwvpxTGNJ:JyJEhpcQXQRqhxcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385026, "uuid": "78f212d2-4660-4c7c-87f5-ae7ed4cb7a1a", "value": 3259392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385026, "uuid": "86dd72ee-1729-4c43-9a72-71c062083d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385026, "uuid": "46dbc60c-4586-4e7a-b550-3f6ec9f8c3bc", "value": "e28caeb7f200cb9e09493e31c3946e3a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c84534-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396374, "uuid": "51654ffb-ec6c-48eb-b5da-bceb94c26c2c", "comment": "Malware payload", "value": "f369250db766a9469a786daf30c43d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396374, "uuid": "fd66c42a-a274-415d-a2b8-e097fc6df5c1", "comment": "Malware payload", "value": "134c23ec245a8e10995adfa594154b61bf94e1e5016cf5daeb2b8d594bb16448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396374, "uuid": "6c1cb590-5306-43ff-95c5-0ad52395ef36", "comment": "Malware payload", "value": "d94c8ec04b26231e30143e11d03ef3dc90b0af03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396374, "uuid": "bfffe9d4-353d-4372-9b20-fd6dc816cfa1", "comment": "Malware payload", "value": "e7b175c1f979f3e3a78fdd94324c714a0c86496cfd5cf92d9b3d941ed75c8c44ac58eb3795c4cae7c0ef343adbfbbb4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396374, "uuid": "1fa9e969-07cb-4e17-a8be-97e3e5dd3487", "value": "T17C0318037F5DA5A0D6949B3FC9A794100773EA82F923CA1E784A236B1C137BADD5134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396374, "uuid": "ba4dd2ca-e88e-42ed-96b7-b2043c09197b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396374, "uuid": "2cdf6b8f-987d-4867-bd69-90f807345cef", "value": "768:Sur9dUnBnvK4spMElEOdwVXYZ1DpgfmZi8DkbVh:Kpy4sAV0Dpgj8DkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396374, "uuid": "010f9f75-5e81-46a9-85de-5f2c9fcc8702", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396374, "uuid": "6cf32f40-57f6-4448-b4dc-ee38cb734d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396374, "uuid": "54656b64-913b-4ae8-a277-735410ac28b8", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4066ad9-2bd4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690390331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390331, "uuid": "dad09aad-bef6-4c2f-b2d2-fb36a57ea5a0", "comment": "Malware payload (Amadey)", "value": "082931c582b6984be9ecf0b9a10d3a97", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390331, "uuid": "b5a1c597-8f49-4e42-8784-c862ce3c7e2f", "comment": "Malware payload (Amadey)", "value": "13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390331, "uuid": "f9921fa9-8770-4777-b8c6-eda1a299848b", "comment": "Malware payload (Amadey)", "value": "b54ae43dca0f037b8d859239e1e395bc574d750b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390331, "uuid": "4155166e-0ab4-46a2-b3b0-f621c52b6790", "comment": "Malware payload (Amadey)", "value": "996bbde95f3e3668a32952f99202f274ab335ce80008e14485f484027a73efd155cd335f4f012485a50d5f0129700685", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390331, "uuid": "7fecb5f2-1182-46f0-b1a0-b261a0ddc0ed", "value": "T1A574F112BBE99133D8F41B7098F603D30E367DA19878831B2B859D5E1C72AD4E83576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390331, "uuid": "291741c5-d819-4d5f-94ec-67cf2a7a7b7f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390331, "uuid": "53be521a-14f8-4991-962d-60ebe9420c74", "value": "6144:Kry+bnr+qp0yN90QEJGvSQG82CRZn4ERr7UXYfoi2vT7hQrFvCqfuln45:BMrey903GV2K17UXYAi5rlCqfulM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690390331, "uuid": "9001b128-02b4-44db-a0dd-19a85cbb4431", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690390331, "uuid": "0bbac8f6-2f2c-4714-beaf-5fdd4ae9f6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390331, "uuid": "caf67734-a7e2-4c60-b2ae-7ba4b4516a64", "value": "082931c582b6984be9ecf0b9a10d3a97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8710698-2bd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690389131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389131, "uuid": "b5bd58b2-f16d-4141-8a84-33f725ad3cf2", "comment": "Malware payload (RedLineStealer)", "value": "0f29e3c4c519b83a63e3dc22d77870c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389131, "uuid": "d620d3ea-4b82-4f3a-8028-17b36fbc390f", "comment": "Malware payload (RedLineStealer)", "value": "14c2a2ad49f08dec10e72f42f330daa8e92cceae705a65cc84750c493cb7f4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389131, "uuid": "2b34b01d-ba57-4e3f-a5e5-01a5c39627db", "comment": "Malware payload (RedLineStealer)", "value": "6f6973c4bea0ecaea3b6628cf0015f69e9e4cdb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389131, "uuid": "4afd4157-17c6-46a7-b9ae-5033f61bbef9", "comment": "Malware payload (RedLineStealer)", "value": "94b631791c34e0aecb0add6f5cf370823e8487bdcde0fc644749522ac731ca5f5129f8798e7286e92e8e1b3c6e70cec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389131, "uuid": "afa89bb7-5557-42ef-b3b6-3a76e91a0434", "value": "T1DFF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389131, "uuid": "d85964bf-5c3f-4dcf-a609-4ab4811f5bd9", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690389131, "uuid": "4469f83a-9318-4f93-91d7-b8024844282f", "value": 35182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690389131, "uuid": "1d3e27fe-9b5b-4dbd-be81-d5259a674da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389131, "uuid": "d3e891c6-daa1-477e-9bdd-7db8e0489c03", "value": "0f29e3c4c519b83a63e3dc22d77870c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ddf7be-2b90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361162, "uuid": "d08dc79d-3a9d-4e4b-8265-19c19f8f0606", "comment": "Malware payload (Amadey)", "value": "62738107dfec0f5b263280164906a4d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361162, "uuid": "aa646356-7e79-4321-ad43-a4f316a14732", "comment": "Malware payload (Amadey)", "value": "157d83ab1a3b14a9062f11329ae78a8a1e10f99943eee66d58ebb770c9ef547e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361162, "uuid": "0fab7d57-d636-4bcb-b885-87f3694196d5", "comment": "Malware payload (Amadey)", "value": "2eeef428c2a980875f7d02a49082b7345de9333b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361162, "uuid": "519be369-064f-4d65-9bf1-4948606eaa20", "comment": "Malware payload (Amadey)", "value": "c544112022f406ed78b8c3761cc488ce8402fe3ea92915c16581f7de46069f280bddf91b8b76707c62128c7d5a25edb9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361162, "uuid": "8d2fc760-79e3-47c3-8de1-8a3ae5b66e98", "value": "T197840216F7D84532D9B62B70ACFA02D30A3A7DA1D878835B2381598F0CB36C4997577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361162, "uuid": "bf4b589e-a336-49eb-a04d-2fe9207a5a7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361162, "uuid": "19be1671-8e6c-4128-8b58-3a12308200b9", "value": "6144:Kly+bnr+ip0yN90QEtxapgYzonLU/lkN722CElIYtKJhTA/29mmWmHWL2fg97:zMriy90KgYYU/s72REZKJhTw2Ym2ic7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361162, "uuid": "7a03dbbd-bc08-4c38-8516-13d6875778e0", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361162, "uuid": "a61fc522-1d36-4c0d-8f06-58ffa995bac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361162, "uuid": "0c3c4094-2aec-4164-8de2-59afb0380303", "value": "62738107dfec0f5b263280164906a4d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9cbb71-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690386727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386727, "uuid": "5cfb8f46-de50-496f-a020-eaa4ebc5205d", "comment": "Malware payload (RedLineStealer)", "value": "7df24f49f54b8ac81e3c00b6ef1ce8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386727, "uuid": "9b15d13b-26f8-4b49-8b64-22b66d36646c", "comment": "Malware payload (RedLineStealer)", "value": "15a93b61b0f1091ffed5e2a2a442e7fe5060b5674f75443efcb362de169b83e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386727, "uuid": "e63cbf42-4939-49ce-a021-24d27e594d57", "comment": "Malware payload (RedLineStealer)", "value": "788350bc977f6bbad5170e21e5cd2a0ef1499472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386727, "uuid": "6ca8b4ed-aa62-4ebc-9362-05f2ed962eca", "comment": "Malware payload (RedLineStealer)", "value": "5f0ff21d3ee82dc185d8ad69036c5c9ac55198572a723e1669d97d9be1de12618034be79bb00e47fc29b1f0e5870b11a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386727, "uuid": "f51cc810-9654-4ef5-961c-969380d2c630", "value": "T19FB41202BBE8C073D8B427715CF607930A39FDA15D78832F2B45695A0C72A85A4767BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386727, "uuid": "d01e0891-14a9-48ce-abf9-3c7a13801b2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386727, "uuid": "aa205128-7bef-4762-b248-0904c4419694", "value": "12288:yMrTy90wTnRjHE/K1rdz7rhYXr8RsVWuoXd++974nV7c:RyzzNdvrhY78io4a49c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386727, "uuid": "01f29729-4fb1-412d-be91-3880ee009327", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386727, "uuid": "1ac3bc61-9fba-4ea6-8ea9-e3d1c2cc5e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386727, "uuid": "2380cb04-60c5-48ab-a0dc-a4b9ecf58739", "value": "7df24f49f54b8ac81e3c00b6ef1ce8e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1726a363-2b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1690360406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360406, "uuid": "bed31fc1-c96a-4f3f-8a0f-dcc49c52688c", "comment": "Malware payload (CoinMiner)", "value": "b634d0b3af3d6a147f871701da357207", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360406, "uuid": "93ba1c91-8552-4e5b-b6d2-efdb0206bebd", "comment": "Malware payload (CoinMiner)", "value": "1627305ce5b682e34b63b01be748a33e25514e0dfd977ff1054f13d1358c9db7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360406, "uuid": "fec7129b-d664-4332-adb8-9e73aed10c93", "comment": "Malware payload (CoinMiner)", "value": "2e0b90d726a625140148fa811fb7f66f0c4574b3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360406, "uuid": "f5d157a6-5f98-4a96-be1c-e75547670f8d", "comment": "Malware payload (CoinMiner)", "value": "4916ee12805c9ebb4226bc0913d0252153e70f17b528777d1a5b9b526ec24d1c8aa4b7bec3caead861201589deae7c03", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360406, "uuid": "1cd9a4a5-c2d2-49d3-8447-6cb301530f4a", "value": "T14EA633596D7379C6D89029F8093CE53EBD28AF1EDB408F9C94011D024F89BDC25DAB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360406, "uuid": "ed7764e3-fd6e-4d64-97f7-3a3115e6196e", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360406, "uuid": "1a76dfc7-3975-4dcb-81fa-8a8e0d9c653e", "value": "196608:4I8u99EFVdrmAVoVv1/gx5j/N961UbOsQUzHs2aqHhy2vttEdCXgV2VysiJmUqxR:CUV9/gj61VPGM2ZhyQHE9V2ViDqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360406, "uuid": "30fd276c-53cf-4646-a3c5-7cd9c35e931c", "value": 10235960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360406, "uuid": "9451ad96-1059-4ee4-822b-194c75594985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360406, "uuid": "ddc6afe8-aeee-442f-a321-aeec10642a5e", "value": "SecuriteInfo.com.Trojan.Siggen21.12182.15540.15638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d076d59e-2b77-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690350409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350409, "uuid": "b5e5ffcc-df41-4425-a84e-31bba8672f84", "comment": "Malware payload", "value": "7bed84eb56172ad856c94beecb7a6d24", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350409, "uuid": "8ad8f40f-6f18-4e02-a962-3e37759d5067", "comment": "Malware payload", "value": "174ea03717777a27dd10a1d792b4b11e9814dd391efc96fff202448dbc20f1de", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350409, "uuid": "29c6a0e0-ac84-4441-ab35-5ffc1fd92b29", "comment": "Malware payload", "value": "069a9336039daec38b468cb09eb90457473ddea0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350409, "uuid": "cd914f2d-076d-42bb-ad14-74527b414ece", "comment": "Malware payload", "value": "ae01a11d55ae4bccd0f37c5bdb6d4789788c76a311751b7d2dc4afa4f6ac820048b7305e76c20afc2a0048ba5c5fd8e2", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350409, "uuid": "15c6fd9e-2782-437a-b964-13727edcf8d7", "value": "T18C62C713FC968812416251C0FD79AA1EA546922BC3058C1473FC97DABFC5ECA8E727DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350409, "uuid": "34d3234f-2fca-446c-80d1-3f134902e96c", "value": "384:Ulie3ZdPEISARyiWXTCxXCxuSIg5ZVE1S+IQI:ze3ZdPEIYlCFSIg5XEchT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350409, "uuid": "7cba5c92-209a-439b-9fee-312be7a9bcdb", "value": 15059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350409, "uuid": "00ce85f5-936c-43a4-9acd-b6d9d944c21b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350409, "uuid": "a78848c2-8e36-4ad6-b025-a64a77b515ff", "value": "RFQ # 1045981 - MAA_D Plant Project r01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6d28b5-2b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690347723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347723, "uuid": "787a6721-73da-44b1-bacc-ceab10dc797b", "comment": "Malware payload (DarkCloud)", "value": "1882861692ac02f14f37709ffabccfb4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347723, "uuid": "56a14b60-7657-4f67-8998-831a16353892", "comment": "Malware payload (DarkCloud)", "value": "17cc77dc779d4556755a6ca45a26565eb7c3efbeff7d973b9aeb9d167ebfe27f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347723, "uuid": "e78e95cd-0485-45a9-9592-3cba7626339a", "comment": "Malware payload (DarkCloud)", "value": "89ee2733e76117003ccbebe4d67a5665e93889d6", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347723, "uuid": "aa474f41-0dfd-4574-958c-fea9b723449b", "comment": "Malware payload (DarkCloud)", "value": "5847eb33e8b3f4a5bfb74e7a796bd31f4217394cd5e922359a927e1e5532659efe85e1193ac3406dbc724e5efcedd28e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347723, "uuid": "e29fdb04-daea-4d5e-9600-bbd2bcbdb8e2", "value": "T111F29F62850149CFD3424D79910EA184E26CF217B6BF73877A708E7D4CBF5EA3A6064A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347723, "uuid": "753cde12-f5c8-4179-a054-1b9a09909adf", "value": "768:7IIS5f4ZyQlF4ADtIgglgUSDr4O685fiAB7368R04p53fiA74O61fiACW4O6Hvnf:7TY020tIRWr4gK6d04LKe4vKxW4tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347723, "uuid": "1f055518-fe7e-4062-ad25-8c441e15e323", "value": 36195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347723, "uuid": "fc17d2ab-d52a-40c0-96cf-2bac2b600329", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347723, "uuid": "1113b385-b379-41dd-9352-f8086983fa00", "value": "Product-List.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b54938-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1690376803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376803, "uuid": "2dda8d4f-c58f-49ce-a3c0-d3786896973d", "comment": "Malware payload (Vjw0rm)", "value": "535074e18bb8158e02c210a49b608d27", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376803, "uuid": "eac52894-ed94-4bab-b43c-a109143566da", "comment": "Malware payload (Vjw0rm)", "value": "17d541ebec88f36a380096bc34ab5e358a75a02395f14ce35b067304d94260f9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376803, "uuid": "8a8f2a57-da3d-48f4-ad42-ef7a028e54f2", "comment": "Malware payload (Vjw0rm)", "value": "773c9512cb8e3629d90abbb2c61bab322032511d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376803, "uuid": "bcc6f829-2fa9-4b31-8333-5b7abe8b2937", "comment": "Malware payload (Vjw0rm)", "value": "d56996683d1a6b895cbb2fb54f4b218056f48932ed40b3b611f4f9afad00188affad265ecb24d964db8075a467f4d922", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376803, "uuid": "248f7fd5-7bde-4420-a34f-e869f24ef8c4", "value": "T117F593A43E53B23E051F2CB189321E369E8EED76CF590950241F5B3B63A34496B3F259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376803, "uuid": "97894332-39e5-4e2a-b812-910a33fb045b", "value": "6144:5TLuIztXQahBE8pyDIg+8LBEa47U+T1dk9nJbAIcKU/JaShKUHQLJrRt4/ea4lvg:5/fBLE/t4/ea4lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376803, "uuid": "3592830c-82d9-4a4f-a144-d73f1679255c", "value": 3503637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376803, "uuid": "9325b2ee-c073-4360-9999-abf2d14d7ea1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376803, "uuid": "81d9786c-f0a6-4038-84bc-36994c3caae2", "value": "ORDER-230733AF.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27690384-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690385773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385773, "uuid": "f8795f9e-31aa-4276-9a66-c24f2801af84", "comment": "Malware payload (Stealc)", "value": "ca3048f3c3dfc5345968cbfed67cf23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385773, "uuid": "5ebcc292-b450-45f8-a367-b085602eea96", "comment": "Malware payload (Stealc)", "value": "180bb4e28a2faaf8faee1afd083ddfb01782420a1a72a6545a93ec5487b58c78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385773, "uuid": "a08b3fba-5094-461b-b3b9-736245872c8b", "comment": "Malware payload (Stealc)", "value": "ad65f42df846d04605db78e9d9d724539ee2ab2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385773, "uuid": "2fd69563-30c6-4f25-a376-4d1e5428b099", "comment": "Malware payload (Stealc)", "value": "a6c747febff80d14582c3f01887eb6df386eea538b73905b683bf4256a02775442a99dfc7af8c342dfd1524a0582efee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385773, "uuid": "32ebb405-36e7-4a7c-bc47-0d34a8878336", "value": "T13844B0227590D032D06759315970CAA21B6BBCB2EB7882CB33983F3E5E712D05B75B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385773, "uuid": "0ba6f7c9-7488-48f6-8828-485cfe74b625", "value": "5ea05395629dd7cfa2fe7ed080de0303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385773, "uuid": "a1bfd27c-89ea-42b6-99ca-408041deadf5", "value": "6144:Qgw3guF95PGwRd1VQUFOvH4t4RV96snA0:nwQu5h52UFOvH4tUem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385773, "uuid": "b5c67160-1c91-40f5-9119-c50d4d07d853", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385773, "uuid": "4ae07351-59e1-424e-912d-66fa4ef59e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385773, "uuid": "6710919b-8657-4615-b7a3-923412b1a866", "value": "ca3048f3c3dfc5345968cbfed67cf23d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e2f063-2bcd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690387026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387026, "uuid": "8c2aad8b-6c40-47d6-a88c-25627493aa11", "comment": "Malware payload (Amadey)", "value": "06d0dac2eac27a5551a9bc9c8eecc4a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387026, "uuid": "e3533e49-4806-4287-bb4e-d8d68828ae73", "comment": "Malware payload (Amadey)", "value": "18ce05ff4a275f75a627fd0ece6de64a5166478f26e2a652b416144f39882b8c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387026, "uuid": "cd96442c-6c29-46d9-a2d1-038648f7fe8a", "comment": "Malware payload (Amadey)", "value": "637c3ce5dd64dfd503f4a66f45a7e38d87bf2710", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387026, "uuid": "e81fd9cd-ff27-41f4-a364-b4c6885fe979", "comment": "Malware payload (Amadey)", "value": "058388de23e919d8eba6e1e8771068bdad4e30b0e9553716c0b9d85917fb32dd2cb34a5c61606850e8cbaac1e68cd35f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387026, "uuid": "3c31754d-73ec-44a4-aea0-edfa76cec59f", "value": "T1C924F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387026, "uuid": "3fc88867-41b3-48ec-ad95-bbb0f0be3b9e", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387026, "uuid": "83e1796f-421b-4982-876f-d8d927ca55b4", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690387026, "uuid": "a566afb8-4f4e-40a3-8563-2edb4a26e2f9", "value": 214708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690387026, "uuid": "dc343dc0-f46c-4e9c-92f0-6604ab6c6440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387026, "uuid": "e6fddd16-b54d-4529-aa67-5fdeb997cd6e", "value": "06d0dac2eac27a5551a9bc9c8eecc4a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a971ee-2bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690381316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381316, "uuid": "5b93cb28-6fdd-4ba1-a066-7f055c98a9c4", "comment": "Malware payload (RedLineStealer)", "value": "972a61d7924f25bdec4e14aa028a24b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381316, "uuid": "4bf2cf64-4bf6-48b7-860e-7e3ad74f1e59", "comment": "Malware payload (RedLineStealer)", "value": "193164b83238b1973eeded37e3fa7232c66d284e4e8fda4b1d846950a8df33ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381316, "uuid": "6a20c0e3-6879-48f9-b400-bffe39003275", "comment": "Malware payload (RedLineStealer)", "value": "abb407923052de2f7f5511331224297c7ee7c1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381316, "uuid": "77efe6b7-9b83-440c-8c55-8e94557e6d19", "comment": "Malware payload (RedLineStealer)", "value": "a3ef7eeb18655958ec5c272ffe74f57b18ac5dced4f5d516d54a4d7bbc19d8db182ed580704714c7cf981194911f20d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381316, "uuid": "0fefd42a-85fb-4e84-951f-b5bffb344397", "value": "T155840203A7D49132DDB42BB05DF606C30B327CA69978876F2746A85E4CB36D0A87137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381316, "uuid": "f5933e8b-59c5-44e6-aa1b-e9fa78fcd5ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381316, "uuid": "cb1504a7-4c90-486d-b5d5-719e88ac0cb3", "value": "12288:BMrJy90eoPO2S8bwPTdvNBgBYCWreVldNqOTgeN:oynoWjb1kzdrDqly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381316, "uuid": "dc23b47b-6ac5-427c-9ba6-bb2ba2b0a469", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381316, "uuid": "67c58bb9-85a7-4daa-ba1c-acd562587cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381316, "uuid": "1c7d4852-8694-40d1-a61c-733d5df2b86f", "value": "972a61d7924f25bdec4e14aa028a24b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da900a3c-2ba5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690370183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370183, "uuid": "2357dbe0-f302-4ec0-afed-97438b049cf2", "comment": "Malware payload (RedLineStealer)", "value": "fd9b3130950ffc2bfc62b454ff744e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370183, "uuid": "af827b2b-5401-433a-94b4-21939703945a", "comment": "Malware payload (RedLineStealer)", "value": "193e9b6e5dca60d01cf466ddc227aa2f8d9831c24a73c4fa92b3435ab3de7db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370183, "uuid": "9adaa085-82fb-4ed8-90b6-e0d8d0c06923", "comment": "Malware payload (RedLineStealer)", "value": "7981899ae68b818c24904aa6fe5ac9bb610c5d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370183, "uuid": "b7a8ee23-6519-4450-9181-65869d7ac911", "comment": "Malware payload (RedLineStealer)", "value": "57bdab40d0d724afabf9ffe654170c955206d12142852cb2c920feed52b7ee71ebc4595769c6a4ad8a5803f192ea317b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370183, "uuid": "e510083c-59da-49b4-96e6-ba5f91d8f2fe", "value": "T1B084025197E88437EEF527B008F602830F3ABDA55D78836A3355A94B0CB3694E97137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370183, "uuid": "947417da-2786-4baf-b915-eab79c773c72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370183, "uuid": "4e34ff29-0ef2-4fe4-8c89-ad7d2fd50a77", "value": "6144:KOy+bnr+Hp0yN90QEndbikkWcnZNbQR5Ya9BtfESEEfB/nISm/jwveXcCrB6Tn:OMrny90td+pnSESB/nIIveMCrATn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370183, "uuid": "be271791-395b-447e-bf2d-d105dbecd160", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370183, "uuid": "6f89d8a0-c86a-45ca-8065-dd3929d2b701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370183, "uuid": "d874c905-d084-4055-a41f-23ece0c7cc14", "value": "193e9b6e5dca60d01cf466ddc227aa2f8d9831c24a73c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042082a7-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408048, "uuid": "52035473-7772-42f1-9222-a9e1a40ce78d", "comment": "Malware payload (RedLineStealer)", "value": "a29db94f70c9189229e5ff4c9f659ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408048, "uuid": "bdd7f9cc-f7ce-4198-8632-4d39ef7a1ccb", "comment": "Malware payload (RedLineStealer)", "value": "1a9b5bd2f3672c9217afd2d074169fcddb935fea9774da1c997759c355e3315d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408048, "uuid": "6510c16e-a2b0-4214-8232-a92aa491ca61", "comment": "Malware payload (RedLineStealer)", "value": "7c14be17f1ed9c1b8b2b22cbad3be95ad1de7d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408048, "uuid": "d91a430f-dd4e-4cb2-844f-5051c96e220e", "comment": "Malware payload (RedLineStealer)", "value": "c72242bce5b79b3cc667dc2647518f37d48e47595736005dec251980eb707233725296eda9daa646ac2c63a17b632e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408048, "uuid": "aa58fe65-4bac-4ee0-b8d6-23d36411d683", "value": "T142840113F7E48473D9B5277018FA02C30A327DA29DB5C3BB2755A89A0C725E4A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408048, "uuid": "d4e4bad3-45e4-4bed-b0f8-78576749ce93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408048, "uuid": "664ef604-8b73-4cfa-8f9e-e7a3b50f6085", "value": "12288:uMrxy90U17i+cLXcR5FLHUCV5mNfgZGG:fyi+cLXk7DCgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408048, "uuid": "a5befd61-1ec0-4d01-a630-7ba25263ba97", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408048, "uuid": "0577503b-8678-4035-85ba-9215110810c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408048, "uuid": "204c61b1-ad74-4741-b265-677dd12d9ce9", "value": "a29db94f70c9189229e5ff4c9f659ca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273a5008-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690365587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365587, "uuid": "3ce71c32-bb08-49e7-9d65-895920d1a18b", "comment": "Malware payload (Gafgyt)", "value": "10497d579ff3d2dd4d81df697da705dd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365587, "uuid": "f2cdeab8-b63f-4a85-9b8d-03d59a166ce9", "comment": "Malware payload (Gafgyt)", "value": "1ad891f3af791977b9a2e3d9f8acdd13d5197c6458381af9422d04c290a47657", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365587, "uuid": "26cfe966-019d-4796-8811-11f80b89054f", "comment": "Malware payload (Gafgyt)", "value": "1af39c5be575942467df9337cde770d3e212c6e2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365587, "uuid": "4b32ccab-0611-4139-a620-af9dce678b36", "comment": "Malware payload (Gafgyt)", "value": "8f99a1cb9f3df9a26cd3719ea294cff75e58dc40e5da64d9216b815fcd079f8be9670b365cff6010028d338a65def826", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365587, "uuid": "f388328a-ec5a-4d52-a573-854e00b240aa", "value": "T16343955A6E228FEDF76C823407B30A31A79873D636E0D6C5E6ACD5042E7034D545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365587, "uuid": "8a3b2a3a-70f5-4fa7-a3ed-ecb0418b93e3", "value": "768:/GY6HlvCTBmX5hbf7XzjrfIVC91pPZccy0Yxe45xQNVInnbCl:6w1A3jDfUaUxeCxQNVYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365587, "uuid": "b1e8eb3f-0f8f-4866-aa56-f0d65b832e3a", "value": 56120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365587, "uuid": "9c7be90c-7b25-46f7-9db7-11a0295e3feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365587, "uuid": "9113747f-96d4-45e1-aeb2-94f3677ffdfc", "value": "condi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dd92bf-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690386731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386731, "uuid": "deb42716-7f24-4c99-9088-09e9b4e08822", "comment": "Malware payload (Amadey)", "value": "bb0753dc0f21ba5b88f9efdfd5760f86", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386731, "uuid": "61e379c5-2bf7-4e42-a507-2a3982891788", "comment": "Malware payload (Amadey)", "value": "1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386731, "uuid": "f6b9ff82-903f-425d-94f9-cfe4d6fc87ff", "comment": "Malware payload (Amadey)", "value": "ed86f97a30aa9d415af373a150da9ed444cc93aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386731, "uuid": "e8445d4e-a83e-4c39-a50f-4d0869baeec1", "comment": "Malware payload (Amadey)", "value": "a66d0159f586f4ba5107a0542a39eed2920381bbf942b70fc395019dd4c75c0b1316323ac4460e80a0a0310164845899", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386731, "uuid": "ded40f53-463d-4b69-9cbb-1f432cd7bc46", "value": "T127840112B7E88073D8B5277064F613D30A36BC625D74936B2B85AC5B0CF2AC8657277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386731, "uuid": "b6ccf042-676f-441a-a5bc-067d1f244c3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386731, "uuid": "c2fd43c5-78be-46b9-b6bc-85fd21fff849", "value": "12288:/Mrvy905HLz6SlnopjauhTjgBYCDSViHApFnQA:UycrPlnop2upczGViHAp1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386731, "uuid": "a525f93c-0822-49dd-8512-be10853e4736", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386731, "uuid": "2c97214c-6e27-4c93-9ab3-9f978000d71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386731, "uuid": "2cb5eb01-b527-4642-8df6-6525e6c92a67", "value": "bb0753dc0f21ba5b88f9efdfd5760f86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8aa36b-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356950, "uuid": "7e93e35a-f2a3-46f2-b50d-26d2a3e971a2", "comment": "Malware payload (Amadey)", "value": "f721e921a1d0ce588d0614c7257f90f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356950, "uuid": "738cd74b-6bea-4d68-8b74-f225e07743ea", "comment": "Malware payload (Amadey)", "value": "1b3c0e579787bcef84732f5265ff9b365cdc639dfb3b301ffbfb808167567506", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356950, "uuid": "589e2798-524c-49c7-a754-60d0dd057f6d", "comment": "Malware payload (Amadey)", "value": "339b731d73e585d123b3243ef3f3f95ecd92e4d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356950, "uuid": "3fe7d23b-2e7a-489b-9cba-9caa4ff8a1b4", "comment": "Malware payload (Amadey)", "value": "5d6c8e0ac324fb75bea024ce90a07f2ae5689283cc088b0298986d20bc75aa072e415a82b79eef5ea60dfa3d2980d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356950, "uuid": "aa8b4bd6-e690-4aac-9fde-284f023857a3", "value": "T1DB840113F7E89032D97517B018F712C31B367DA19C78936A3786A84E0DB3694993272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356950, "uuid": "bc8d1462-96f6-4fe5-a9cc-f448e0c7da30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356950, "uuid": "5d6990b1-ecc3-4616-9cc7-004d9e526599", "value": "6144:K9y+bnr+/p0yN90QE/TmKPN4KfD+HXyLx+SPntq302ViNF4XLmMdmIi5:zMrny90lyMGKfDwaPO02ViNF4zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356950, "uuid": "a9017234-43fe-4141-b226-3c4de52e74b0", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356950, "uuid": "b541560e-8a83-4d89-80a3-292b6c354ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356950, "uuid": "f12a3b8a-8bab-4d19-a7e9-e08f78d8efa9", "value": "f721e921a1d0ce588d0614c7257f90f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411ecee7-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690376797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376797, "uuid": "c441290f-19e0-47f9-ae3b-4b020af8a46b", "comment": "Malware payload (RedLineStealer)", "value": "fd521013454248e86a636512dbe3d338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376797, "uuid": "7883d541-5064-4010-b91e-833b78b8c4b6", "comment": "Malware payload (RedLineStealer)", "value": "1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376797, "uuid": "11d10f13-1a25-4cde-82b6-efca94eb7140", "comment": "Malware payload (RedLineStealer)", "value": "2c2b97dee16c2d7ced7d76ce594e03270ecb9e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376797, "uuid": "cc439ebe-0a31-4808-8a21-032408b0259d", "comment": "Malware payload (RedLineStealer)", "value": "fe3d484028c0f1ac43f5d1982992dc8cbea85a47dfa6212df2f90c563be84493c4243685088e58af981ddc4ef5d0f10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376797, "uuid": "c3ff8f37-d833-4eac-9874-a679af28ec15", "value": "T1B7840103F7D88076DCB1577058F603931B3ABCA19D74836B2A45D96E4E73BA4A83172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376797, "uuid": "f8010777-d64e-4805-9353-b3fbe5c6abf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376797, "uuid": "5feac91f-120b-4e51-b920-f6e18e6d27fc", "value": "6144:KCy+bnr+Sp0yN90QEnJi2omMch2DFto8CKsEIxqySgBZ+t4eDCpUDozUP:+Mrey90NJ7omMFFt+KiAgBYCe2pkozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376797, "uuid": "074e0017-618f-4436-ad98-02412a1b1a6b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376797, "uuid": "4d824342-ffc7-4df5-a9d5-713638843326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376797, "uuid": "447d89f7-4598-4ddd-ae4d-9fa2fb1a304e", "value": "fd521013454248e86a636512dbe3d338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be316ed-2bea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690399632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399632, "uuid": "c2b0bd80-7e61-4dbb-9508-e0d421e73512", "comment": "Malware payload (RedLineStealer)", "value": "11e2fb36741635604d1dc6a3474d93f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399632, "uuid": "4c739a26-675b-4749-bd50-eb1b23c0b8f2", "comment": "Malware payload (RedLineStealer)", "value": "1b763eae22a721a18ae6c70c91703fa179513aead9d5d327b44255d6664b34b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399632, "uuid": "a3ebd9bf-6b7a-4b1c-8d78-e64611beec00", "comment": "Malware payload (RedLineStealer)", "value": "b57638bbe9ca5cf792c4d6566361fa1882846773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399632, "uuid": "54c71c02-f452-4072-b8bb-4caa66f668de", "comment": "Malware payload (RedLineStealer)", "value": "d6e4a93bb020b5ede984d72d58874b0a573297b80dee25f97afb17e92c9172bbf0869fe563e29ebe37e0891b520882e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399632, "uuid": "55bb732a-16ea-4a59-b4d2-a0c276f3fd12", "value": "T107F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399632, "uuid": "d72b0988-6f74-480d-9431-2afac5972e60", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690399632, "uuid": "d2b25e2a-0a43-4375-97a7-b8fc7643a9a1", "value": 34914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690399632, "uuid": "d09a41e0-5876-4f04-be44-4e9e4a165386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399632, "uuid": "45cc5f2f-deb1-4f00-9960-59c41db4e935", "value": "11e2fb36741635604d1dc6a3474d93f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cd30e5-2b7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690353022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353022, "uuid": "1d042468-1926-4bb5-a53b-a7fcc128e9b6", "comment": "Malware payload (AgentTesla)", "value": "36f8ef6bb5f1eb0e31788497a53277f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353022, "uuid": "3ccf12f3-abf8-42ed-a15a-4edef1e1a9c4", "comment": "Malware payload (AgentTesla)", "value": "1ba931f3d786284d056bd83659afabe498c61c999fd5d64837da8c2b737e3746", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353022, "uuid": "08edfa74-4d52-43b1-bd6e-4ebaaa817d4d", "comment": "Malware payload (AgentTesla)", "value": "c2da68d0338eef8506288d2c706518635153a9d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353022, "uuid": "eeb753cc-b1da-4add-9d7c-f3726d5eb3be", "comment": "Malware payload (AgentTesla)", "value": "a0c794a6f1cbe2b8f3475902ebce629e4a6915d88df4143abccd47c4db1f7f8136f4bb2dce3a13b688c61077074bf311", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353022, "uuid": "f9c5bfbe-25cf-49aa-89e6-cf3d7ec7368d", "value": "T15D05AE34A2B890B3E11A6A358D4AE75848247D303D34A4BB6AFB7DDCDA7B243F4151D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353022, "uuid": "07c11a14-7fa2-4532-b4d6-e59e493100c7", "value": "c4867fc7f459baf2209064e6b84b9cd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353022, "uuid": "91c8efa0-2ebf-4452-a22a-869bd1e78bc4", "value": "12288:AsgeyDZ++kHOFSOYloGEa7IlS9yfZnwABjXjibbS5GdxWgy9cAjG4:xgrbkuFSOYlo1a7IcWZnwOKbbMjcAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690353022, "uuid": "405ef737-50a7-444a-995b-9b5fe8cb3612", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690353022, "uuid": "658cd68a-0e5a-4646-89d1-81a7647564c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353022, "uuid": "bcbc7125-68b7-4591-990c-d900a80da238", "value": "Commercial Invoice PL#1009 - Urgent,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74ccaa3-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385639, "uuid": "6de31215-b290-442e-b8ad-c4712fa7d0ae", "comment": "Malware payload (Formbook)", "value": "c11d8d5a44eb9bd5066e8c45c97bfada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385639, "uuid": "07c1b1dc-ac71-4fac-b6f6-899cf287469f", "comment": "Malware payload (Formbook)", "value": "1bf9eea6de3a59ee58e13e33175ffdd66c6ba4a187b4df949593853c43784afe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385639, "uuid": "95d52f8c-7c9c-4da7-94dc-823a6ce8a241", "comment": "Malware payload (Formbook)", "value": "59a57dc5daf19268d52b2214101efc1af2b5a853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385639, "uuid": "e0c68c78-a39d-44fc-b28e-91b929990951", "comment": "Malware payload (Formbook)", "value": "538ced88c0f003b93f9da0e9f06da74492c62585c9d3953412860515b14ae275460180164d0fa622ab89c9686b488415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385639, "uuid": "84907b08-7001-4b37-963b-a1e203764038", "value": "T143D42211A2BD9726CCF253F511E041104BF2F99F913AE2895EC661DB9A73F101BE0B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385639, "uuid": "c0254e2d-3bbf-4ac9-9aa4-d3a83e3c4196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385639, "uuid": "43b34dc1-61e1-47bf-a272-edd1b81b0202", "value": "12288:Tf2iN2GULiRrouFF/14R9Yyo4qg+uNznb3JRq8phyn+lUW84Wb2y1tY/j02E:Tf1xULiRro8iR3qgtb3JRq/EKb2y1WjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385639, "uuid": "1180f0d0-e0e8-4f44-8dd6-daaba4b07d84", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385639, "uuid": "9d723082-ef69-4dee-8d46-f12f70ef8b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385639, "uuid": "6e83aac5-3d26-4359-973c-976b463eb3a9", "value": "c11d8d5a44eb9bd5066e8c45c97bfada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9121b6e-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356034, "uuid": "32b4537e-92cd-4644-9862-805b62317f75", "comment": "Malware payload (RedLineStealer)", "value": "232287f5d562489800292f58e7147c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356034, "uuid": "ca5c26b9-3c5e-4bf4-8e35-feeb968381fb", "comment": "Malware payload (RedLineStealer)", "value": "1c0cc29edf3fda05ac6cd12ee7acdaf9ca6233c60ef212f53b42d088f670c7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356034, "uuid": "0ba56378-82f4-4815-a3dd-8380d6bac4b7", "comment": "Malware payload (RedLineStealer)", "value": "6b9b9011bd9a0580c06a3777ca9b55fe2795ca43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356034, "uuid": "179d146a-73b8-4ca5-a2d8-6322a4912268", "comment": "Malware payload (RedLineStealer)", "value": "6d30d263dd0ab3034bb8ee1cdf53c432b391acc55671087f54c3dd339f5bb584732cb52f3c2159c86c8ea7369d6805e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356034, "uuid": "c7f306df-fa05-40c9-8a52-18a9d7e2ec4b", "value": "T13A840202A7E84137D8B123B069FA47970E36BC91DDB843AB3345985F1CB2AD1E57173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356034, "uuid": "12b412f7-0a13-4909-a345-120c8f8b1f94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356034, "uuid": "26c0cbb0-582d-4d8e-831a-d347cb79ac08", "value": "6144:Kxy+bnr+ap0yN90QEpKP4ky5OqsVrV8q/9uYF0JwNampLy4dom+/2YLxSjr:LMrWy90ziVrV8qP0JcXpv42aUjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356034, "uuid": "0501a22d-8d96-45f1-b3d0-44bb9fb4ed14", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356034, "uuid": "64a6fa8b-2f01-4f2e-8fc0-26203c073fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356034, "uuid": "7855bb6e-a21c-4f5f-897b-35a6c08aee97", "value": "232287f5d562489800292f58e7147c69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc685b4-2be9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690399045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399045, "uuid": "860ba6a0-137c-4396-aa76-9c9a5530483f", "comment": "Malware payload (DCRat)", "value": "1dbf7897291b0de35d85ed6c7cc453b4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399045, "uuid": "e363481d-8a91-4fbf-85cf-297eb61dc126", "comment": "Malware payload (DCRat)", "value": "1ceae668356dfed36c3764b532862d5ba0a53f1c509a1463a34d3680a927df99", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399045, "uuid": "09a5ae13-1b88-490b-a3e5-f605d9bd1e9a", "comment": "Malware payload (DCRat)", "value": "d502544ec44e44f48039080c947c0798c846ee55", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399045, "uuid": "9d13d77a-cc14-407c-8e5a-ec4028161050", "comment": "Malware payload (DCRat)", "value": "51355105e5c21b396be899edd4909eb8f46332261ef628b0474cd6677516d2b416cab74e69f7560e395c4747abaa38a7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399045, "uuid": "c5a12d50-0a4d-4414-a0f1-00fa7cfeaf92", "value": "T12205E5027E44CA99F0095673C1EF420887B5D9516AA6E32BBDBB73BD15123933C1E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399045, "uuid": "70c9dd65-e8e7-482e-b8f3-3e9be17eb5b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399045, "uuid": "ca1f429c-421f-4831-9404-1dd028dcfb86", "value": "12288:rJ4q1CZGrBED1oMWFphy/i9U8KBTEuMdPhD:rZC8rBEDMFpaBWdPhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690399045, "uuid": "c228a0ed-2673-4a6d-be93-0641a3126af2", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690399045, "uuid": "4e495324-4893-4fbe-9cd2-4b36a8900f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399045, "uuid": "483f1250-499c-4daf-ac61-b9432ebcf901", "value": "1dbf7897291b0de35d85ed6c7cc453b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcc772f-2b93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1690362323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362323, "uuid": "18d6f97e-6b43-4947-a29a-1437819d339a", "comment": "Malware payload (Adware.Generic)", "value": "58a34176496d2ff9264b9990d41d930f", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362323, "uuid": "1c3e7fb1-924a-44f7-bdfe-015d7a443e0b", "comment": "Malware payload (Adware.Generic)", "value": "1cecb5f04b2bb2994f2f5f3f9413de052a28a33f7efbfa52fa8b71ef47b5d8c5", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362323, "uuid": "995bf46c-9cda-467b-89aa-040a56d68b8b", "comment": "Malware payload (Adware.Generic)", "value": "eda2b129882af31e7b94cb32509027542ce9862b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362323, "uuid": "fd4c579d-85ec-4345-b161-f18a87f9fb64", "comment": "Malware payload (Adware.Generic)", "value": "1cfebbe2b48e990eded76b9dce3acdb3106a5ecac8b18eea5b141103bfd66014c43622244ab76f2b9da7b481dea3e31d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362323, "uuid": "959cf455-9851-4310-824f-f89d2dfb5b9d", "value": "T1BE56BE1177F85E72E16AD3B3D5B1542363F0FC2AB363EB0B2151667A1CB3B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362323, "uuid": "5ba1d42a-ccd4-422b-979b-90c03e4e847f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362323, "uuid": "75fe2b36-6edd-4150-be82-50c3a69ea7ef", "value": "98304:YGh5ziNlRUaub+MPDrc/c+NmXnKyFrsqCkHj92AYawl1WPOl6NVLkJ0xWE/8M:Y3NlqaubXgUCqCSBjxIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362323, "uuid": "84495120-3f04-46fa-9382-7314b984fa77", "value": 6351872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362323, "uuid": "cd2c11be-060f-440b-9362-9a9d8221494c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362323, "uuid": "d671b17e-dfb3-4667-b034-a65ba1b0c44e", "value": "OperaSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d7599d-2bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690381318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381318, "uuid": "de60d01f-dd03-4aca-9f80-ae501bc1b2eb", "comment": "Malware payload (RedLineStealer)", "value": "842953f98a2e094b866e9f17b5542f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381318, "uuid": "4ae1b489-7519-4dd6-9941-541b99bd562b", "comment": "Malware payload (RedLineStealer)", "value": "1d1378582f0465bf2d40d4fe516999a46e2936f5f509f8a6a639fd1857158d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381318, "uuid": "fc6a2f8b-286a-4776-b7d2-24042e887a55", "comment": "Malware payload (RedLineStealer)", "value": "6270761bbd6cddd4ac7ecec26670421cca66015e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381318, "uuid": "88cd7eb5-6ca8-4c4f-8c32-52ec67b7b336", "comment": "Malware payload (RedLineStealer)", "value": "59e60ef2bd67e1b34beea339bdfce4ac5815db2592f81d7613c3ca95fce0d84e7d2e1aa2f608db78128f57e9e62efbb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381318, "uuid": "cfc2a976-6c71-4162-bca9-1f26c2bf573c", "value": "T1FF840213BBE85073E8B5577058FA02831B367CA2AD7C826B2745699F4CB36C0A53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381318, "uuid": "38c615ca-1a8f-4631-8c4f-797aaf2566cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381318, "uuid": "f3e0f1ea-0981-4492-bc5f-0fffdf90c7c1", "value": "6144:KHy+bnr+jp0yN90QEytO1SYcmY/CfWmvbgACRFh1REDI51u7Vn3BdAMV:xMrvy90QtOFcmACvNy1RE+yVngi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381318, "uuid": "59be8ba0-8937-4575-95c2-c98b9fea40ce", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381318, "uuid": "a3850f9f-cebe-4390-a418-f4d9a8494197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381318, "uuid": "8f903311-bff6-41f5-9294-c1a8731f0394", "value": "842953f98a2e094b866e9f17b5542f1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b0d92b-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356028, "uuid": "b8657ba2-0aac-4a6a-831e-bb798d71a8c7", "comment": "Malware payload (RedLineStealer)", "value": "21026c9599514bae90aaf79dc0254d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356028, "uuid": "63afc4c6-c084-409a-82ad-790970f5c564", "comment": "Malware payload (RedLineStealer)", "value": "1d1fee0a22c1c8f6a5cee07540dbe7ba8d3a0ff74fd316ba0a910fdb1f471da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356028, "uuid": "e588f334-4802-40ce-b670-c65ade1e301a", "comment": "Malware payload (RedLineStealer)", "value": "a6dd30bcfde3d0899e3970b073e2fd162970c690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356028, "uuid": "219cf094-bf31-4359-b53d-d58a7b24fbd0", "comment": "Malware payload (RedLineStealer)", "value": "99870de4df5a3fd465f0989557bacc61585bc7bfbf16817f039f288aecc8619fb03e161a891c7e11b0d08508dd5c78d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356028, "uuid": "3d8a7f11-7713-4729-8df3-fae67c93c351", "value": "T15E840242E7E88132D5B26B7059F602D30A3BBCA1AD7483BF3795984E1DB26D09572337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356028, "uuid": "478a7160-67c2-4fe6-b7a1-1847dbee115e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356028, "uuid": "fee412bd-0c12-434e-b7a6-bd599c8cf299", "value": "12288:5Mrwy90crORejpL8wWzoFV71YcSkSJJJgLU:5yfKA2oH1YNkSJJJAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356028, "uuid": "5c07e6e6-b172-42e1-8920-898696b54c37", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356028, "uuid": "b528add5-670e-4774-8c0f-fef3512aae14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356028, "uuid": "461f7b4d-14e3-4760-acb4-233092b0edd1", "value": "21026c9599514bae90aaf79dc0254d05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45a39cf-2b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690366280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366280, "uuid": "f2e89ddd-51fc-4082-adac-39663abd5902", "comment": "Malware payload (RedLineStealer)", "value": "bff884bb4545a9a95edb6cf9dfc29580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366280, "uuid": "481d6f60-9dab-4dd3-a5f6-3572c549e23b", "comment": "Malware payload (RedLineStealer)", "value": "1df0c5ca89dfc7f09c4e9b79ae3630e113d5578799714964a95c342b57e2d100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366280, "uuid": "8815be59-8416-4f35-996d-8139c0c266d0", "comment": "Malware payload (RedLineStealer)", "value": "9e7468d2e7599b2eb75fd0dbd8ececbb29487f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366280, "uuid": "719a063f-0d1f-4be7-a8b6-fb1edb27d59a", "comment": "Malware payload (RedLineStealer)", "value": "2941b724efd782e0884610d1654c108df23e7eac2fb4a82ae8c486bde1bec5ddfe3d3955981137438023a458a7dd68e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366280, "uuid": "66ee4b6d-585f-4576-b4fa-7f78324e0ad2", "value": "T1FA840246A7D89172DCF52BB018F603D30E35BCA19EB8535F3785A84E1C722D4A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366280, "uuid": "0881b860-e2ba-46af-b8d1-bc9b34dd765e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366280, "uuid": "c9f9952e-b57f-4032-8f87-bb4e0c2fa361", "value": "12288:GMrZy90lrcGE+hF4HqoYnWl/gBYCL4l5qm:Dy6uSn1zFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690366280, "uuid": "5ca89374-037b-4189-bf4c-d06cdcffe889", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690366280, "uuid": "88d6aecf-90d8-4cf0-8a13-8ed9b15d8542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366280, "uuid": "2ad7e60a-2fbf-4144-b02e-f8acf6f0d26f", "value": "bff884bb4545a9a95edb6cf9dfc29580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd69cbe8-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690351343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351343, "uuid": "22e92ecb-8fcf-482d-9e88-5ff78fc78014", "comment": "Malware payload (Formbook)", "value": "6222cf1b976d611cd061eae1ee7f1472", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351343, "uuid": "310b47d1-1e94-4928-957e-f394d360e9b0", "comment": "Malware payload (Formbook)", "value": "1e8a154e8dddf328932a06c1af734d6bd74ff4bea94a8f7f9767ff3a953e5dd9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351343, "uuid": "6baafef4-bf08-4c4e-94ec-4d091a6eec6f", "comment": "Malware payload (Formbook)", "value": "b22184717953f9786eab95ae01310407007a570d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351343, "uuid": "4dc9b7ad-5079-4bb0-8895-bf134a16f691", "comment": "Malware payload (Formbook)", "value": "36583545c5947a33679f2b728f8bc3259f5a003480373c12d9cebd23d55c65de9f4ad662d0302a9936e8c81b143d7fda", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351343, "uuid": "77e540e3-e057-412e-8c6f-705cc8bc251c", "value": "T1D034237610EADB498C66F25B2AC615BB4DA3134C56FED4AF998CA3D30ED68C370C91C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351343, "uuid": "5c9d7651-1c3f-46e8-950e-d3702e485261", "value": "6144:7eehPctTzoMrZxM/0sXQKEsWT/kMJQwEAYVFt2gVBuoGapjyDpc/Y:6ScpzxZxDfT/kHwwVFt2OBl+QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351343, "uuid": "5c952374-06b6-4230-9d2e-0bb35b173556", "value": 245069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351343, "uuid": "c2da4e53-dde9-40da-bd38-d5ad5136fbb7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351343, "uuid": "f1a5c349-8130-4bf5-815e-e2d6f348b1c1", "value": "Revised invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74aca328-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690351114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351114, "uuid": "f3597cf3-11aa-4ff2-9a16-397a6358d323", "comment": "Malware payload (Loki)", "value": "0c7c1c5574f56f3c27cb140f6a32b348", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351114, "uuid": "897461fb-244b-4054-8eb1-76065e84986d", "comment": "Malware payload (Loki)", "value": "1eb33459bed65793b12f96a80c0208e0560ce711793790bfbf2fdd21585974ad", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351114, "uuid": "671698ce-2bc3-4979-a76e-468e79952d95", "comment": "Malware payload (Loki)", "value": "811b44495f1b7381f8e971d960a67c840c16046f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351114, "uuid": "3957923b-57e8-4be8-828b-7b0bdeb6109a", "comment": "Malware payload (Loki)", "value": "f93f2752b0ecf28444580fd56a1c1d41502ec24d75fa04a12711f8b022a898ac7e8bbf9be4479e6ab03cad8f17587adb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351114, "uuid": "dd43b26d-0f35-45a5-93e0-9874de876dc8", "value": "T1E1B4230C97D92DF325B64B045BE360B8B60AF16E3407D0FC64AB9F52BF14258D65368A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351114, "uuid": "608945c9-35f2-46b6-bd07-9d9270f2ee97", "value": "12288:atFSNePXFgpwr/R2dm6WdvYdqY8uCFYT1ItIOki+S:IAeXyCIdm6WZ2qYMFYT1fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351114, "uuid": "648f4ea4-88a3-4636-b96f-491e22a82a5b", "value": 494964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351114, "uuid": "36762a4c-375f-4cd0-b630-a1ccf4f28e83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351114, "uuid": "3050ca5a-e5e5-4e93-b3bc-14c9d2c21813", "value": "PO#130460.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee6da0a-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690384927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384927, "uuid": "90f95c0c-c34a-46a7-a73f-356b20340d20", "comment": "Malware payload (AveMariaRAT)", "value": "a5ac323eb154760c08e83cb26643b3b3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384927, "uuid": "22b5c543-7e9a-42b1-98c1-533fbba8c3ca", "comment": "Malware payload (AveMariaRAT)", "value": "1f32b6a5b5b88e7b31eab4461d59dc67a228745f65da06d63272a59d80079b6e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384927, "uuid": "c9d9216e-b12b-48e8-9e90-e062911ff7b5", "comment": "Malware payload (AveMariaRAT)", "value": "2b806ab7c3c5269d1c304bffe0f034ca24ae41c0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384927, "uuid": "c2097b92-eefd-42a7-a50d-82d7173ac2ec", "comment": "Malware payload (AveMariaRAT)", "value": "5960ccfe2abcbc223a9285f29fed0a24c109449ee7fea9d7c30862d123a2b79171591d8ad5b90e02dfbd956c2cac5395", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384927, "uuid": "9d36b649-be08-4948-b413-e796bf2766d2", "value": "T1C1F328497690B5DFC867C931CEB9AC64EA24B87B471B8203D41316DC9E2CA9BDF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384927, "uuid": "f00ff21a-829d-44db-ba84-d454a9f7987e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384927, "uuid": "2a236a46-d6ac-450d-989e-679d918549d1", "value": "3072:IxGbpQi1W0p/Stz/dAMhdF2jBCmLdjaf3k6aaICeO:mGbpQi1W0p/Stz/LLvmpjE3EaICeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384927, "uuid": "b7dbc7cd-6de1-400e-8cf4-c1d0cf38722a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384927, "uuid": "ec64bee8-19e5-457f-adf6-b818503cc576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384927, "uuid": "1b09e3f6-9f59-4256-97f0-32907a9082c5", "value": "82fd59ed-fc15-4398-822a-b6fbbf452705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030743c5-2bbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690380129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380129, "uuid": "06f29ed4-a6e5-4056-aa9b-bac62760ee38", "comment": "Malware payload", "value": "ba02d7a5d1e69903caf3fbb7d834fc21", "object_relation": "md5", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380129, "uuid": "e9167fb1-d50b-47f2-a95f-d03e9ef00284", "comment": "Malware payload", "value": "1fa698b15f19f0eb7f4e72933740ffa4d0d8963f9659ea94bd0c7456e167e39c", "object_relation": "sha256", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380129, "uuid": "d16d3481-e496-4c0a-b3f0-b066dea61e10", "comment": "Malware payload", "value": "fe9f0fcca12516528922a459ace7517dfe8bedb6", "object_relation": "sha1", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380129, "uuid": "3625534c-3cf7-4db0-8f88-6c6d044667a9", "comment": "Malware payload", "value": "c715e0aaa7304c920e0c52aef0bb562dbd7c70152cf6606f20dcba12fdfa064d3df8fa8e2d54d3214dba79bac7ad3bd5", "object_relation": "sha3-384", "Tag": [ { "name": "GeoMetrix", "colour": "#471E5B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380129, "uuid": "405391dd-d4cf-4332-bc45-9163eada3214", "value": "T170273352F15277C814D60EFDEB0882AFBCDD13159C9A418F499BDBA8A5C42C39F4AD23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380129, "uuid": "a016950f-4c34-4794-92bf-7c6ae688d07e", "value": "393216:jF4B4NpLd+wJABxGK09bC3QYPO9qYZTypf6CsfigACf9eL1uT5DYJwe:pVNp8wgsNblYP9aTOJT1O9YJwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380129, "uuid": "991b1107-feed-4531-ad6b-ea7834489e7d", "value": 21822031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380129, "uuid": "7fb750f2-9ac7-423d-bf28-896b767fc9a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380129, "uuid": "1d309f51-6237-444f-a3c0-5b8b88d724ea", "value": "Gmodi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e96776-2c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690414836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414836, "uuid": "8f272300-b245-48f3-a779-cbeb92a84394", "comment": "Malware payload", "value": "7fc379eee10b79726fcd7a2f6753bca8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414836, "uuid": "ede34df3-d62f-4287-afd1-d53634accb7c", "comment": "Malware payload", "value": "20ae918236cf658ef9fff19ec4db4969b81a66e41748640c2eaea70ccbbcad23", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414836, "uuid": "656981ab-730b-4e61-8a35-424c6d1a8853", "comment": "Malware payload", "value": "5b658821e36777367f06547e9517a862d9f0d1a8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414836, "uuid": "0f05058a-9117-44bb-870c-859c8f6d825e", "comment": "Malware payload", "value": "f16767b95b12add1a05a3fd9fb4681c24c57d4d4cb8ab5eca9af0726e8c83dfe313dff062d30c0e84472e20a91cc7556", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414836, "uuid": "aa32d068-2254-4d54-a71c-72d8ab669e43", "value": "T104327C2FAAE41A6EE31710BA40D82109F6B574835A2D9E1B7AF0E5F9CDB13CD5F01394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414836, "uuid": "6ca43289-6b34-40ef-8279-79e95906e37a", "value": "192:fya0N2NfVWhARgZVPCK44AG9xXSJ+Ej71JYTKwEKi5FWYjcWe3zO:fyX2NfVWhANK4499xXSJf71JYT+SYjgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690414836, "uuid": "d840c532-c5ca-4f64-9042-1f711e9c013d", "value": 11087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690414836, "uuid": "76c548f5-9886-4a73-a733-24754d9c75ef", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414836, "uuid": "f3f2ae2a-804a-4480-b179-aaa1d44d76d0", "value": "7fc379eee10b79726fcd7a2f6753bca8.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379cc646-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1690385801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385801, "uuid": "e1840d70-a5fe-4aa4-9940-041a60071233", "comment": "Malware payload (Rhadamanthys)", "value": "2df701e38a101115e0a86673e5f63d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385801, "uuid": "b3ec3500-a2a9-4d4c-b79e-57e89b158988", "comment": "Malware payload (Rhadamanthys)", "value": "211809c137b352584707b7d3b254df7e9b80302615f758ff8060b535d8804945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385801, "uuid": "2f918ade-2e2f-47a2-a24e-232820aabf7f", "comment": "Malware payload (Rhadamanthys)", "value": "0ac10d378ca80cb8a45b3ffdf692924dead3b612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385801, "uuid": "8456f193-126f-497a-a4a0-38e4f358c09c", "comment": "Malware payload (Rhadamanthys)", "value": "3046a92855b5e894453c644cd97bc59830d4dd74ab8d97fb9f91796677e51a755baffea2cdbd1bfc8c8ce096c2f940a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385801, "uuid": "c6065833-666b-44ff-b37b-d23e0ed55cf0", "value": "T1B204AE5A63E421A6E4BA537594F302935A31BCB29B7582FF22C4C57E0E336C0A532F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385801, "uuid": "a0bb61fc-7f51-4c54-ba7d-e9d05e9311b2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385801, "uuid": "36bab99b-783b-4154-a4f1-77910d545a27", "value": "3072:WahKyd2n31C5GWp1icKAArDZz4N9GhbkrNEk1Lqoqx7nVT:WahOyp0yN90QEqnqxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385801, "uuid": "b9de5eb7-5934-492b-b0b1-2b6109c35531", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385801, "uuid": "09b5633a-a3f6-47de-b84b-d9ebe8721869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385801, "uuid": "5fe340c1-2014-4a49-b060-524e4a09e59a", "value": "2df701e38a101115e0a86673e5f63d83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f5ef07-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690377042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377042, "uuid": "27d87a8a-82ab-41a5-bfa3-f9bf33c1c1e5", "comment": "Malware payload (RedLineStealer)", "value": "7bd22a0b43c1e2a58c7ba84259eeb82d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377042, "uuid": "fc2f02ba-9e3f-44b4-ba79-86588eb7b1e8", "comment": "Malware payload (RedLineStealer)", "value": "2147210208e3b43e9406b311cbf79a9752e6ef6641cb7f512e87f3e4a3ac57f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377042, "uuid": "4e571910-0391-48df-81a2-79365e3c9c69", "comment": "Malware payload (RedLineStealer)", "value": "2014b7f40da9941d615a0973fea7f1ce053adef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377042, "uuid": "fd285a6f-b26a-4994-8b5e-774244e8643c", "comment": "Malware payload (RedLineStealer)", "value": "17959c46c64490aca6d875ae605b3e09fa293d3051a728615b0b57f824b3dd4af04c8aae33c6e93bd2e8f6a6eb3d964a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377042, "uuid": "8315ba8b-7a8e-42b9-a672-f1f38d7174f6", "value": "T1B9840213BBED5472E9B517B068F207830B39BDB2597C836B2355992F4DB3290A43532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377042, "uuid": "ca1e0a03-9fd1-47c6-8239-eb2436fcdb6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377042, "uuid": "65ed9b6b-a1cd-49ef-b201-76548f993d2a", "value": "12288:NMrCy90yoJ9RpyYZvQQn39OQxNIgBYC8byGbA:ryPuDgYZFQQxNPzAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377042, "uuid": "0c83792e-7d5d-45dd-b152-57830c18910a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377042, "uuid": "6ca7bcc1-ed98-4194-8fdf-1cb23adcb32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377042, "uuid": "2f5cf0d2-d8cb-429f-87df-cb0014671540", "value": "7bd22a0b43c1e2a58c7ba84259eeb82d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6283a9ef-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690351513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351513, "uuid": "d04212df-6aaf-467b-9941-a298d6a26ff4", "comment": "Malware payload (Loki)", "value": "660d5ec93140c53bd87ccaeec90c3bc6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351513, "uuid": "21880bef-e719-4279-8494-e3514d85954b", "comment": "Malware payload (Loki)", "value": "21b22d518ceb92e014164ab1bbe6559ff2169d3304a211ae4452695666ea1f41", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351513, "uuid": "2fbf1a5a-b808-404a-9b4e-c18283665746", "comment": "Malware payload (Loki)", "value": "d7e5047b2f4c43d6081767d7385be7b9bb414d92", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351513, "uuid": "3c44de4c-c52a-41fe-aaef-38674ea660fa", "comment": "Malware payload (Loki)", "value": "54a09c33b836452b7f8fe3fccd22ec0e7982c1c6683dd487d0d6e51c1b1b73e3af7cac44842804895c20c5a58691053f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351513, "uuid": "7744c2f9-521c-46a8-b28b-3450079f0130", "value": "T132B4230CD7D92DF325BA4B045BE360B8B60AF16E3407D0FC64AB9F52BF14258D65368A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351513, "uuid": "e3297faf-588a-453d-b9bb-ae05cedfcde7", "value": "12288:ltFSNePXFgpwr/R2dm6WdvYdqY8uCFYT1ItIOki+9:DAeXyCIdm6WZ2qYMFYT1fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351513, "uuid": "c21a2ceb-d874-4f0e-acaa-1e0e4dc549a3", "value": 494962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351513, "uuid": "360ec70f-9ad7-4074-be4e-bffbe2bcffca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351513, "uuid": "3b857c15-ab55-4952-8a7f-4e426efc0fd4", "value": "20230726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e657530-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690386725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386725, "uuid": "72731341-848b-4ab6-9dd2-8ac4a2452966", "comment": "Malware payload (Amadey)", "value": "5254f44995d0fcd7ebd80d488f5a3f3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386725, "uuid": "d0e609e4-7c85-46e9-b9f1-de0f41c4d026", "comment": "Malware payload (Amadey)", "value": "21e51a67249cbf69af93a7b18c47271cd67eaa749f926f903fc9a46ab244ff53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386725, "uuid": "0a57e013-d5f8-46d9-b612-364817601128", "comment": "Malware payload (Amadey)", "value": "4ab0db4cce57a0d372ecbdf0210c6d5bd8063513", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386725, "uuid": "d9d51074-c5b0-4745-b164-8cd8b7d50c12", "comment": "Malware payload (Amadey)", "value": "46f50776bc0eadbe283003901aca2dcfede953dac9a31a0b6973811fead3c16bf49deb5123b0738d2c119a8962d0e7ff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386725, "uuid": "983a40f9-0f9e-4a68-a148-d3cf9bb529e6", "value": "T112840153FBE49473D8B507B06CF703930A367CB19A3983673785A85A0DB2690A97137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386725, "uuid": "3c2b219c-2c82-4ee4-8f75-7695fbd56eff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386725, "uuid": "cc106d05-0034-48bd-8f02-84fa738120ea", "value": "6144:KVy+bnr+Sp0yN90QER+Km4PGzYaYmF/9LR9+Z/1WMc6SATuyPx6pqVLBHBKtJCf:HMrmy90jtmtYc/9Ly2sTSwVlHQtJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386725, "uuid": "9a2dabe0-f4a2-40ff-a991-1f6c5f4903d4", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386725, "uuid": "230a4f00-843b-4c82-a865-4a21df598dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386725, "uuid": "f1c6c5a1-0530-4b4f-b0f4-0298d985f02d", "value": "5254f44995d0fcd7ebd80d488f5a3f3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7630ea4a-2b96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690363572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363572, "uuid": "c4dfec1b-0262-42dc-97cf-124be3083cb7", "comment": "Malware payload (RedLineStealer)", "value": "8e9e9cf7b53a993aadd842a5dccb8578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363572, "uuid": "4a6bbff4-b4e2-4188-a44a-4c1a9afac213", "comment": "Malware payload (RedLineStealer)", "value": "21eb66b618c52776978cda9d68ecfcbbb91b83b81b084c6ca1b5493cfaa3fc3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363572, "uuid": "db39922d-a614-43f4-8a4c-ffc947189a2a", "comment": "Malware payload (RedLineStealer)", "value": "0b8aefae2a3bc1d33ee562fe31da1084c675086f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363572, "uuid": "8a81550d-37f1-4a9a-ac0b-2cb1d9b023e1", "comment": "Malware payload (RedLineStealer)", "value": "82d81886e05771dee9f484d13df339bae3b082b65f14c7b85f9d0c9ce63a60e8102e74c5a72ed3f47be538c9f92dfd25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363572, "uuid": "aa4aa3a8-7659-4625-82d9-f0aab317b992", "value": "T193840112EBDC8171D8B42BB058F613D30A397DA19DBC876A2645EC6A5CB32D0A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363572, "uuid": "32d98612-66ee-450e-bc34-7d26541b8835", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363572, "uuid": "4ea3fb94-e1f0-4e85-9824-1efddf57a49c", "value": "12288:lMryy905OzQJ54LQYjbm1MvgBYC79wwV:3yigNjbmzzBhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690363572, "uuid": "dd3e9f1d-2984-448b-a711-4b1abeaa568b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690363572, "uuid": "aa0a9892-95bb-4421-8a99-02328c3836ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363572, "uuid": "cd4db017-0a43-4dbe-bf6f-53504dad5285", "value": "8e9e9cf7b53a993aadd842a5dccb8578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323efdb8-2bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690390946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390946, "uuid": "2ee2a5a4-9dca-44a5-a85b-362ade96e48d", "comment": "Malware payload (Stealc)", "value": "0e6bcaf5bdffe703a0bc33c0340d83ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390946, "uuid": "b598ba96-5f6d-433e-af9e-b816a2c5c0f0", "comment": "Malware payload (Stealc)", "value": "22814f131b662ce39621efa04ed521815577ab95b7309fca37f78adb771be380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390946, "uuid": "75c3defa-58c8-445a-8c1c-3482eaf3c98f", "comment": "Malware payload (Stealc)", "value": "547d98a64f191983ee768bebdeeb0cae12f20843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390946, "uuid": "47d1d52f-768f-4089-9b46-219b485f2f93", "comment": "Malware payload (Stealc)", "value": "7f29da9cbc94fd225583b8af7c1ae990eb6fd10c5dd8642a9d95eac4015ca30546a94412ee1601aeae7750d4d50926e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390946, "uuid": "817dfbbb-120d-49da-835b-2440812828d1", "value": "T1C654A3A7C342921FE74770B5C1ACA6B6A00623713B4648E3AB15ABFDE37C1D15939B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390946, "uuid": "ccab1c11-5106-4028-aee7-b96c0dcd50eb", "value": "bee2f0bdac3917609dc0489f88ad57af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390946, "uuid": "f02af289-90b6-4a29-a43c-b34531a158e6", "value": "6144:6gpiJWzYZ7hEOpRzH1mijLaYwpGTphcIR3xicGQMe65I:6/JWS7h3kuzwpGTRBiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690390946, "uuid": "32e130b5-1e83-4ddb-a0b0-1fd36ecb1b60", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690390946, "uuid": "713a0410-2686-48c4-8366-092165b9c6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390946, "uuid": "1c5b69f1-b2d3-4df3-9253-50363db10442", "value": "0e6bcaf5bdffe703a0bc33c0340d83ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e740a6-2bb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690375327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375327, "uuid": "8bda2175-d7b8-4e3b-85eb-c7af631ae80e", "comment": "Malware payload (NetSupport)", "value": "e95cd3612377e76eaac412273353553e", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375327, "uuid": "d215bc7b-c605-4322-a6a3-ae58228647d9", "comment": "Malware payload (NetSupport)", "value": "228ab3e4b67fe1e661d90f3755e62ff66a9267765f11e1f63bb084f05c6a582b", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375327, "uuid": "8ccd9172-a1cf-4d5c-b345-45ea8178c879", "comment": "Malware payload (NetSupport)", "value": "f04c101a750b1d9b7c3fdf266f5d0819524d26d2", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375327, "uuid": "9159ea50-4bc8-4123-af35-062eeb733dc2", "comment": "Malware payload (NetSupport)", "value": "d5f60a124f6f1813f618d5e58e5641053f93b2daf946b3d31216be302f85c0a5490fbf7b536a7f68bc70c68fd0e164c0", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375327, "uuid": "33c4cf1a-a0d3-4e46-bd48-755a32700b09", "value": "T17F45DB38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375327, "uuid": "ddd2cf87-6cdb-445b-9a57-422c959bdb54", "value": "3072:SpAh5Ac+r/ogwE3uTxFmMNZVR4a07XMWe5PPU:Spk5+xwEeTv5V3EQVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375327, "uuid": "4d5ea307-2eb3-48c2-bfe8-603eac55b91f", "value": 1250991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375327, "uuid": "3d98b7cf-5b76-4e6c-a0f2-5065637eeb31", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375327, "uuid": "52ae088c-cb39-4408-8e5d-181037da83e7", "value": "local-EN.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa594d54-2ba8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690371390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371390, "uuid": "ec41a39c-95d4-470f-86f5-d19941978ead", "comment": "Malware payload (RedLineStealer)", "value": "3ceb0b8d62e9b0a5f21f575205569aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371390, "uuid": "3191bab7-a6a3-46ec-917c-f0d3c7e55d11", "comment": "Malware payload (RedLineStealer)", "value": "22cf7fea8c47096ccd135c3d0df5e043354f700af5e57849621894b7b78498f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371390, "uuid": "26d6a9f1-1371-49c6-b776-a3984af67b40", "comment": "Malware payload (RedLineStealer)", "value": "1cda11d64a4e0960fa9623925d0c41c467e90cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371390, "uuid": "56efbf0c-2a10-42e0-a8e3-46141b72c3f9", "comment": "Malware payload (RedLineStealer)", "value": "2bae3374eedd026cf4f3b84469dd1926ffc21098927a7913bc852791119a2a246adc408b70ed8f714364006258a328d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371390, "uuid": "3d5a1885-96af-4951-8b2f-eae0ae2807dd", "value": "T11A840252EAEC4132D8B56B7008F712831F35BDE1AD78831E27959D2E0CB2680A97577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371390, "uuid": "7418836f-5521-4ecf-b1ba-88b6b5ea69c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371390, "uuid": "8b5cc038-fe44-4273-bafa-407c5b440c36", "value": "12288:1MrCy90Vix4klZxzY3wBePAwFucrEukT:vymgZhZBePAwwcrDkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371390, "uuid": "8f589893-87d3-4eff-bf5f-24d974280e4d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371390, "uuid": "fd290f33-b853-48aa-a1ff-63429bc8fbd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371390, "uuid": "5b42a5d7-4f21-4877-aeb0-8c1039c22b36", "value": "3ceb0b8d62e9b0a5f21f575205569aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47575852-2b7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690353615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353615, "uuid": "14ab6e0f-884d-4d2f-8abd-ef8418da49e8", "comment": "Malware payload (RedLineStealer)", "value": "67d4ac02bac1895a0b51055a81a71ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353615, "uuid": "24f3597e-1c16-407e-8f42-15b32e99de1d", "comment": "Malware payload (RedLineStealer)", "value": "252055d82e07b21166bc7cd77e43635b582947c7bdc60646c5edc4766bcc7f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353615, "uuid": "053fb0ad-3883-4142-ac52-b9b6b5b43a96", "comment": "Malware payload (RedLineStealer)", "value": "a43f3efccf952bd03c15a88a5d1ad95293225969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353615, "uuid": "453d596d-f170-47d8-b44f-0f0453baade2", "comment": "Malware payload (RedLineStealer)", "value": "e63917443bcd3e8336a971e1f18329e84f7447a7b883ebc5d2160c234faaee601ac8f94ed069d579810e96fd7185d7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353615, "uuid": "e390dbea-3b09-4d3e-80e7-e62f62872b59", "value": "T18B257CE27B818132FEF210F552EFB531426DA0A0372746CB96B456FAE5643CC6A33593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353615, "uuid": "5c259771-83a2-4a42-8dc0-f917726a7bc4", "value": "804a3a181935154bc979712eeaeaaa91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353615, "uuid": "1009af50-4517-49fe-8d49-dcf5a5a52b01", "value": "24576:fzVglzdtzvB2E6LAWLFkW4rRofFtwtDYU:idtzvB2ECApBryfF6tUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690353615, "uuid": "ac99d3df-a36e-44d9-9c35-30983bbc6338", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690353615, "uuid": "ce951364-7f74-442c-823e-300424f2e8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353615, "uuid": "35177857-6c3b-4381-b7cd-6db3519fe9ba", "value": "67d4ac02bac1895a0b51055a81a71ef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4ec3dc-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356338, "uuid": "64c6b569-d381-4826-aaa4-8c8eebd1801a", "comment": "Malware payload (RedLineStealer)", "value": "68c0e665b3dbb42134dc05359acb3ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356338, "uuid": "6bdcd7aa-206f-4455-a69a-86e7bd6fc7d0", "comment": "Malware payload (RedLineStealer)", "value": "268e5c2d2bc6b5a05ee0b79f2766ee62947d3fbc621cf7b655ac99297ee8720f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356338, "uuid": "13e5a8b4-b725-46ae-85c5-5b3a2d323d20", "comment": "Malware payload (RedLineStealer)", "value": "2824ab8406c52ab1ad653edb709a63b4679b2f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356338, "uuid": "be0ccd00-a07a-4154-a565-292c4f86295d", "comment": "Malware payload (RedLineStealer)", "value": "ada48b335f789752a0dc79bf6b94e5626d3862df654f669bd3cf402c753935003e15f8c6f6e80325fd07426e3fa7fdb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356338, "uuid": "b76f78ca-b000-4b6c-994a-e0e3b3fa0066", "value": "T11A840213A7E48472CDB51B7059F703831B36BCA1593883AB2759A94E5CB32D4E93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356338, "uuid": "1242b6b7-6ff1-42a2-a65a-9750236e1bc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356338, "uuid": "44ee0a9e-a202-437c-a2e6-64cbd0443d6d", "value": "6144:K2y+bnr+Mp0yN90QEoKSFofkeCkaDzB6nz40Jq3ruRDP/+h+t8wnEZkM78dPJd:SMrcy90KK4oNCk0zBSMM1bV8Ih5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356338, "uuid": "0797fcf2-9b67-4248-84f7-690df6fcd215", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356338, "uuid": "2e52f10d-65b3-4de4-a66e-8e21623025dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356338, "uuid": "887d5264-e95f-4680-9276-8ac7d7a88e3c", "value": "68c0e665b3dbb42134dc05359acb3ace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8221df8b-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690356290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356290, "uuid": "cccbddd7-df4c-411a-aeef-5ca70a5258e3", "comment": "Malware payload (SnakeKeylogger)", "value": "34afb2548bb29ae4dafa4d74abfaf1ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356290, "uuid": "03283c18-5ec4-4a2f-9341-abe4e7c99ccc", "comment": "Malware payload (SnakeKeylogger)", "value": "2789aa8055724706f932fb029c7f6a1023b10048cbf2e1a04afe15af82a2ac4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356290, "uuid": "36c05d0a-0367-4483-855e-a3f44d0e8863", "comment": "Malware payload (SnakeKeylogger)", "value": "af990d8c5fa79e1481aeb0fcaae172b331515279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356290, "uuid": "553c6daa-0d55-440d-a56b-b4bc797573aa", "comment": "Malware payload (SnakeKeylogger)", "value": "c57a09a698a9fb5815be853d775678a7e7fe6b638dacf47faa4cc49cae8fcdf360111ecd1c2a229c51bf98899c5f4ff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356290, "uuid": "4a551b1e-3fbc-43ab-aebf-4c6a349d01ff", "value": "T1C4D3091D2BF8C800E5FF8A7306B16111C77AFD52192BDE1D56C2F9192A7C6908E1AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356290, "uuid": "728d2d00-a1ce-4b23-9393-e3c8403fa2e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356290, "uuid": "d5199a00-496a-46d5-b037-a276c27c4647", "value": "3072:xw1/iasc0uNi3zDm6D9M+b7tzJnfBINlgbY:AiLu+/D9Zb+NGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356290, "uuid": "29adc2fa-0937-4a57-9e3b-a2d6b1f541be", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356290, "uuid": "c9c71cde-181d-4959-9e00-c8f76619141e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356290, "uuid": "748c9d63-147c-4641-a3bf-8118c6c98a86", "value": "34afb2548bb29ae4dafa4d74abfaf1ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f145fd05-2c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690410164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410164, "uuid": "039a03f5-d088-478a-bba9-545a274801a5", "comment": "Malware payload (RedLineStealer)", "value": "fd2e58c8e4ce88b55a06ef9d02bc18fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410164, "uuid": "f16b9375-6361-4a12-8364-856167d12219", "comment": "Malware payload (RedLineStealer)", "value": "27bcea2a5088068ab987526e1df2d140861993022ca52e21271a9fd768f11a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410164, "uuid": "73c700da-0ec4-430d-8c68-b31eadf219f7", "comment": "Malware payload (RedLineStealer)", "value": "0675532822c09ab5e3c3a96844e142846c63eab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410164, "uuid": "93bef11b-96dc-4f0c-a882-7d9d165da2a0", "comment": "Malware payload (RedLineStealer)", "value": "d9e1900a1100502844eec009963f23b78d8c71999faf0a3f5a2976e2486d37396c795af1f6629697578ab5b4e8d821c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410164, "uuid": "2c896c6b-3428-491b-9a66-1eb0d0062c58", "value": "T11D840216A7E95036D9B90BB05CF613D30F367D62ADB8526B3396995F0CB22C0587233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410164, "uuid": "856da19b-3e10-4156-84e6-2390f3ddd09f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410164, "uuid": "aa501d78-a70e-4c91-b1ed-13675e2dbddf", "value": "6144:KXy+bnr+Bp0yN90QEb8rrFpzJ8b9U3BiAjsW26BpIBy6M/0muTzx8Z3SmVT/:pMrNy90l8rh8b2R9sW2WuBy1o8Z3S2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690410164, "uuid": "6a994bbf-7925-4180-89fa-41310aa2b269", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690410164, "uuid": "32f6ba6d-6525-4c8e-8434-f063518e13cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410164, "uuid": "0e44bfe4-89ed-44fd-8d2f-41aef86a990b", "value": "27bcea2a5088068ab987526e1df2d140861993022ca52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3728821-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356024, "uuid": "574f734e-6a92-49df-8e35-70f0c50ccb95", "comment": "Malware payload (Amadey)", "value": "05b1bd5fc4cfbb5ac811b1085e421a0e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356024, "uuid": "1495d694-fc49-44ec-af79-3d1e16b19bbc", "comment": "Malware payload (Amadey)", "value": "27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356024, "uuid": "ff87019d-d28e-427e-970e-aa7ac4290bba", "comment": "Malware payload (Amadey)", "value": "cc9da7c9ffe07eac65e1c6b57d62f820a9b75e99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356024, "uuid": "90567e9c-34cd-4908-8ac1-c57e92862836", "comment": "Malware payload (Amadey)", "value": "d856155de5236ddccaef46ff0c185255481c96dbb9131c8ab9162d138457d53b54a2cb628ecf5e5d0011b9c5274ed6d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356024, "uuid": "4f086f50-8b41-4f50-8b2a-48b4b7e10c25", "value": "T1ABB41212EADC6032D8F6277064FB13D30B32BDA15D3483AB3681999D6CB3584987677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356024, "uuid": "68ae6ded-f602-4f86-b121-6b28e18f3309", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356024, "uuid": "c1fb8888-d881-4ec7-86df-467e7e4730b6", "value": "12288:bMrFy90nQ3cYBUovwEOAjj3pvqur9J1VpR8/G98aYE03ZoRU:iyBsOUovwsjjMupbR2GSVlJoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356024, "uuid": "1032cbd2-19a2-4f99-838e-da13f5cd9364", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356024, "uuid": "1057b98b-0a28-4d57-abfb-1eab2fbf2c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356024, "uuid": "8f018f21-1150-44fc-b0fe-5bbc04dba342", "value": "05b1bd5fc4cfbb5ac811b1085e421a0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed94df5c-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356041, "uuid": "4f8e62c1-1f72-4190-8223-b284902803d1", "comment": "Malware payload (Amadey)", "value": "319bd25cccb75fc18a1fe19c7beaf3e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356041, "uuid": "7dc9c063-1b7a-4998-be51-3faed5348cca", "comment": "Malware payload (Amadey)", "value": "28839ba22be16cab09b3664b34397e918be834c1459cde49048ffd421d2876c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356041, "uuid": "b797e084-4413-4200-87ef-075af91a3c87", "comment": "Malware payload (Amadey)", "value": "fc22a7d780f89b6ca0e1b449871fd3392fb16ba5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356041, "uuid": "0f7c900c-64f5-4c93-ae72-470ae273a3dd", "comment": "Malware payload (Amadey)", "value": "1199999f65eb348a3112a5f62f145cdc798b8a4c24a9fec2a93bdb494a911270376738b20a1fbcdc1eb14ea7a4efb06e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356041, "uuid": "988057ce-ab48-4928-977d-d1df563de8d7", "value": "T17CB41212A6C85472CDB51BB414F703A30A39FEB15878639F3356A91D0CB3AC4A97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356041, "uuid": "b1989229-b07a-4e79-9313-254bbfb42a77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356041, "uuid": "70d8261c-d5d6-490d-81f1-214e8aac0e56", "value": "12288:JMrOy90iUBwxKnDbdDEPT9iOhjRBu0h0PrwjWh:ry5UBwQnXd4PpiQRBywjWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356041, "uuid": "3b9c8d12-1a0c-4ef2-ba25-f4d23786d024", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356041, "uuid": "36fef6a4-7055-47b5-bfbc-b1ef162456c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356041, "uuid": "a66acaf4-632f-4830-9c16-4b6a2e1bcd94", "value": "319bd25cccb75fc18a1fe19c7beaf3e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9b7817-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690385564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385564, "uuid": "3b53ff0e-2273-4a2a-b1e6-4d85e1905e13", "comment": "Malware payload (GCleaner)", "value": "63b0dd474484c7d3ae9a0d95450b79f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385564, "uuid": "b3898323-204c-4232-94fb-1af8908c0907", "comment": "Malware payload (GCleaner)", "value": "28e838bca38d402be2669364c269c54e2c5d41e53c140a369c8e28664d5e2468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385564, "uuid": "11749b5b-520d-4f6e-903d-df6f76a9b2f1", "comment": "Malware payload (GCleaner)", "value": "f0c3153ab7494f984f34dc369e6e60fb150419df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385564, "uuid": "6f732f9a-4ec6-4cb9-8ef8-a00e6e7cd387", "comment": "Malware payload (GCleaner)", "value": "2114c22ef141a99fcae936bfa12c888421a2771afafd328254a57604cf98d5efefa79bff5454b474c87cb1d70010dba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385564, "uuid": "225fcba3-cd88-4f84-a1cc-ced101bdc63a", "value": "T1EF45233294928DF7E8A3C6758971E628197B7AE47C3DB7A47EFC8E4E0F762804504316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385564, "uuid": "99d10556-aee2-49cb-a599-9d4312cea95d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385564, "uuid": "30f5e5b5-ec55-46c1-95d5-07fcc75cf37b", "value": "24576:+2lJ2BL/BZEliZ9c+iByZMuqEu01IJnV0qvixxrCBeJKavoXDdHY8Mh9GxanV:+2f2T4+iBypqE/2VZixIqjgDd48MhMxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385564, "uuid": "6b5719a9-f2f7-40f1-bf4a-174c60111d69", "value": 1194779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385564, "uuid": "21fdffbb-93dd-42d6-91be-4a572545f209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385564, "uuid": "53defcab-8a9a-4ce0-a002-f75b246da7fb", "value": "63b0dd474484c7d3ae9a0d95450b79f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284826c5-2ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1690368595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368595, "uuid": "22e0fabd-bad8-4f8b-a8c5-b6e114e1c0a6", "comment": "Malware payload (MarsStealer)", "value": "001240676293a2fd74cc8ba790d5806d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368595, "uuid": "50b4dee4-5334-41ff-8109-2654d676e85e", "comment": "Malware payload (MarsStealer)", "value": "29f23979e3b541ca8955fcbd3a0f9cadbdf92c0df65ba495eeb98bd1e154bc6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368595, "uuid": "42561bb5-6616-4e8b-a307-ebf449b3620e", "comment": "Malware payload (MarsStealer)", "value": "4ece19672c0a131aaf9328c753e8f7fc9239ef11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368595, "uuid": "faebcbc1-f347-4312-8ad1-5c4668897715", "comment": "Malware payload (MarsStealer)", "value": "8b4bd797089c32f0b4982045e1707d73b8c376757e600a80de347c94905013f0b2a7fdf6ad635dad5a399c9ca726beb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368595, "uuid": "f14272e4-0450-4aae-ba9c-882dea6998bd", "value": "T1FC74C74383A9BF44D9A54B739E2FEAF8B60DF650CF4D3B65A1289E1F00B51B2D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368595, "uuid": "6a3e558f-3a74-4da2-87d4-f9a5d030fd87", "value": "28e47df11fcc31ecc5eec0c4cd0746c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368595, "uuid": "8de24c39-f120-4507-9432-54614eac17dc", "value": "3072:HaouFGFBLMgLqHuqH5jeNsypZQqSvHT0lEiL2E5g91RMwwlGvPGT1lTUZ:6oPFBLMgLhsyjQqcHT0uiLK97Xjv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368595, "uuid": "a955c857-7d99-4c5e-9fb7-652694ddbd40", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368595, "uuid": "22e96284-2802-4c72-8a2e-ee0fd656ab3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368595, "uuid": "308531ff-d574-4336-90bf-1df3a44f22ca", "value": "001240676293a2fd74cc8ba790d5806d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c32c7f-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690376701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376701, "uuid": "04cf4771-d02d-45c2-9db8-3d89c6d92ce6", "comment": "Malware payload (Amadey)", "value": "690fae3f5789482a7ad3581082dc83c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376701, "uuid": "33ba0482-81d0-4803-86f7-557a1ad546cb", "comment": "Malware payload (Amadey)", "value": "2a0110181474cf61a419cc193877f2fa47fac590d075a67df05787cbc2e49717", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376701, "uuid": "2afe273d-00ca-406b-80fb-c36b0b3d1d96", "comment": "Malware payload (Amadey)", "value": "453cf52ebd849e0b9995bd069ddcd7c9e2361c14", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376701, "uuid": "88bbfe82-f025-4c45-b7f8-164c6059715f", "comment": "Malware payload (Amadey)", "value": "75faf54f501930929b757ae941d3b4e7a1ec2c2512083e96138971adfe0d9f73341fa9e3769125dd1812efa1c191244e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376701, "uuid": "78392723-2e59-46c9-abe2-28d7abdc306f", "value": "T144B41252B7E84033DE71177029FA02C71939BDE14DBC866A278E798A1D736C065B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376701, "uuid": "53e87b7c-d8c3-4289-bfa3-9c2f87b8b0c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376701, "uuid": "df5917ea-599b-4340-b222-45dab6313b4c", "value": "12288:tMrZy90T8jTqUuJQ2caBts0lVhC4hx4kk58/ND0ZXTd+zQ0n:UyTTqj+Da80rl08VD0ZXTd+zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376701, "uuid": "e74495b6-db63-4bba-8385-ac57a67ef3e9", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376701, "uuid": "0fcf988c-3043-4be4-b4f5-817de1067b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376701, "uuid": "240af445-4be8-4b99-b0c3-148b8b0b26d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37879f5-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690365070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365070, "uuid": "47b3c432-a27e-4b8f-93b5-91ca347c6fa7", "comment": "Malware payload (Amadey)", "value": "52b42d7431a54e2b730ddf54e857ab2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365070, "uuid": "d980667b-ffb8-400b-843d-95ac28d3d1a9", "comment": "Malware payload (Amadey)", "value": "2a73bbc7e00fac7eade1ed5432e88a9d6271a17ffa0c95ab504829d33d75ea51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365070, "uuid": "b1d2ab50-0db7-4215-8d37-4940ed57ddf5", "comment": "Malware payload (Amadey)", "value": "b8831924e533ae79ac740e2a3907535b44bc8e16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365070, "uuid": "b5711b24-6e16-4fb3-836b-8b1ea799c4ef", "comment": "Malware payload (Amadey)", "value": "dd52e757dffb487a29499610af0e9683f4dc544e17ed301826cc0cfafeec34a9400a3d34e282f0ac519ed286c7c785eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365070, "uuid": "33996c5e-f901-4203-805f-d5f8a47bd514", "value": "T129B40227EBE58073E8B1277049FB02D31B31BDA16A79826F3782984A0C725D4993577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365070, "uuid": "0b622e53-e0f9-4bda-b0ad-0c0db1e57a14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365070, "uuid": "93913bcb-dc2b-4495-88b0-aebde2621544", "value": "12288:+MrRy90wxQZTcucSIE77yY0UMiCKz3Wn6VhGymYuWx:vyDMCePyNKzW6zTco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365070, "uuid": "0743a3a9-c989-4ad7-81cc-60345f446203", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365070, "uuid": "8137ae27-4c6f-4613-a566-fc24a47583bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365070, "uuid": "cb7df796-a52e-4767-abc2-a516ef44a45b", "value": "52b42d7431a54e2b730ddf54e857ab2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30de66dc-2bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1690374622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374622, "uuid": "c0fd972a-abf7-478a-ab96-4565790a9cb2", "comment": "Malware payload (MarsStealer)", "value": "5487be4ca04d8c00ff0c83212641e413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374622, "uuid": "2460a881-9d8f-4e8a-9929-c211f669538c", "comment": "Malware payload (MarsStealer)", "value": "2a7ccf835cd47e53b218d02824e1db7194aa045271d10a049647528a865c723f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374622, "uuid": "0357a122-cec7-4323-af79-0afa9a57f65f", "comment": "Malware payload (MarsStealer)", "value": "96cf0a0f58eeade0214a1d646de18a3a788b067f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374622, "uuid": "c63398c4-afe8-4d5e-adb3-2baa435b26c4", "comment": "Malware payload (MarsStealer)", "value": "5cf947c9075c3694b90ab478098ebe29645db20a4e08745b5d02afec6d0e22ba42cea4b66fb64edd241c10a1cbdac9d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374622, "uuid": "354fcd0f-0557-4df9-94cd-71290932ffe6", "value": "T17F74B75383A1BD40E9258B729E2FCEF8760DF6518F4D7B66A2289F1F00B61B6D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374622, "uuid": "78972b0f-f54c-41d5-9d02-c7634c82ebc3", "value": "23b1f12acfdc16a0095d4f2599c53eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374622, "uuid": "5eca04ac-8654-49bc-acd8-2d4e773987e8", "value": "3072:SbYvr6FPL2gVUDOkOSY/30U8JxVHlSUKDZInLF8Z0a+5g91RhwlGvPGT1lTU0:SYGFPL2gK+OH2DyLF6Z97hjv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374622, "uuid": "3514402f-cb72-4ce4-b3c9-00882632a6a4", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374622, "uuid": "a92a0df0-8209-4bf3-a604-a1810900eb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374622, "uuid": "db4c3d30-1118-48c1-a5b2-e4e04e4b0f33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265bfc6a-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690365585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365585, "uuid": "3b48821d-5afc-426a-a4c8-71117e6f2e61", "comment": "Malware payload (Gafgyt)", "value": "426e3b0b4f4a738ba0da746aa4b2a011", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365585, "uuid": "3d933f4e-4b6c-4767-bfcf-74bc93c5ad98", "comment": "Malware payload (Gafgyt)", "value": "2b2a5aed40a0c4b56c55f7ba0f9a5a6e130a650f4d46cb306056ab2ce4c16292", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365585, "uuid": "be4f0fa7-8770-4b12-88c6-59fe3b0d0e01", "comment": "Malware payload (Gafgyt)", "value": "cacb39b01475d019b28e8bbf9112772cb22939cd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365585, "uuid": "9aea6278-c15c-4545-b554-12b83367f0fc", "comment": "Malware payload (Gafgyt)", "value": "97ed63cc7ec4f9077d3e56b307a6e1b8c36b01c84268d34c8c6ea4c0870a44b70c824f218e8ceb31df9911e24c3604d7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365585, "uuid": "fc3c17d7-d790-4392-a909-619b8de856e8", "value": "T1BE136C0ABB83D0B5E94215B5313BDB329BB6EC361059DB03C375AC3AE8A2611E71775C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365585, "uuid": "60bceaf6-d3a2-4607-97a1-247feed75c79", "value": "768:rFcYwXEoiaNGi2t89lhWVb1RbHJGjq+IMPYH0C84DSTIu:YUOlQb/G2+IMwH0yDST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365585, "uuid": "283554ab-f7d8-4ed2-9547-32ebe2b64560", "value": 42144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365585, "uuid": "52ffa0ff-b471-4ec6-acf7-725fdaeef8e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365585, "uuid": "75dd61d9-eca1-4d64-8162-11004e15c41b", "value": "condi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f81866-2c0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690413769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413769, "uuid": "1545b619-d20d-4510-bdf7-f8810e8b840d", "comment": "Malware payload (Amadey)", "value": "c9788bc47fe2c701a18e3ef9808099c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413769, "uuid": "edc859ef-3852-4480-95a4-42b7e572901d", "comment": "Malware payload (Amadey)", "value": "2b3ecdca0d46bc919ae200509b3999c172cb227b46cfdc290430e41906542e3a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413769, "uuid": "de4983a5-fd3a-4f5e-afc2-a7ea859bf5b9", "comment": "Malware payload (Amadey)", "value": "79d4d77f6d17d28c97c71cd5ff8b68d3f31bac8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413769, "uuid": "3e915805-af9b-4691-b832-1899d191edcc", "comment": "Malware payload (Amadey)", "value": "8073cd133f285f62a7e7717fdc88273e5b669faa355e2df0600110d87e413617675fb0a1cfbd920a4534ba52f9028eb0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413769, "uuid": "ce0334a3-5aea-4ac5-afc7-8cb5976417e5", "value": "T1DEB41252E7E88473D9B52B7028F602CB0B31BD519979836B2754692E0CB33D5B83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413769, "uuid": "eabd71f6-2417-48fd-9953-35716039a1e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413769, "uuid": "70377af3-6623-4e45-a3f2-8444ad2b2a96", "value": "6144:Kny+bnr+1p0yN90QEj6IlazgzBwJmqNGm0Ac9w9l6FyqnbSEcfGPd+2PGEjGtmML:lMrVy90wIlIIYmDclhgQEop6vjeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690413769, "uuid": "61eb8785-4980-441b-af62-8538d947fbc4", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690413769, "uuid": "a7e826a8-a3db-4255-b8b4-f0646fc8d40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413769, "uuid": "ce074da5-72ea-45ed-b798-ed3585f37549", "value": "c9788bc47fe2c701a18e3ef9808099c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c51ee26-2ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690371689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371689, "uuid": "0ad12bf1-fb11-46b2-adbd-bc70bf8b341c", "comment": "Malware payload (Amadey)", "value": "ffa74c1590befaa87a5b3086e8784e99", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371689, "uuid": "27e38093-6809-4fa6-86b5-908ad0ba4087", "comment": "Malware payload (Amadey)", "value": "2b6b93bcb0d33dd1af85626fa89653ed055f08141cf7afc35e1dbf237629da9d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371689, "uuid": "0e580a98-8022-4154-8393-a016474da3c3", "comment": "Malware payload (Amadey)", "value": "ec78fe63b48d9199df99ef1c43bdc862a4570b12", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371689, "uuid": "98d0b5f3-c054-4a2c-95b3-2aba51debaf9", "comment": "Malware payload (Amadey)", "value": "53365715b33a6c3ae841dfd8e55a5a4a12e094c27d98bf62055bfc43514ac759ff1a1eaf5e11862788f2c078159e449d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371689, "uuid": "939ca674-8642-46f4-8115-bb9414b6ce51", "value": "T19E840202F7D98172D4B267B018FA06C30F36BCA58D7897AB225598591CB37C4E931B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371689, "uuid": "4ce255d7-7d3b-42c5-91e0-11cf3c2c3f63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371689, "uuid": "4a81d74c-f366-455f-b14a-b53d05f64b7e", "value": "12288:QMray90JBUHrV8XNjvnPCnncX+hEGJ1BE:aycBUHryNj/YyW1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371689, "uuid": "e4386446-1740-4433-af46-1c0e1bc3f430", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371689, "uuid": "1c2ea50e-0de7-40eb-b499-a39d448d6d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371689, "uuid": "d0d6103d-01b9-4394-ba8c-9153a600d54c", "value": "ffa74c1590befaa87a5b3086e8784e99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98269e0-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690362074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362074, "uuid": "6cdca4cc-2403-4394-8e4a-cefc839b0a8f", "comment": "Malware payload (RedLineStealer)", "value": "5151da14da5318506c76f8f0bf8f2263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362074, "uuid": "e2c7359e-502a-47bf-82e0-de96f1fc9524", "comment": "Malware payload (RedLineStealer)", "value": "2b87c7a59a469adca1693ceecd7fb1ea4eb1bb095a55e316a96eafda54e2285a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362074, "uuid": "efcc0968-9126-46dd-840a-badb427b2bb4", "comment": "Malware payload (RedLineStealer)", "value": "ee1e6b8c177e075ece88b6186b97a1f1d878eebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362074, "uuid": "dd079f10-56ff-461b-8d72-df114517540f", "comment": "Malware payload (RedLineStealer)", "value": "e4085c1106690f88f86e5adc855c8e241af9015dfb71566215660c5870327a8a7ba38145e2baa1726de53420e775ee6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362074, "uuid": "3ced5feb-2f13-48de-b5ef-ea90f0b9b912", "value": "T1F4840213E7F85137E9BA27B058F202D30B3A7D72A934836B2789595B0CB3690947573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362074, "uuid": "6dd64fdd-50d0-430b-bd44-ee934d91043b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362074, "uuid": "6e6058e2-0fef-4c1e-bf83-a9f6008c4f96", "value": "6144:KMy+bnr+ap0yN90QEkHAJLR3gWt7ooOsikfnmTT7SOV/MQtmauilIlYJRZBtg:sMruy90+HAJLR3gDvtkfSSOX96mPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362074, "uuid": "f50e2201-24b9-4dba-9cee-9e98d07417d6", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362074, "uuid": "f9d91cfd-b137-4597-8742-f8f8b1ed13de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362074, "uuid": "fea100e1-1d63-4e9a-8325-9c1add305ad7", "value": "2b87c7a59a469adca1693ceecd7fb1ea4eb1bb095a55e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c705d6-2c0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690413767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413767, "uuid": "9320b1ff-7eca-41e5-b266-74af0e2a94d5", "comment": "Malware payload (Amadey)", "value": "00db65dad659f95f255fd66a55a3dbcd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413767, "uuid": "4648ab04-922e-4556-b221-f2de08b3dbef", "comment": "Malware payload (Amadey)", "value": "2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413767, "uuid": "4658fe52-8a51-4505-aa96-f0d71427d995", "comment": "Malware payload (Amadey)", "value": "59e2ff84dd9a158365a1046620138ddd07757acb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413767, "uuid": "58c448f0-ab9a-4e84-a7bc-d1b40c330e68", "comment": "Malware payload (Amadey)", "value": "18317122a4d2d1cd6a6a47cd6f7dc2c4e6934caa0c523fa51082eeb79ea2f5731a035a35d70294bef6c3c5e3e44ac714", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413767, "uuid": "8698d3dc-1684-45c9-b4ce-9f74d98bbeab", "value": "T15774F142BBDC4073DCFA2B7058FA13D31B36BCA15D78435B2785A86A0D72690A53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413767, "uuid": "f109e2ee-f4b0-4999-96c4-ba907264bcd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413767, "uuid": "ebb43f85-38c0-4c33-b32c-7ab87f31be11", "value": "6144:Kwy+bnr+Up0yN90QElkfSgk3+ouqto7NQz7wmYo6Bv9Ov+bwR8/8gPefdHOD9:EMrMy90l/m4xz7wDoG9OmG8/Befy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690413767, "uuid": "5cd1e951-75d2-4b4b-b349-19c144eabce1", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690413767, "uuid": "91c668e1-9681-4a49-93d1-5802500b758d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413767, "uuid": "cdc21f5a-be11-403f-aae9-3bce8f9eddd9", "value": "00db65dad659f95f255fd66a55a3dbcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11781973-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356960, "uuid": "f5546a8d-7cc0-4fdc-9760-e8e80a2185c4", "comment": "Malware payload (RedLineStealer)", "value": "fd76478e77d1ce4627a8c2a284c1f02e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356960, "uuid": "4b1a4b29-a700-42dc-af07-11b29b649c56", "comment": "Malware payload (RedLineStealer)", "value": "2bdd9cde8357eb89e6b961779e3e919d5e24a12cb6c0d71c02180e3d5ca25677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356960, "uuid": "34cb6e74-9056-4564-9b19-b74e8ed12ead", "comment": "Malware payload (RedLineStealer)", "value": "1444eaa31cc1d1c007bead837a23303cdc4b9f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356960, "uuid": "7804084d-75ac-45b3-b53c-ebbc117d1084", "comment": "Malware payload (RedLineStealer)", "value": "29624022ec6292bdb9f4e9cbb4caaf6dbe3f16ce08cd0720c62d78a18d74cdd2e9ff1e5b83c05139e141565de7e20eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356960, "uuid": "08a06bda-9768-4edd-bba2-9b90d9873905", "value": "T13E840256B7E88133D8B5177058F616C31B36BCA19D78826B3746A85E0973BD1E83233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356960, "uuid": "0982dc41-1aed-418a-9a41-1dfb0ede6e3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356960, "uuid": "5a523425-5339-4280-ae37-f59bbed987e4", "value": "12288:xMrPy908BovgGrir87fK16Jh1cGf2Yva:my6t+Aey1Z2YS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356960, "uuid": "22c532de-0061-49cc-acaf-7e8ec49fb439", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356960, "uuid": "65594b33-b153-406e-a435-51b03ec968e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356960, "uuid": "aaa3e6b7-d033-4557-8efa-e89f1c7e6459", "value": "fd76478e77d1ce4627a8c2a284c1f02e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb7f15a-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351131, "uuid": "bf791ea0-2304-47c4-8887-66ab456aa1af", "comment": "Malware payload (AgentTesla)", "value": "2bca34da8f5786f0e8282cde996fd78c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351131, "uuid": "fa8e807e-fe41-4542-a8f1-f489ab4da04e", "comment": "Malware payload (AgentTesla)", "value": "2be2c2853a22f9527a423426db8133f6497eec231843c7741efd277370445eaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351131, "uuid": "a72ae8b3-75aa-4670-a69c-8eb58680510b", "comment": "Malware payload (AgentTesla)", "value": "49de235da152c3941fe22fb93baccde8c4cfb9fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351131, "uuid": "33f5ecab-8801-4ee9-b702-abb1c014f66f", "comment": "Malware payload (AgentTesla)", "value": "daba672319e6d76116ac9d47f623f733210210af6f40f42f3db7e0a39107592ef5ca15f4a35d699b5eed4461d87332ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351131, "uuid": "679aebd4-49d8-4535-aa70-718111859bc7", "value": "T1FC4423E93D400EB5E8F80265DA2CD7187563B2D05A4D6F490303B62E65E58A4DF13DBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351131, "uuid": "f640517e-e489-4644-8f36-8c14e184211c", "value": "6144:p5ewuywNtngdArnBp9j1XpiZ4zvT4vn1jBY:/Y1t02nfrXpcvnBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351131, "uuid": "71f8e199-4999-4355-b9f7-f700e58ce3e1", "value": 256937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351131, "uuid": "86d57999-43d9-4fb8-a035-e4b03f3285b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351131, "uuid": "b7ef6a45-f44b-4a61-be1f-5aba5477fdf4", "value": "ENQUIRY - PR-009583POWER.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910826c6-2bea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690399695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399695, "uuid": "b971e82b-9c75-4876-a9a7-d41b6080c635", "comment": "Malware payload (Smoke Loader)", "value": "618e4050696c3303523e67ccb16660b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399695, "uuid": "752092d3-8083-41c5-b211-f017d6b806a1", "comment": "Malware payload (Smoke Loader)", "value": "2c43ca2ea57631cdd00d46b6d292ca82922c239c1ad400a4714134fed8f2a50e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399695, "uuid": "3c7e82af-de25-417a-98fe-9cf22e7773bc", "comment": "Malware payload (Smoke Loader)", "value": "681096cc439d07053de0fbcbbef4686f13e5a475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690399695, "uuid": "170a3652-4276-4141-adef-a1575f326084", "comment": "Malware payload (Smoke Loader)", "value": "de478f6ecf67555cbc250badfcaada4e7a2644aaceb1bddfa7b45b4f7cd553188bda281f463ab043f1169dbfeb604d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399695, "uuid": "791ee198-8018-47fa-aa22-a8944cfffb95", "value": "T15174B74383E1BD44E9258B729F2FCAE8760DF6608F4D7766B1289E1F06B51B2E173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399695, "uuid": "37bc2958-d1dd-4ad2-b0df-bd9b900db42d", "value": "a9a61375e97ff1bb9ae776c90b197580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399695, "uuid": "7860a1d2-9228-40c2-a6c9-b536e37b764a", "value": "3072:SJs46UEL0AzLmizdx3AH2+KzMgZmqtDO5kGVwlGvPGT1hM:4srUEL0adAH2+KzlRDrGVjv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690399695, "uuid": "d49cbcd9-357c-4ee3-8c69-d832c1d8e409", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690399695, "uuid": "ce158002-9b33-4e23-abcb-65c1055f1f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690399695, "uuid": "377f74e0-33f0-4247-a285-ec50023632b3", "value": "618e4050696c3303523e67ccb16660b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77d6241-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356004, "uuid": "dd1e48bd-f592-4d2b-bb2b-7ab92255552c", "comment": "Malware payload (RedLineStealer)", "value": "b648acb21d71035e13e5d38da2374fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356004, "uuid": "791a152a-1c64-4d59-80d5-eb746f386bdb", "comment": "Malware payload (RedLineStealer)", "value": "2cc54ce9ab3e76504d4913077d869afd10acf127ad800935ed2f69ccca8472d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356004, "uuid": "c6860491-dde7-4eb4-b2a9-1a3325211867", "comment": "Malware payload (RedLineStealer)", "value": "cb2e3d0326dec4cfffbc7e2322c7b484e7815c69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356004, "uuid": "b967e561-1ed3-4408-973d-212dc7e789da", "comment": "Malware payload (RedLineStealer)", "value": "edff684da4f58f45beb16f4479a8dc1715637589647e0a2f89454e30a2ef3cbeed09ef669f50b6ac0b8f29e77f93d783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356004, "uuid": "1fce1a6a-ae1b-4baf-815a-04eea600a77d", "value": "T1A255BE26B9C082FEEDE2307142EDF53441DDE06C072636D7A99846DAF6506C06B36BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356004, "uuid": "539bf697-e04d-4402-9be5-a049ff918143", "value": "804a3a181935154bc979712eeaeaaa91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356004, "uuid": "27750ba7-71d2-4eb6-956e-92ae408a27e2", "value": "24576:OAVgl6+azvB2EPEWLFlW44N//t7k/XoV27UiKyiy2PU:x+azvB2E8YB0//lk/Xo07Ui97yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356004, "uuid": "abdd2d7f-ab92-4ded-9b45-91cbedd0ccf8", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356004, "uuid": "01ebee57-89d3-4d65-acca-ee26440e8d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356004, "uuid": "7d2f7803-244a-4db4-88eb-61008b135b4b", "value": "b648acb21d71035e13e5d38da2374fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fb9941-2b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690347979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347979, "uuid": "90be28da-7071-416c-86d1-888ef4c54454", "comment": "Malware payload (Loki)", "value": "9bfe16fe703e38f4014d6e1da6f51830", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347979, "uuid": "8adc59df-3659-4230-828c-cc6234274cbb", "comment": "Malware payload (Loki)", "value": "2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347979, "uuid": "84327f73-de4d-4bd2-8d8e-d85f292d39c1", "comment": "Malware payload (Loki)", "value": "8fa55e0e8471fe4652d1b57b30f5d209cbe0b025", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347979, "uuid": "8174581a-3b0c-46d0-9753-f38ee6e30ff0", "comment": "Malware payload (Loki)", "value": "725649fa4833e83d5c942a23e9a63df8d76da719881ad0f657a8d365d7d9bb0b88d428f3bb3b55c8ea65e0bae3e1d309", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347979, "uuid": "b02d05d8-d012-4e35-80b2-43a732053d86", "value": "T1C9E4022437B8AF52E2AC7BF552A061140371D9596837D38C8EF120D61E63F90AB92FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347979, "uuid": "f1c8f6c2-2f06-4252-b126-84ca59648827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347979, "uuid": "7b160585-2ea0-4c49-994f-65804af13c04", "value": "12288:mvvJRBusyWerdU5dH2AHVv/itX7bujP+1TOGcEh2tbNeUjMV5F:CFuVoH2A1v/CXw+JOGj2bNe8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347979, "uuid": "aac3c165-906c-4367-a690-a594f811b54a", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347979, "uuid": "40499156-7d0f-4297-a5c4-6387c34f5f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347979, "uuid": "785e997a-61af-4d20-a855-40305fec62cc", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937c3647-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690364909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364909, "uuid": "73f4883a-95cd-410f-9b13-cd910494637e", "comment": "Malware payload (RemcosRAT)", "value": "07031508b50b3a23e9a3283160fe8a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364909, "uuid": "6bd8832f-1c39-42c4-9988-d697e90d1c2b", "comment": "Malware payload (RemcosRAT)", "value": "2d12bedd8d6cee6c6fbee5ccb9d7dd25fc6693d9d6a7a0207104f94b681b55aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364909, "uuid": "daa35c60-12bc-465d-bf5f-8870f2c95768", "comment": "Malware payload (RemcosRAT)", "value": "749723ed52c8acbc6fbe3e1b659ca444d78adcdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364909, "uuid": "873285b2-2e67-4cd0-9be3-29f736cef4ea", "comment": "Malware payload (RemcosRAT)", "value": "88399a4927ec7f92e5c0b55e15501e8611d477e1489e15c985e3467fc497968e3e79decadf9687a9ce95b05bb0aeac56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364909, "uuid": "c441bdf2-1f1b-4f50-881d-0519b9ddd353", "value": "T15E152326734CAF59C5299FF30602942157F2D8A79922F3062DC221C98FA6F094FB1F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364909, "uuid": "f8cb9d79-91a5-4dc4-bd81-d9b33810aff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364909, "uuid": "7c1bbec8-a4e0-452e-9eab-8f2fada3e80a", "value": "12288:DJmefaynhmekBnmPW8FCg6IuJge/JrEqP1RyN+kR/TjBfQHD8gQcwG0c7KJSPx2l:UeCQmebWngenk+sjBfs8ncwxGcSA0wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690364909, "uuid": "56b5d3ad-e2a7-46f2-9da6-a89164331fa7", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690364909, "uuid": "33fd2331-f87a-4966-b63a-2ac1519eeafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364909, "uuid": "e7d2408e-d504-4189-b8ed-7ae1c605068e", "value": "OST VGM PSC2370222.DOCX.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2358e637-2b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690347971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347971, "uuid": "40f7bbe3-d2c0-45bb-9978-0e2d7122f550", "comment": "Malware payload (Loki)", "value": "b368200b7382b59859e117b0d50bcacc", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347971, "uuid": "f48d9ab4-6e5a-4115-bbff-bb3c6542d4d1", "comment": "Malware payload (Loki)", "value": "2dc8c1b785b08208ba17447f05ad2f9bf51ed2933bb63deafad5272872fedd72", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347971, "uuid": "81ee3a38-f292-4e72-b340-02f6fae5d498", "comment": "Malware payload (Loki)", "value": "227d88a42945cf988590357a1b5ae6231c9a50c1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347971, "uuid": "f49ce9fa-f28b-4813-b7ba-5af2e9dd0929", "comment": "Malware payload (Loki)", "value": "9766b9f41925dcd9967167220dd3bf4888b728d55d0236655ab5f3aa32544b82b191a6892d44afe68120f3c8386fc4fb", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347971, "uuid": "26197fa4-321d-4453-a942-765d29e5c668", "value": "T1F5C42317574CF51BFB31293ADD8F8A7A5EEEC13200F34A4639892E7193471AA27C2B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347971, "uuid": "10c7af14-5bbd-48ec-8028-389c327fbb33", "value": "12288:N57S5Gbvn8cJeakeS0ja1KQMICUldnKM7Qee8:Xcmvnd7ajgmdD7Qeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347971, "uuid": "a3cfb5cf-887a-433a-880e-d18cfbc24e2b", "value": 567409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347971, "uuid": "d20a0793-90aa-4f47-b690-78e14fa9f587", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347971, "uuid": "7cc0c180-8f04-4ee9-8077-07a1c8c4977a", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5c5686-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356657, "uuid": "496c3ef9-2372-40f3-9773-75593b37e2e6", "comment": "Malware payload (RedLineStealer)", "value": "e4cbac507491f32794ab286326efdbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356657, "uuid": "c1fb44c5-8695-4ecb-8b5c-315db50b1921", "comment": "Malware payload (RedLineStealer)", "value": "2e44c0c131aa0646df559d489b10a0255928e191238e6ffb0c88adfd635b3795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356657, "uuid": "d6992c38-6a1a-444c-967a-2cb07104df25", "comment": "Malware payload (RedLineStealer)", "value": "e0fe6eb378efc25dd078928feb81f3293ea1c6ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356657, "uuid": "e99dd2c8-3627-42b3-9f22-e0005a67c866", "comment": "Malware payload (RedLineStealer)", "value": "a16c57efdaa5a3bc203c8b12d5a1794d5bc28a98873a12e89d913cbaa17f0fe56d10ccbe9c7c56020b1ed590e9422127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356657, "uuid": "8069d8c7-37fa-4384-a799-a71198e30214", "value": "T1B4840183A7E94433D8B5177068F612C30E3ABCA29D3493AB33459D4F1CB3691A571B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356657, "uuid": "00b53276-1d25-4547-bb47-81e953d942a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356657, "uuid": "5274be94-a2f2-4305-bf9b-c2600cb3de43", "value": "6144:Kty+bnr+Ep0yN90QE/NSUKXckwgPQPR/p429GWkliEmQPVymwA5yoXtSIGTJ:LMr8y90ZNBtkhIPD42V8pwA5vXtSIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356657, "uuid": "ea979ebc-dbf4-4a82-b8e3-3c21588b7182", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356657, "uuid": "310840d2-f259-4860-bf29-f8439767306d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356657, "uuid": "94a93cd4-ca0e-482d-ad61-f723c9dcbca2", "value": "e4cbac507491f32794ab286326efdbbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5fb0f5-2bb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690375070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375070, "uuid": "485f0288-ba5e-4c6e-b6ca-0d7cf9301b7c", "comment": "Malware payload (AgentTesla)", "value": "8bd3ad9bf8e7d0b6df8073482070ea17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375070, "uuid": "1d8acd0b-cd91-45b5-8125-aa877263a85a", "comment": "Malware payload (AgentTesla)", "value": "2f0826046728f20f38234c0809eb0c85b74f195e181e93a1f10164293e9bfdc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375070, "uuid": "e973fe9a-912e-4de1-b124-ba32d16c2c72", "comment": "Malware payload (AgentTesla)", "value": "970992e6592bb4fddc9745fe46e6495064de064c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375070, "uuid": "96271cb6-540b-4d6c-9956-5f2d54dbdea6", "comment": "Malware payload (AgentTesla)", "value": "a0fd33cea5a3cd3ce86d17bddc08e9b49f9c747c903f4a0bdacdf89db568c67d8c840566fdbc92aad3365a423aca56cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375070, "uuid": "440cf978-e4ea-40dd-88ea-b38140f47e52", "value": "T1FAC41362B69C6F36CEB953F55480C91183F5EA6B5438E3582DCB20D7DA22B1023D1F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375070, "uuid": "ac6b43ba-44b9-44fd-b751-2045092474bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375070, "uuid": "4afe157f-7fd1-44e0-91fd-58cfaf918c58", "value": "12288:Sf2iN2GUL9IWdyAkJlD0mcAzrXtpcXOLasQMmPur7pcXcv:Sf1xUL95IDD0VANuCasQM1qMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375070, "uuid": "672c0278-3070-4688-bcd0-c2b189951023", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375070, "uuid": "c4ee74da-36bc-4ac2-8a7f-eccca7421b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375070, "uuid": "bbf14383-a492-4136-9595-d87e4d9003b2", "value": "54900008765110421119_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b65046-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690350639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350639, "uuid": "6e296085-2146-4670-b00d-553dac0bcd0e", "comment": "Malware payload", "value": "b4a0fd8febfb1bead4356b1664a15d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350639, "uuid": "bdf07a13-c6bd-473b-97d6-a8bd05118b49", "comment": "Malware payload", "value": "2f833e55f77e4ceb95c2455f50153b2edf5b9a3f028e622d73709d3b2eab9d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350639, "uuid": "bbadfe20-cecb-41f7-91b5-9b152b09a83b", "comment": "Malware payload", "value": "88d3370bcccab5bc6efa7c9ee2e104c67123e84c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350639, "uuid": "54bb76ae-625b-4db9-b345-313a312829d2", "comment": "Malware payload", "value": "bb68a25274054f85817cbdd55ff0d54f5afb959d5852880440d7368b79583978dc0602aacc5007b6f25173d673631f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350639, "uuid": "614d47be-5000-4973-aa64-3d7c6da1ce1e", "value": "T164A5DF16FF228406C15E4139CC2AD5FEB515EDAB2401EC6762D7BF9E18F13427CAA21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350639, "uuid": "3e4e9d65-c668-4334-8cb4-71047d876f65", "value": "986e1440e2bb1ed27081f302753b6079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350639, "uuid": "b8781c82-f16c-47df-b2e9-996871e0ed31", "value": "49152:0bVSM/uTQmOSViFsCeIUky7ocGuZirp6Y:0bVSM/0ROSaWkQzGu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350639, "uuid": "4083ff50-4a0e-4e02-9818-038e27bb52d7", "value": 2086587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350639, "uuid": "8de860ad-95bd-416c-a8b6-461b526c8cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350639, "uuid": "610f1815-2921-4c8f-8c8d-2837522e1edc", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd316c75-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408359, "uuid": "bd0edfce-8368-4d97-85ae-93b09d4633e1", "comment": "Malware payload (Amadey)", "value": "c75fdf5ffd4857b5f4a6570f50b6effb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408359, "uuid": "a28416ad-648b-4032-b618-bcd0a3b0a84e", "comment": "Malware payload (Amadey)", "value": "2fb9f4e13aeb2c71d2bc6274f16a926c4df3168385d6ad9744ac6265e59a0eab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408359, "uuid": "f4000d53-6d1c-43eb-9299-68070e3c8948", "comment": "Malware payload (Amadey)", "value": "e11637af27e652df994c838e35f6838f1d195651", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408359, "uuid": "7d6c5d06-e829-4cbc-83d7-734fde3a8e26", "comment": "Malware payload (Amadey)", "value": "e8979487749fe0058da257f01999a6763cca9e1dab41a758bf88c9c44b3d6c66864ad2bd23fdb74ba13cd0cf060c89cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408359, "uuid": "83856465-4f5b-490d-933e-98cde198a9f5", "value": "T13984F102E6E88073DCB5277018F707D70F36BCA55D78936B2746A85A08736C1A876B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408359, "uuid": "6d5d1687-a47d-4175-9642-ba56c63d8241", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408359, "uuid": "e376b803-34de-4de3-b14e-7059f3e65c82", "value": "6144:Key+bnr+Vp0yN90QEAC0XTkWH7ZN0vEDbUTwRzXjyz7Ct/L3VWbfByx1:2Mrdy90nISEXUWjySdL3vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408359, "uuid": "8a1bce41-2dc3-4e54-a571-d8c1f302e4d1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408359, "uuid": "52edff31-ebd1-43d3-b5dc-6a7d92fb2c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408359, "uuid": "c6d32dcb-7925-488c-989e-507c40287f4e", "value": "2fb9f4e13aeb2c71d2bc6274f16a926c4df3168385d6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc7436a-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385197, "uuid": "1f9fb497-a131-421a-a342-73e25a5e54bc", "comment": "Malware payload (Formbook)", "value": "7d048f6853d9cf051871d363f21db77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385197, "uuid": "f86a9fe9-009c-44b2-a90b-b96aa50a331f", "comment": "Malware payload (Formbook)", "value": "3023483cc305946575fd1d72187025aba439c95753d39d586d129880a40052ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385197, "uuid": "b720708b-00fb-4c03-bd93-9f24fde25c51", "comment": "Malware payload (Formbook)", "value": "54edfbdbbd7c9c1e410f94a43ee5708a44bdb4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385197, "uuid": "5e7a5623-0d23-44dd-97d5-8b5074cd8869", "comment": "Malware payload (Formbook)", "value": "2c7c22ec0ec19909abe00cbb554a13e1255a12ac160bbbb0d0df908c96353fd2840fa89c1feec4c41b522b272b539cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385197, "uuid": "292bcfef-d5df-4c79-a8fe-42d203ee05df", "value": "T1D1E40140B39C6B4ED53AB7F10705971953B0867EA102E3166FF224CEE666B11F6A0F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385197, "uuid": "993a7067-69e5-4526-b362-d346b8778405", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385197, "uuid": "53669b1e-e1d3-4227-9d97-d01f09551b70", "value": "12288:pJmefaynhPbeToDr9tXOvSf+P3iiaJkHYfyi8c8z+q9Z/EK1uU3tefCPQJ:2eCQJz4Sf+PaJkExq9ZaceaPQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385197, "uuid": "3c416b7d-5726-4617-9e46-ac66d22fd000", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385197, "uuid": "49b696a2-f833-4c04-8072-fdc2f6cdf090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385197, "uuid": "d9757a15-17bd-4638-9442-16f9c0d1de8a", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adcaa7b-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356332, "uuid": "417118b7-ccc0-4f74-9b2e-121260cceb63", "comment": "Malware payload (RedLineStealer)", "value": "556b6f8063b6be20e9c3cce8da51432c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356332, "uuid": "3750b802-d77b-4ee2-9de0-a61c9973a532", "comment": "Malware payload (RedLineStealer)", "value": "305a49521aa7fa93bdb6f6a01420fcd3800a565c32194a366c1d6a22f8f00da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356332, "uuid": "bd5baea5-d943-46ac-8881-71c1511ddb52", "comment": "Malware payload (RedLineStealer)", "value": "0fc90e69928de47b6dc5502fefa2eae4f82805ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356332, "uuid": "d4248bff-e10d-4a2b-b773-d7c0571032ba", "comment": "Malware payload (RedLineStealer)", "value": "be0be1d379e075ee77970928d845bd91c3b9e8a0a3403725ade2a1762e6bfa8a86a51222bb961692d8930dd5d18b80d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356332, "uuid": "189387bf-b2a1-4bbb-b887-5c381d33c05e", "value": "T1818402136BD58173D8F127B059F603931B3A7CB19E39975B3792A94E0DB22C4A53233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356332, "uuid": "d1814765-62f5-43b6-ba34-76bc036ba642", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356332, "uuid": "e9e174fc-a3f4-4ad4-bedf-b1008c567983", "value": "6144:K6y+bnr+rp0yN90QEqwfVzEk+363cTtpEfG3SCVCzhyYc7SdMMMQ0OoJmCUKWLA:OMr7y90cIzu3ehhyYcOdBzIfUKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356332, "uuid": "b630a8f4-274e-4495-ba13-450eb557b510", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356332, "uuid": "444719e9-d791-4cef-b193-1dcda8d29e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356332, "uuid": "700306b4-c47b-4f65-952b-c2e5eac26d03", "value": "556b6f8063b6be20e9c3cce8da51432c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0555fcc5-2b5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690338472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338472, "uuid": "721ecbd6-b552-4ab7-836f-dd789b904d9a", "comment": "Malware payload", "value": "1cfe08c0cd2e3389ffee84915765a03a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338472, "uuid": "0f146c0b-ba31-4ec4-8390-9d488f3e4464", "comment": "Malware payload", "value": "30b3a610d92484107f21e5bc28f32d008decb661e8044bb782737ace569ac70b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338472, "uuid": "8d29539e-973b-4707-a0b3-4454ac546fce", "comment": "Malware payload", "value": "bd49bcfa7a48a58b4971bb6b1ca0f10175d77282", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338472, "uuid": "81b387e2-54aa-40f2-ad9a-e36a84fd5d5b", "comment": "Malware payload", "value": "400440caa7d3fa211a43477863ddb3bd3513662c52b945b26859da33f81a038dac86743bb13d1de52daaecbe542a9ee1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338472, "uuid": "57bcce4a-4286-4501-9edd-d6913b265f04", "value": "T11D528C72CE070475CFEA0BB84AA76E2F1590B545228E01B08F354E4EAC5179BF6871D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338472, "uuid": "3cedae07-48f4-4570-8c67-9a0503b039e0", "value": "6b2143eb6bf3b6b18e23ff7de66e6891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338472, "uuid": "d4966ff8-1e7e-4907-a338-84a20886a93a", "value": "192:RnmuVONtmUQX1WixmlhHppMIP3RmDPShLkobeUMRQm1q8WkTYj++B:Rm1y3lTIhdP3RmD/weUiP134++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690338472, "uuid": "9309d47e-571b-4180-a9bd-733c9d130742", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690338472, "uuid": "a8a1ae1d-d110-45b3-9fc3-a534ab2dd9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338472, "uuid": "2115336c-0e9a-4163-83e2-594fa1c7ec3d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22462.23368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbad06a-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690385623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385623, "uuid": "c6c02c37-97d2-4f35-8c58-2cc8d9515d81", "comment": "Malware payload (RedLineStealer)", "value": "836c2e6c543de8734f2293001cdeb892", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385623, "uuid": "f75be4d2-10d5-4d71-a674-bf0b3f4c6764", "comment": "Malware payload (RedLineStealer)", "value": "30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385623, "uuid": "7139e212-0f8b-4a88-a564-a9d82ff94a55", "comment": "Malware payload (RedLineStealer)", "value": "8d079b4246c7778350797bb66f290fa4f9e72d7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385623, "uuid": "efcad3d4-e318-4f2a-88f3-220098c9331e", "comment": "Malware payload (RedLineStealer)", "value": "765787391bb206c2c307b8f3e2458eef662e793a19bbeb4771314a015a88f71cf1a7073719dba63e346df83f38850428", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385623, "uuid": "3a7f2889-1785-4d36-973e-13c1dff5feff", "value": "T1DC840203B6E84432D9B513715CF646D30B3ABDB2AC78875B2742E59B0DB36C4A87136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385623, "uuid": "ac718628-5f5c-47d7-831e-2bc4caf2cc64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385623, "uuid": "9e4c82a7-6cc8-4a57-8b5c-2c2706041733", "value": "12288:wMrwy90h82X+eb0XDKMSIgBYCzzq+f0D/:QyXeDPzioU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385623, "uuid": "2effc954-ed6a-4f10-8032-155a4d9fe6c6", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385623, "uuid": "ea3b4602-78a8-4b19-b270-7465fc47386d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385623, "uuid": "bf73a645-fdf2-401a-a97f-5a4936ed3e6e", "value": "836c2e6c543de8734f2293001cdeb892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a504394-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690365592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "a9552528-38cc-4434-b1bd-4392decb2fd0", "comment": "Malware payload (Gafgyt)", "value": "080cff2db6be64827743a6e9f9e144d2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "7570a679-7e37-45b4-8864-9de9e2dee1da", "comment": "Malware payload (Gafgyt)", "value": "3149dd25e8ef6f673f0027cce81c61dd8423d40855f66b4d5f6c20aff3d9ec24", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "42c51d7e-2437-4904-9bfa-9cc395410a84", "comment": "Malware payload (Gafgyt)", "value": "989c69e452837bce99deda1182ea9cb572296149", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "5e113f2a-54f2-4c6a-b569-fdb167b90833", "comment": "Malware payload (Gafgyt)", "value": "41c5533426c5b388810f3dc3898ceaf42412c295ef718cf1fcaa0e57b5efe46549288997e121c6eb556c9d26682532be", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "ff4e59a5-a043-482d-9613-8e03f8c569ec", "value": "T1BC134C92FD819A02C6C15677FF4E438C7B5A4398D1EE33029F296F62374786B0E2B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "1b1ebf96-142c-46ca-a592-2e4eca210cc1", "value": "768:23HwuP2s5Eat6JYLRiDLk9/5E+2tbH5Mi1gbga6zzfHSs1NmjHNpIH:QQABt6JYliDLM0ii1FPzfysyTNpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365592, "uuid": "88f37a02-ce9a-4c68-a4b6-86fda4db5264", "value": 43056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365592, "uuid": "b16879a5-7852-431b-b1f4-b866c037a0d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "f51805fa-cdd2-4ee3-a29d-4fead95b1438", "value": "condi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb0b3f0-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690365628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365628, "uuid": "268abeb0-f619-4e15-b637-f38c10c0d36e", "comment": "Malware payload (RemcosRAT)", "value": "ccf183120b8348168048159469a78374", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365628, "uuid": "9b1e19ff-b4c7-45e1-9050-3b48c216ab74", "comment": "Malware payload (RemcosRAT)", "value": "31620601276007053664bec13c9371cb564e50d76fb58c7d593a694bf4c55b75", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365628, "uuid": "bc8a2f5e-0957-4f3a-9a57-82d9fe61f9bd", "comment": "Malware payload (RemcosRAT)", "value": "d7071d5b13f0f12d3da8a0857df90c5363839208", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365628, "uuid": "1de332b6-5daf-4cfc-906f-57f61d71de53", "comment": "Malware payload (RemcosRAT)", "value": "96819b834b43a1e3a4019d6f4c08ff5aa09e998e0eb6883a370dccaf8535ecb0ea979f8961ad73b0dcaaec164dc9a990", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365628, "uuid": "dc31479d-674e-4c3b-a77f-0719239bdecd", "value": "T10372A1D699F2E3350D9F52BA6449C435D0354CB72F140BBE685DF2A42917308BA7FA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365628, "uuid": "69b7c585-feb5-400d-b3ed-9b60bd5e38bf", "value": "384:DJADO899ys+mstfFS2iW8SgXqNKH051zE:FM9uJtf02hLoH0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365628, "uuid": "f1235e70-3469-498a-b20b-4670ca68b029", "value": 17001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365628, "uuid": "825e0841-e4b5-4e88-b79f-14e952153d58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365628, "uuid": "23406dca-5858-4613-a6f1-f30757a4c1e6", "value": "CamScanner 07-25-2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8855366-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690385587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385587, "uuid": "38d7bcf3-58e8-4607-ad78-2668b8999ba2", "comment": "Malware payload (Amadey)", "value": "f7813b4af850ec19f21ba7aa3e362c09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385587, "uuid": "cf9c7453-f371-4608-b9ad-3e396e7e9657", "comment": "Malware payload (Amadey)", "value": "318edfe41e5664a4afc31db7bf683c25c1dda3ae1a35b216404f72a93204114b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385587, "uuid": "7faefdbc-fede-4827-b680-35894f0457cf", "comment": "Malware payload (Amadey)", "value": "57c0e3c96f761891342f711001f6c11a4303158b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385587, "uuid": "0f25b0d0-8c29-465b-8d4f-ee6881f4a691", "comment": "Malware payload (Amadey)", "value": "77032a1c99c308700d90ba31809bc7c5fd4eb01650257d9ed678f5c0d6fa3a3c6a6e6a589dbb228e0b724cc5408ee840", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385587, "uuid": "218eaa30-6908-48a2-a391-3f29a14a0bea", "value": "T1173408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385587, "uuid": "20562a3a-830d-4f4c-81ec-251787b2fd7b", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385587, "uuid": "14ca9c26-782c-4284-8dc8-19ecbf11257a", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385587, "uuid": "b7df5ed5-63c6-4cd3-841a-5ba7d75f1863", "value": 230551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385587, "uuid": "7e1fb4db-43ed-4804-95e5-e6a04aed2b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385587, "uuid": "3bf545c6-0172-4b93-94dc-f2930da84847", "value": "f7813b4af850ec19f21ba7aa3e362c09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933874a7-2b94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690362762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362762, "uuid": "897a1d64-3814-4f7b-aaf2-5e7b14e47f78", "comment": "Malware payload", "value": "83b80af5bb79dbe2cd1f06286d904162", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362762, "uuid": "dec9fd1b-71d0-414b-8c52-49b1ec018db3", "comment": "Malware payload", "value": "31f223ad23ff9b2220307d38630dfb3c806bacebc56e3af327ac6a3e31971e3d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362762, "uuid": "312c8f4e-3f07-4fcc-8d00-3ed33b6f026a", "comment": "Malware payload", "value": "c592f126758fc66bafdd3746fd74943bea817e0e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362762, "uuid": "dcb499f8-a499-4dbe-bd23-db7373e6a03d", "comment": "Malware payload", "value": "1892db90a097f0f065a74547e2a4fc0821e23a85aad97752bd955c472c0ade48fa2310f7968c97658f79408734489877", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362762, "uuid": "a8b4040a-d47f-4fcf-aaa1-1595e567452c", "value": "T15CB4237BB64D990BE31FB572A3CAAC4AA4F5C5E425784A0978D3CB5D000EC11FF8D661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362762, "uuid": "70593cf5-b46f-4df3-9b72-199a4ae674ef", "value": "12288:aHix6kQWpwGx/wtmi6EUea7pmuigDeySFF1+O1p:36kQWDxUNURY1weZFNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362762, "uuid": "c4728add-97a3-47cd-9364-a075a7a8df27", "value": 519238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362762, "uuid": "a6659135-e62b-48fc-8cd7-ffdf8637e935", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362762, "uuid": "57059db3-a999-4c5a-8139-89cf2a1e1650", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f232c4b-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356956, "uuid": "f8b989c6-358d-44d2-8eb4-521f29ae7f94", "comment": "Malware payload (RedLineStealer)", "value": "df8577ae2727207fd7c51ce5dcfa4b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356956, "uuid": "b5472934-4fe6-4c35-a466-062c670cd570", "comment": "Malware payload (RedLineStealer)", "value": "31fed4d6258d4aa455eeddc33ac3fce15fdf9661eef78465ccbf0f34cd8cbdde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356956, "uuid": "221aee02-38cc-4cf6-a87d-477e4b01b15f", "comment": "Malware payload (RedLineStealer)", "value": "56a432cba6a475ceac14fb0ac5bfef1cd60d723e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356956, "uuid": "8fa7703d-7174-44f4-aeff-e99ab8945efd", "comment": "Malware payload (RedLineStealer)", "value": "2df186a5ecb45bb2de7c2182bedfe5192f32eee9610f1db6f489505326bb6626d68b7956f42408887d9471c19f637855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356956, "uuid": "9c5065b8-0361-4c00-91a0-78a3b1ca6d04", "value": "T100840246A7D88173D8B41BB018F617930A35BCA19EB8536E2785AC0E1C732D4A57276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356956, "uuid": "200b3eec-ca96-4907-985a-fa9c0e0f8747", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356956, "uuid": "c98287a6-c902-4838-98a0-920c87bcccc6", "value": "6144:Kjy+bnr+wp0yN90QESxl9mON40pbDrIkmp9YxYMn31Sw6QgBZ+t4/DH25W7g:BMrEy90m9Y0p7t0YzF6QgBYC/T25Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356956, "uuid": "0e44fd08-f460-4128-ae6a-1c5d1f73fd5a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356956, "uuid": "ed9cfe82-c6e8-46ed-b105-c272ec80c158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356956, "uuid": "6a90b7ad-29d2-4f26-a904-a90a85d6c920", "value": "df8577ae2727207fd7c51ce5dcfa4b3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2b6168-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356336, "uuid": "87981299-b266-4d59-84f6-7a96227e6951", "comment": "Malware payload (Amadey)", "value": "69a65bc5073fd3fa7484f93c8c592b66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356336, "uuid": "1d975d99-4c09-4d67-9eb7-ceeb3c74632f", "comment": "Malware payload (Amadey)", "value": "33b9825f7826b1eae609c14a5adfce194f59cc3b8eb9953a8541a2ea773c419a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356336, "uuid": "759337f7-5739-4fe2-b99b-ae35d505b496", "comment": "Malware payload (Amadey)", "value": "526d977317ddfc32a5b830e6f28fb6c1d557a4d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356336, "uuid": "945efdd2-5894-4771-8a6c-55e4c609fd7a", "comment": "Malware payload (Amadey)", "value": "13c9d7a8fa8dfceb61e0b145eb78e6e298e4a1384823294d63c5200b5cb8a88a7ba34545de78527e13cffbebcc26277b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356336, "uuid": "9317e446-9fe9-4ef8-ae86-2c41ad2b8ad5", "value": "T11D840253BBD88132EDB517B018F707831E3A7CA15A78836B2305AD9A0C736D4A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356336, "uuid": "c76593e2-216a-41b8-a6bb-2c2bacb72445", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356336, "uuid": "0fe0771f-ca7b-4120-90ce-ccc3e7339109", "value": "6144:KYy+bnr+gp0yN90QEU6c4XdkWzjZNcPRWeDV3dsMQUvhKXS5fSvIE2MkddrSx:AMroy90NcUcsMPheS5fJlTdd2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356336, "uuid": "86028061-5828-44a9-81f6-513f676c529f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356336, "uuid": "57d10ec1-2fa6-4a9c-a70b-da74fcbf25e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356336, "uuid": "1e89fe98-40ba-4f01-bdb5-020092a1ebb8", "value": "69a65bc5073fd3fa7484f93c8c592b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32a7c9b-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690357258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357258, "uuid": "90d1fa2a-5db7-4daa-839f-012854119f66", "comment": "Malware payload (Amadey)", "value": "ed816c985dd7ace25947cd2b7e7d0d37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357258, "uuid": "b3722567-e212-4a55-97ab-154f7623f068", "comment": "Malware payload (Amadey)", "value": "33c29441827f03d0a12eb37f77ae5a4339f9af785b8d34af2254a5d423005495", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357258, "uuid": "452a66d4-a790-4ae7-bea9-cc0299c44ef5", "comment": "Malware payload (Amadey)", "value": "99a1fe7e3e47d0ed14c4231c347d31fda52b8887", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357258, "uuid": "01b6fe42-f5d7-43d1-922c-0d3d90ba3648", "comment": "Malware payload (Amadey)", "value": "1cc8dbd4b93b78cb13ee284dd3777238aa0805faffedfaa8b903316d88b48e9578143e3d2da7fcd6c81f1a84a0fc812b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357258, "uuid": "fc2280a6-0356-454e-bd2e-d4807db90424", "value": "T1FC840102FBD88032E4F567B05CFA53D30A36BCA29DB4C36B2755995A1DB3181A87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357258, "uuid": "cabac9c3-b10c-4f37-8a9c-9862e343cd71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357258, "uuid": "25ca3674-cf28-4ee2-b668-f87765beb318", "value": "6144:KEy+bnr+2p0yN90QEkkrqxid8ZVpV+Ss/xdQ26AAd6DMmnBLbuFwMjFMcmb6z0Um:AMrWy90x5PAADrB0mEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357258, "uuid": "0dc07f2c-8da4-4adb-8e4d-69df9efbecc6", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357258, "uuid": "08683095-7fdb-44b9-bb18-3f77f097cf71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357258, "uuid": "821a0004-3f07-45c2-a039-e676da12d14f", "value": "ed816c985dd7ace25947cd2b7e7d0d37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896c20a4-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690356303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356303, "uuid": "2ec453ff-40c7-4be6-8d09-795ae20346a6", "comment": "Malware payload", "value": "3a5b27d89eee0fc187d722265defaadc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356303, "uuid": "6bb0ee08-1280-45c6-948e-5951b57fd82e", "comment": "Malware payload", "value": "33ea8cc570fb2b8a1d0899bad3c57723a3ba950d9400a111270cca4e5b4f5081", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356303, "uuid": "af57a23a-a62d-4a55-982d-971219e264a9", "comment": "Malware payload", "value": "e2bc008bf7669563806b67674e45005d691b0f62", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356303, "uuid": "be7b26af-d925-4183-bfe9-121d9945b2cc", "comment": "Malware payload", "value": "2227ff8e597693f47e9a98b41d780ab251bde2bed6e4e8ae1cf19e41d6c7a3f5867e159ec921c038c3693a859d6a2639", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356303, "uuid": "555b18b4-3b85-4b5c-977c-53f5d769c120", "value": "T1B213C25AE79F02A8CF511273171A1E89A6BDB23EB35051B2345C933433EDC7E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356303, "uuid": "d37c2ed5-160e-4a73-963c-e9cd48071883", "value": "768:dFx0XaIsnPRIa4fwJMQl07Z50en6Eg3CTBnswNXY:df0Xvx3EMwCZmenekBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356303, "uuid": "2845fa18-1649-4d4b-b414-3444c7b7d660", "value": 44281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356303, "uuid": "18058cf4-21fd-4519-a2ff-6116d4676720", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356303, "uuid": "c16f1c7b-6dfb-4eb2-ac83-b01281d33216", "value": "Payment Advice_3744956.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7671f5f9-2bb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690378605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378605, "uuid": "43528f3c-47c5-4a56-81f5-ebb28505d2fb", "comment": "Malware payload (Amadey)", "value": "66f54ffe709bab07100af569ead4119a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378605, "uuid": "8c3fdf7a-5906-44f7-9de3-dfdd9a86d392", "comment": "Malware payload (Amadey)", "value": "349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378605, "uuid": "a7f8897e-edb5-448c-89be-ee6ed54954dc", "comment": "Malware payload (Amadey)", "value": "1cb8a599e4e929dd6a1b918a8b67a8febc8a0750", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378605, "uuid": "7d2994e0-d624-4070-9d20-f97929261130", "comment": "Malware payload (Amadey)", "value": "6745f5f6a2f3bfa7d340eec3642e9101eac2ce21107cf4f37d2c473589bcb68bce186b8b53cbdeece3dc1513f5ddd1c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378605, "uuid": "cdf709fe-c4af-4bdc-bd08-e645da37283b", "value": "T1A8B41202EBC89027EDB617B049F7038317357CB0AA78D36B275A584B8873785A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378605, "uuid": "ea817cc6-716d-4d0d-a6c1-917bba13660f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378605, "uuid": "25f79f5b-6fa7-4a25-9b36-d6e1d46f1817", "value": "12288:6Mrby90AubVaRq5diuRCH+QykIb80gtid1ZUcTL/:JyjZuRCH+Qy73gtiD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690378605, "uuid": "7b409570-3966-470b-bb3a-b33c4ac1975d", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690378605, "uuid": "c8bc6738-3081-4952-ba71-9f5cf47f4b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378605, "uuid": "4fc957b1-dc98-4f44-b603-6971d7c393aa", "value": "66f54ffe709bab07100af569ead4119a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0753784-2b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690347456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347456, "uuid": "57beefa7-46cc-4fe8-8e03-7d63114449fb", "comment": "Malware payload (Formbook)", "value": "1e2df0ab232642aeb27ac3b4bbac2260", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347456, "uuid": "303ed885-5f5d-4d5b-a2b4-85b0c2d84cce", "comment": "Malware payload (Formbook)", "value": "359cc4c08d7c6be094a93950e4350f0234a5cd5f42b9a4e790049f36af1ac8a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347456, "uuid": "16fa9163-6ecc-4c51-bace-de30d815bc05", "comment": "Malware payload (Formbook)", "value": "ca8e9c16f28062acba1a33655dffc450d5d677b1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347456, "uuid": "cda09d6d-4a3a-44f8-9870-b32131d3894a", "comment": "Malware payload (Formbook)", "value": "e94d373f962e373fd5721462935eb7453664641f2b2a8906546f321112e74721c626972144fffc7e8b19c65d1126574d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347456, "uuid": "53eddfeb-e748-4559-a4d0-eb7a392cd39c", "value": "T1B3C42378D2C278E7585F08D9C2F9FB777E0361D002351E7427EB9C3D11A867ADA860A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347456, "uuid": "801f32ba-11e0-401a-8413-3056ae126ac7", "value": "12288:ra+iYESzGoJg0Mc7iUlJzkzEAiRHzbc/rK37gMKQ+8S23Mc51rfMyqZYU:GHlSLu27PfkzERT8+sq+87Z1bMy6YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347456, "uuid": "6e9e9ebb-c32d-4cb3-88d5-e90b0fad2004", "value": 550758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347456, "uuid": "0f53db6d-e4d9-444a-9619-ddbeb4747355", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347456, "uuid": "90732e71-49cc-4d72-a9a4-5d12bfc3d081", "value": "RFQ # 1045981 - MAA_D Plant Project r01.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b46fed-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690386626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386626, "uuid": "6833fa3c-2318-46d4-a735-6db7baf3d589", "comment": "Malware payload (IcedID)", "value": "4b5bfea94ebec929317edec2b119cc7c", "object_relation": "md5", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pw_524", "colour": "#6B5491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386626, "uuid": "219bf825-9764-472c-8f34-63079650f45a", "comment": "Malware payload (IcedID)", "value": "370e88365578673166f376e689603efdc9cff084df9f36ca3a7e96068f1e16b1", "object_relation": "sha256", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pw_524", "colour": "#6B5491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386626, "uuid": "ecc21b8e-d19f-4898-9727-09306d2a2e43", "comment": "Malware payload (IcedID)", "value": "a9357dabbd3530b3629b57cc67fb8b7067451f52", "object_relation": "sha1", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pw_524", "colour": "#6B5491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386626, "uuid": "ee92995c-3fb4-4f4b-b4ca-3d0367fd0da7", "comment": "Malware payload (IcedID)", "value": "31d88ac8fd1ffc19be27a071329de11bddabf8ade4c31a87f10485e41aa7ee17f8c208feb0caae30351e00102d4f2a1e", "object_relation": "sha3-384", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pw_524", "colour": "#6B5491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386626, "uuid": "81ab5a1c-6ce9-4048-9ca6-e6801af97b32", "value": "T1C8D312C7D57F8D0DE96E993EC47998870BFB56352ECCB3B07E1488C65C44A40AA419F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386626, "uuid": "f127e8a0-c297-426e-a55d-1bb1983806e1", "value": "3072:oRkHxP3w+goZw1+TgIf9n9qZHxreZGf5feizv6h/F1WXDS:5HxPsoGkvgHrOGRfeP/F1WTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386626, "uuid": "d62aac55-5f99-415b-aa09-777a135c76e9", "value": 136999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386626, "uuid": "a7458661-40d6-467b-9c80-9d5705bc8972", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386626, "uuid": "717623ff-1323-4ea2-9e7b-ad2e361b8a11", "value": "Scan_Doc_07-26(347).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d74137-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1690384971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384971, "uuid": "c2014938-dff8-49c1-8f91-163e63e03908", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "1b8d390a00367f1ba41771585c19c4d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384971, "uuid": "62efdad5-6405-4d18-8a75-db2c1cbd7c9e", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "375f623741fe071117c32d8e027f9a705ab54586b12ee5504a56d2205e95b38c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384971, "uuid": "cb145d23-32c2-4818-9060-9c4fed137705", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "b984fe36f8e304013f64733ee8efdb25d38062b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384971, "uuid": "322b032a-0447-432a-9ff4-810ecf171d70", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "b3e47d466421274114877210b24034f99b412a779c64b3304bdbeefb311be71275e97f1ff69977cd0306783c5cecbb40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384971, "uuid": "e245f6b7-2d0a-46b8-9826-6c6019510ce7", "value": "T1BAE47D8383A1BE44E9254B729F2FCAE8760DF6518F4D7BE6A1289F1F04B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384971, "uuid": "0997f1c3-d432-4a66-858f-1ff969d7a39f", "value": "bc04db2ad2507103ec76e744e96f25ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384971, "uuid": "8dcc8132-7df0-491e-858d-a13471f5bce7", "value": "12288:YQAZf5GOE4nVdrj8NRbsrAscGxh0OamxhrcZjmz:YXvGOxnVdk3bscexh0mrYjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384971, "uuid": "77bfba3b-2d6e-4706-b96f-e1308c5621d5", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384971, "uuid": "8b400500-522c-4a0f-97b5-494a21f043b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384971, "uuid": "d3b010a9-6c38-4638-bc26-5c1e56ecdb14", "value": "1b8d390a00367f1ba41771585c19c4d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1420aa-2ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690368600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368600, "uuid": "9ad944a4-99c5-406a-8fb3-814695a894fc", "comment": "Malware payload (Gafgyt)", "value": "f81d3946dbe962f8ce961dc9b6f6683f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368600, "uuid": "43a63011-195b-47ab-b02a-960bc9669709", "comment": "Malware payload (Gafgyt)", "value": "37b274758be3f2ece16060d77d2197dea0a4965d13662ff99d328462d72388f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368600, "uuid": "ccbe571e-ce9e-44b0-933d-e0a25734cc10", "comment": "Malware payload (Gafgyt)", "value": "0374a0b7c012398b23f4c27ac66b09ae6da85d63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368600, "uuid": "cd91b74f-2992-45d2-b2c2-794a617b8d26", "comment": "Malware payload (Gafgyt)", "value": "6571bab51e3324de33f5247b54a2c38d585cdd6094b353071a44c15f3e7f9c54c52756580de761a5680dd4e8f47ac0c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368600, "uuid": "b265594e-0164-4518-8b63-dc4cfb7cd665", "value": "T1EA136CA3C9652E18E29985B070148F795BA3F924928B5FFE1179C3699043ECCF51B3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368600, "uuid": "775db64d-9f1c-4209-b1b9-b964e5d3c675", "value": "768:txOrWTmsCUwtMsADUYTSDn8oKbgrasa4oqbHuCdLu1vfItBAkCI:urDnUwtfZYmDtKbgrcXquCdBt+kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368600, "uuid": "c6399c6e-6eac-4b59-b6f7-eff1cd503d54", "value": 42364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368600, "uuid": "867ced68-d773-4dd4-b9c6-142fb09870e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368600, "uuid": "75d875e5-b9e5-4c3d-9f6b-25a9fd3b6ce5", "value": "f81d3946dbe962f8ce961dc9b6f6683f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907ff7f5-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361468, "uuid": "bbdbf9c9-994b-45b8-abf1-9508fe7907db", "comment": "Malware payload (Amadey)", "value": "9057483041b7df7b4586990456b2fb8d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361468, "uuid": "b84db4b8-deac-4625-978d-f698ec920495", "comment": "Malware payload (Amadey)", "value": "37d6c2c5430b1cd4cfc4a0cb5210b4a101a0d2fb2d95c9b0ef5a05c7f602f70c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361468, "uuid": "f5892b4e-c396-4792-974a-8e89627c4587", "comment": "Malware payload (Amadey)", "value": "dbd26af5c9f837f44f2f4555f847fcee10feb78b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361468, "uuid": "89da00a6-3bcc-46c3-beb0-6a2839d3b4cf", "comment": "Malware payload (Amadey)", "value": "43b105d3a6d11f788713a24848c6004d367fab866fd5cb8895e0acd98631056ad269d6f6d49efee8e5d0457b989783ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361468, "uuid": "107c3a97-2e1f-4bbd-a058-f23e2847a6f4", "value": "T1D5840242A7ED4032E9BA1B7018F612C70F3A7CB19D7483AF2746995A0DB26D0E47573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361468, "uuid": "6a884f3c-5bb7-497b-9841-8e927e626063", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361468, "uuid": "a96b64e7-4bbf-48b6-9372-bfd21185e9f4", "value": "6144:K/y+bnr+Ap0yN90QE+y4OpnErW4HqkDc8k+SYyfXcD3cmAMiqWRY:dMrwy90FTpErgkDbSYE2jiqyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361468, "uuid": "daa9bdaf-469a-4fbd-8b97-1d52f22d4713", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361468, "uuid": "212cce52-0c4c-451e-9fda-e5e894e40872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361468, "uuid": "c27b690b-c427-4f02-a2fb-ec31e94e02e5", "value": "9057483041b7df7b4586990456b2fb8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b270142c-2b53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690334897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334897, "uuid": "53fe0617-e6d2-453c-a2b3-a64a3de55921", "comment": "Malware payload (RemcosRAT)", "value": "c5b0e19ef0ac1a0ff7a848c9b156fd60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334897, "uuid": "7a6d6c94-e4b4-42eb-a40d-bb29c13a4b37", "comment": "Malware payload (RemcosRAT)", "value": "37f3dc0db96f235594f3e2153e851add6103e86a79b81722a130c592d1981f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334897, "uuid": "7807b517-1d36-40cd-9b96-efce3366803a", "comment": "Malware payload (RemcosRAT)", "value": "c6b0df641c971af82a14cf71cbd2226f9430800e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334897, "uuid": "514ce232-6a40-4848-901b-0218ffa040a2", "comment": "Malware payload (RemcosRAT)", "value": "8ccbc8efe67ed8d0835fb03583548d85df12dfcdf3ce733c983046b54245af3a1287f3c52b50a0f56a5b6dcac46a0aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334897, "uuid": "d079779a-8fe2-4fde-a905-6d1e2e262404", "value": "T182A42300B964D2E7DD860A72597709246B7C56200AF85B07DBE18F5E3932963EE0BFF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334897, "uuid": "ace56cf4-5129-4d20-8c2b-ec29374ad7a4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334897, "uuid": "5618c876-052a-4fc4-8d95-ec1c7f025e18", "value": "12288:vYpTPuz7x1BnMKo42AEJ2Nb2qoa12PaS/zcWhi4c:vYpqz7x1VMgEg2RaYhLcK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690334897, "uuid": "562d541e-ffde-47a4-a696-cc1c5dd87ee8", "value": 488672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690334897, "uuid": "b6cae37d-67fd-42f3-878b-52cb1d10dce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334897, "uuid": "6e853c4c-58f2-480a-b2d4-260cc7182b8a", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29604.8216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32288c21-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690375913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375913, "uuid": "059ce996-75d1-4e0f-96e6-e361958e778c", "comment": "Malware payload", "value": "9d4388e8f9c50bc063a4a284e7b4983f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375913, "uuid": "66a0e87b-6414-4483-818a-2360269ccbab", "comment": "Malware payload", "value": "380db9c9ed006cb1ce838ff40cb74bf7c5af0b707db1e83a13353a89833f058a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375913, "uuid": "90eb1307-d833-4742-9241-94ed36313c7c", "comment": "Malware payload", "value": "81a16a5a06c71eddfc4622346b442733e5d410f0", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375913, "uuid": "9ccbdae5-f357-4bab-997b-bfadae3dbe28", "comment": "Malware payload", "value": "e9ad08aa14b7a61d7d7432916273b32aa68215378e04a8e767ee5bc22c74ccbd092f80060f3f3cc19497b032c00c4506", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375913, "uuid": "19ee390b-821b-4984-94bd-3880304aa0e7", "value": "T174D423C5C3A61DA6D9370A35BC18F215E7FBEC6861B61E1FB70C40431B97A9EC9003A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375913, "uuid": "19e0a717-ed40-4211-99b8-ee27ef078105", "value": "12288:S2rsyYgr4Dyo/hbhf3lMJYulWNjhsCnufw1u+0/WLG/wYm7PH:S2inZ/hBUlWNhsuuI1MZBg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375913, "uuid": "50809496-49e2-40a0-9211-6b967927be85", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375913, "uuid": "5ce5c043-626f-4c54-9b39-a12509aa0d7b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375913, "uuid": "af5d8743-c056-4dc2-90d7-ee7132f6cd21", "value": "nSB6ZY9GL_20230725.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d043df-2b53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690334896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334896, "uuid": "9054892c-fbde-4650-829e-5a828fbda3cb", "comment": "Malware payload (AgentTesla)", "value": "e41d2819d74342dd3f5721782a95a0bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334896, "uuid": "44a44dbf-5a22-4379-8347-b18d3ddc146c", "comment": "Malware payload (AgentTesla)", "value": "38dc7554359b82417ee81851f0bd42f9661cd4d4b70a648ae8a8cdf1e0b50b37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334896, "uuid": "ff88b532-bede-41b6-a5a9-c7289290f88b", "comment": "Malware payload (AgentTesla)", "value": "1ae81bc01402e12e0b8a8206679f4ae0e0f6485e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334896, "uuid": "e6006a6f-dfb6-478b-93a7-79cdc4ad53c2", "comment": "Malware payload (AgentTesla)", "value": "45b2740ae0bd80b7e55dd6e35f36e661c4586d4d963e29007f59b7ef036ab34eba44f150db065e30121b8f1ef616454c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334896, "uuid": "c033e950-bd35-4fba-b19a-6a0dbc237ae3", "value": "T15A5412096BA0C6F3E0B352710E358AA69FE2A52774FA974B13506B0CFD572109D1EF83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334896, "uuid": "c6d401ff-2546-48f8-9202-846728a80015", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334896, "uuid": "282acfe8-4477-4797-9802-67fe54ffa2a5", "value": "6144:JYa68Xa1lfQzm1pDWj0qyz9jDDKj1YsXQSyubYUQE/WzHlj/JYt5w:JYOa1u61BWj0/FqRLXtyWJ/WzYt5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690334896, "uuid": "19090115-0c41-44c5-8725-2507ed135f1e", "value": 298699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690334896, "uuid": "668d01bc-673c-46c3-b775-3eaa6be96635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334896, "uuid": "113158e9-61e1-4378-b5b6-c84f0351b36e", "value": "SecuriteInfo.com.Trojan.Garf.Gen.14.27593.17668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8e7689-2bb4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690376499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376499, "uuid": "a2a927c1-a06d-44e4-b391-ec1f982a2426", "comment": "Malware payload (RedLineStealer)", "value": "77af54272d46c055ae6c5d5cdc6e00c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376499, "uuid": "8d15430f-35c9-4d1b-8b97-209a77b4c92f", "comment": "Malware payload (RedLineStealer)", "value": "38e8001552cd12354fcea4bd1e717299e2cf242769089997d17fbdd3c79d07de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376499, "uuid": "80d965f0-4002-4895-9849-3820fc42fe47", "comment": "Malware payload (RedLineStealer)", "value": "3787b2c6e7a354c3a958c28b80540512923a559f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376499, "uuid": "aeeb0d55-6337-49d5-97c4-f386884dfb72", "comment": "Malware payload (RedLineStealer)", "value": "1bc2b8ede5c5655c78cf84d685964d10abe54fa38e4875222b800e3dcae6e59b71d4bb0a434587629eb624e55c9a5e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376499, "uuid": "8d51be9c-776f-4055-86f8-cbf6fa9e5240", "value": "T1F284F103A7E89532C9B517B098F603D316357DA25DB8836F3746A98B0CB36D0A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376499, "uuid": "9a733e08-b1e3-4a06-b204-a97a583e2369", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376499, "uuid": "15f5febe-fd04-4436-9bad-d64757e5a3a9", "value": "12288:eMrAy90nzM6+HYVH6CZs++t3TqqAPgBYCUJtxAg:uyczM9HYV6Qh+t3oozYtGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376499, "uuid": "2aa016d9-cb51-43d9-8254-9bed639fb8e2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376499, "uuid": "cc054bb9-e016-4b2a-9eaf-412eb167db73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376499, "uuid": "1f81becc-1db0-41bf-b2ed-6cb80785deba", "value": "77af54272d46c055ae6c5d5cdc6e00c1.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d951cd-2bd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690389428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389428, "uuid": "34cefbd3-3e98-475e-8d31-450e64a643e5", "comment": "Malware payload (Amadey)", "value": "0bf5ac5b2dfdec8e07c14b8c8136224b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389428, "uuid": "abcdb1be-f8e5-44e6-9403-044bdfdd03f5", "comment": "Malware payload (Amadey)", "value": "395191c95c0fa28bd5a74a35e8ac2a4df5535294e9dbdba18a910f4bb5e56b34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389428, "uuid": "5cdd0057-4576-47df-8616-36e5c118caab", "comment": "Malware payload (Amadey)", "value": "ba7ebb12bb085d6d9a76a52a9041daabc8dbcd7e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389428, "uuid": "e005d28a-ff7d-4998-a942-b082c127674f", "comment": "Malware payload (Amadey)", "value": "f547d94c449d4fb3f6868fe75cfcfd78c38e83940cf2142d1158114eb2995048dafaa9d405f8a87572d017d19117f495", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389428, "uuid": "7f0ca3bd-703b-43ed-baf5-3c72c5f95231", "value": "T122F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389428, "uuid": "0f6a07b6-59d5-4ab2-b36e-7b026c636e9c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690389428, "uuid": "cc666238-de1d-4b9c-b53f-368604b41c62", "value": 35810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690389428, "uuid": "43ad3e74-f2c3-4deb-8433-29c4d942e876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389428, "uuid": "1aa4490b-2ab4-45aa-a39c-32fdbc270d19", "value": "0bf5ac5b2dfdec8e07c14b8c8136224b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc916ff-2b7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690352955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "747f15f8-b4bf-4605-a686-18491186d59d", "comment": "Malware payload", "value": "16ccd769444efccad549445bee1a143e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "f47a2386-a72c-4110-8042-625b614fa349", "comment": "Malware payload", "value": "39ae0f728fa70f88393c1ff6e71502e300ef4197a5214b2cc99d42bb2683ba90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "5a37e431-4bba-498f-aef2-d0b3bd29fd36", "comment": "Malware payload", "value": "f5c2bdd6db999fa878df6fe180d6d5454391706f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352955, "uuid": "34d7287d-caee-4b62-b5f4-3b1a61a74dae", "comment": "Malware payload", "value": "8192461de025e5fa2b90dbad756a68c01c589b1cd238e7c1d18e25380f821150f6f05db54037f08d8445ab557ae41cb2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "d133f09a-2db3-4f0e-b74f-2863bb6de301", "value": "T152528D769F0344B6EEEB2BB446EA5D4F0660B505A18D41F0CF340E2E6C143A3F99729A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "d6fcd2e2-682d-459b-8804-b87b93b05f33", "value": "6b2143eb6bf3b6b18e23ff7de66e6891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "c17b7377-e558-4e0a-b117-77340ecaaf74", "value": "192:MCQQ1VONtmUurX1hixmlhHppMIP3RmhvA31rZ/XyrKyBhzdPAL1pzSflAfdHAHFe:MCh2y3leIhdP3RmhMd2hzIyufdIiQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690352955, "uuid": "57a565a3-9c36-4828-bf39-977ac42379e8", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690352955, "uuid": "a1bd0f87-aad3-4f52-ac89-6d1322f2df8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352955, "uuid": "bedd1dfe-f241-4ea4-809c-8277faf177e4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14073.5160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10791ca4-2bb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690374998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374998, "uuid": "9b69ec6e-effb-4200-b07b-f20dcbd0282a", "comment": "Malware payload (Amadey)", "value": "73d2a6278d36f031fcc2809ec61fbdaf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374998, "uuid": "9dc8fa95-48c5-4102-8362-11dd5cbcc1e2", "comment": "Malware payload (Amadey)", "value": "39d760b3617649c7a02c25faca8208aa4246bb7a24d130e0173a116558c31238", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374998, "uuid": "dacd467f-015b-4af6-8ffa-358596d01bbf", "comment": "Malware payload (Amadey)", "value": "e652e853723ad854ff233eaca97a8e26623512ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374998, "uuid": "d7662974-a281-45a3-9916-8702dbedfbb4", "comment": "Malware payload (Amadey)", "value": "3819952513943617d1a109f3ccf6ac7788af20ebc95458c95bba374ff1c6e4de7325033d42779e1c456021e1c9c982bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374998, "uuid": "8e1bba34-b5ce-464a-b720-5ff102c7d4ac", "value": "T139840252A7E84577EDB427B05CF302D70B357D91CC39836B234AA94F4CB22A4A97172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374998, "uuid": "09ccc807-e698-427c-883c-66424524626f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374998, "uuid": "5d9cce56-241c-4950-9179-8d90c6600ad8", "value": "6144:K9y+bnr+ep0yN90QEQ+7ZECyP9/LA87ulSAEfY//m6m+dKaFlpUYPeSgNn:fMryy90rNECylESASY//m6KWpD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374998, "uuid": "cac669e6-c0de-4f6c-aa86-b18040dbc194", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374998, "uuid": "9d8d5a03-0120-4f34-9161-f9df9d3beb49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374998, "uuid": "8ecb3035-f7d4-4760-860a-f05aba5d5767", "value": "73d2a6278d36f031fcc2809ec61fbdaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb109ff8-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690380116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380116, "uuid": "519d755e-a835-41d6-8b3e-92eb5657d74f", "comment": "Malware payload (RedLineStealer)", "value": "424448615936b35c7e0b163eaf78213a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380116, "uuid": "d140ecb2-cea4-4b77-99d6-aefe272591fc", "comment": "Malware payload (RedLineStealer)", "value": "3a6b3b4c875434acfec528f684acd803ace2c2d525158b39568fef9073dbcb75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380116, "uuid": "e7de3b84-7690-431a-8a7c-84c466d13c4a", "comment": "Malware payload (RedLineStealer)", "value": "a4e44f840e8de01f6a0f238c8910804deba9d604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380116, "uuid": "a813c4ad-cfc8-43a6-976e-a55ad4f10299", "comment": "Malware payload (RedLineStealer)", "value": "4ca7552d5c17d27dab5518aaa7ee9e7a8b44219d6b479ea1f8d95f78b99b83728a1c62d1842ad43f4a29412a81a1b5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380116, "uuid": "1c8948b2-45b2-4bb8-987c-80625a89f2c1", "value": "T17DE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380116, "uuid": "0f2040e6-ab67-4f48-bc3a-415f4feb5aa2", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380116, "uuid": "9fe268c7-ac6d-4904-81ac-fb5d38e4147f", "value": 31319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380116, "uuid": "dced455d-2363-487b-87c1-860a84f763c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380116, "uuid": "f9c002b7-08a0-49c1-b535-b11b19f78979", "value": "424448615936b35c7e0b163eaf78213a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6403d21-2b48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690330232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690330232, "uuid": "3b509f04-8e7b-4d5f-856d-064af0329492", "comment": "Malware payload (Amadey)", "value": "8e667084524c9501437cd806a391ff09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690330232, "uuid": "348d5289-8c62-4e0a-8952-63db3115ce95", "comment": "Malware payload (Amadey)", "value": "3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690330232, "uuid": "85111a78-2100-4016-8b38-4620ce529260", "comment": "Malware payload (Amadey)", "value": "2c88b8d58c6cd3e3a299a36687ffefbc89385e86", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690330232, "uuid": "79ca7fc7-5f9a-4673-b33f-d5e995b25d98", "comment": "Malware payload (Amadey)", "value": "3fa0f77b63500007e920a587f6c3735b5828303fb5bbafddaba2ae7606f9b749ef75446f84b18ed40edfbb55cee75ceb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690330232, "uuid": "fb7a9385-72f5-4622-87f8-846451d619e2", "value": "T154840107BBD88432D9B52BB019F616D30A32FDA05934476F2786AC4D1CB36C4A97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690330232, "uuid": "1a64b087-dbc0-4e52-83e7-08f3012d70ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690330232, "uuid": "4c29839a-c29c-4078-947c-3da901a7e252", "value": "6144:Kfy+bnr+jp0yN90QESxK8s3JXYQoKZ8pxgiFDgXq9asAxgiNcjr8FyUuscU5GNt5:1MrXy90c88SoQUxDgXEa78N5HUoNt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690330232, "uuid": "39f0e9fa-116e-4340-b13e-73b53e17aff3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690330232, "uuid": "eab0aa2e-00c2-4ec3-8d8e-447971c2001a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690330232, "uuid": "7012af08-4931-4fd8-8ac1-8782cda48b8a", "value": "8e667084524c9501437cd806a391ff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104de1ff-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356958, "uuid": "9a0a6937-a17e-402c-9677-ff82408e40fe", "comment": "Malware payload (Amadey)", "value": "fa1e6494c945de20845430bd12159490", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356958, "uuid": "1707f551-0db8-4d84-a440-3737d2116f28", "comment": "Malware payload (Amadey)", "value": "3ac5c1f8dcb6260531f48e3a8ba3416b0340e2d5e7c1498986f7b3ae291ce433", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356958, "uuid": "d5432383-055d-4039-a75d-8159fd42914e", "comment": "Malware payload (Amadey)", "value": "74c335de751b9f4eebdeebacebc952aa3756bb6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356958, "uuid": "257d930a-a6a5-4efe-9d2e-a72b936b400c", "comment": "Malware payload (Amadey)", "value": "3c250ab497f3cf40a6179e23acc2d1ff7f5f524eb7fc96132b28efe981a97027cb2fc3f29f6973591b7fb9f4fa82be23", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356958, "uuid": "9a0cc4d6-93f2-4d33-9bff-3be0a85c5866", "value": "T146840253ABE88533D9F5137028F703830A397CA05D7497AB27C6A95A0CB37E4657272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356958, "uuid": "70db5204-57a9-4021-a51a-394750c6c99b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356958, "uuid": "afd3fb60-688b-4425-9f5f-e1a3ea5f8d8f", "value": "6144:KSy+bnr+2p0yN90QEe3pa6LaFD4lLwwBr+t+A0sXUBC8VzdQ/481/wb:+Mr+y90cZyylkwd8+vsH89ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356958, "uuid": "9670186d-7f71-4fc2-a2c4-3b797e2a894d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356958, "uuid": "005b2aaf-63ce-487b-8e98-ff274174e2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356958, "uuid": "548b915a-a658-4c62-9d0d-c64f426f3b29", "value": "fa1e6494c945de20845430bd12159490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6872e16-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356056, "uuid": "38c4213b-9340-42fd-936a-f84dddbd6048", "comment": "Malware payload (RedLineStealer)", "value": "605f17a9f760261777eebfe349d26575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356056, "uuid": "bb9915e7-cc20-4323-93af-56ee6c251dc1", "comment": "Malware payload (RedLineStealer)", "value": "3b58183e940c1a48ee60a4542c9941da4fb607164a2daef03d0157db0cb5faef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356056, "uuid": "d186a483-a052-4faa-91df-fa99a2ce72bb", "comment": "Malware payload (RedLineStealer)", "value": "93ac024171ed0842bfbaa96713158fc25b58d4d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356056, "uuid": "aff1a8ee-0854-4a65-8f59-f28707f27c17", "comment": "Malware payload (RedLineStealer)", "value": "393af21e7366e27c37f274f42f6fda0efb6618c4fd979f4d44ee9d4a062011f2860c9b84b4f2698ec3e4bbc9b9eb073f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356056, "uuid": "ed31e0ca-8ae0-4a14-b23e-4947d3e730d2", "value": "T161840112A7E88432E9B9277068F303931B3ABCD15C38435F2695AD5E0C726D4E875B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356056, "uuid": "e587d35a-b436-432f-9fef-555f43996d22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356056, "uuid": "3c842a9a-ee73-400c-bdfa-422164bda869", "value": "6144:Khy+bnr+3p0yN90QE9I19dSkWsjZNoA+YFEsw/kkcJ28iYeNmi/2UAftOXk:PMrby90c/tBJ3rpVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356056, "uuid": "365cc896-03f4-498e-8d3a-01cbf175ed11", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356056, "uuid": "c4843136-b513-4e80-8ea3-11bf0e589491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356056, "uuid": "c779f094-82c0-4432-86a7-d26877bf457c", "value": "605f17a9f760261777eebfe349d26575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6d8a08-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690379982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379982, "uuid": "167f54bf-32a2-4871-a009-3a5b2620942b", "comment": "Malware payload (RedLineStealer)", "value": "eeed819879e60a78356884c79cc1176d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379982, "uuid": "c8db39f9-55cd-48c7-86bf-8e015f3e4342", "comment": "Malware payload (RedLineStealer)", "value": "3c35dfb6ea626f1c886ef4aa2783e8564f7331e639f222d5e208b3a6840a2bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379982, "uuid": "a0af2338-2175-4901-862c-2bf5fc8d7df8", "comment": "Malware payload (RedLineStealer)", "value": "73182a6228fb1978bb85b750939e58083733dae4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379982, "uuid": "46c44cbe-cbd8-4155-876e-279c86c07acb", "comment": "Malware payload (RedLineStealer)", "value": "156321d0971c0e99af72b14c8ccb684244a53ecbe159dbac8f72a304e63a842d4c380a5d19032f72ff316e4a696284eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379982, "uuid": "b7dd275b-f53e-4d10-9ada-428cfc5f48ae", "value": "T129B41202A3D89473E8B22B7018FB07931F353DA64D78876B3759664B2C72AC4A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379982, "uuid": "2e14572d-21a7-46eb-b898-3c7d573f3c21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379982, "uuid": "61147991-0182-44c0-8380-d952f6939569", "value": "12288:gMrDy90VStL+T5sUZjdKCjNhbdg9f23ulFmoU61Z/d0Z/+mxQz:zyAcIHH5r4rmj4W+m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379982, "uuid": "07a70328-c3f5-4b33-ab43-9f9126cb8dd3", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379982, "uuid": "6220da5d-9dd3-407f-bf1a-537aa9c37007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379982, "uuid": "c02a68d2-45d2-4c52-ac36-17d3d0eb69a5", "value": "eeed819879e60a78356884c79cc1176d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05be62b-2b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690354220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354220, "uuid": "aea59282-5770-46f7-897b-a51fa229c274", "comment": "Malware payload (RedLineStealer)", "value": "8ece2fb0ffc5b0013d527c430ff09b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354220, "uuid": "e35d5959-997d-48f7-83c1-c777d7bf6fc6", "comment": "Malware payload (RedLineStealer)", "value": "3d76e0091ba2f98a4ca6d693970596a9df860570b9f30e3d1dc7e9628deaaca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354220, "uuid": "e4394bac-4aee-4b06-947a-7e34b71ed0ad", "comment": "Malware payload (RedLineStealer)", "value": "e8f57079fc2c3c02e6968599fa733bf5946fc4fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354220, "uuid": "08048b2a-9ea3-4cb8-b49e-e98bb9b13245", "comment": "Malware payload (RedLineStealer)", "value": "c8461ab5d1650dafb7e5623db3717c6ebaac75dc54bcb6f941858b537644962f1151e782ef41e3d9632a89df15f3f19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354220, "uuid": "2c42c884-a7a1-4a8f-836c-58f401f94284", "value": "T168840253E7E88422D9B55BB46CF603830F3A7C61A874839B33C5E95B1CB2650A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354220, "uuid": "187b7540-e6e2-430b-ac27-75fa133284bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354220, "uuid": "5c89df05-0fe6-4ea1-9429-c03c2bf44034", "value": "6144:KWy+bnr+ip0yN90QEy06Pp+wTImNd5xbN2IA3i9pmlJZtOqxa:+Mr2y90UNYEtu3iCZtOKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690354220, "uuid": "7b7311fe-6742-4437-bb77-9f4aae21db06", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690354220, "uuid": "b5ee46a6-86af-4e8a-9a38-4947efa80c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354220, "uuid": "bfebd51c-37fd-49cb-96bf-8c110ff9d2d9", "value": "8ece2fb0ffc5b0013d527c430ff09b7d.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d0b846-2b90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690360914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360914, "uuid": "cb8f4b22-5c23-49fb-a7a9-ce8c7dce84a9", "comment": "Malware payload (ArkeiStealer)", "value": "7708ef5aaa92e908faff46afc6e721e8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360914, "uuid": "1fb9bc80-d089-4a18-b1ae-649f5ce3e33c", "comment": "Malware payload (ArkeiStealer)", "value": "3d8ba0b67540f7fa84e3f248ce8a978a2dc7b5000788be1069109717351adf34", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360914, "uuid": "26210d50-ed32-4205-ad90-41e4cdf2d16d", "comment": "Malware payload (ArkeiStealer)", "value": "62b660647566fdcda804020084b2c89abc28f2c2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360914, "uuid": "92dfa8a0-026c-499e-8a25-3fa7570ab4ca", "comment": "Malware payload (ArkeiStealer)", "value": "aff93966966814f9b324a82894662219b78e0fc17dea263abefc9f614ceaf62276d806b1de20ba89b73abf5e4106bf26", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360914, "uuid": "5594e216-796f-42e9-adbf-599b8eab362f", "value": "T17BB53386355B82BFC03D093A783E8199BFE132521D21EDD07ABE675908B350FD76B252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360914, "uuid": "a67d7e8e-3038-4834-8ba7-4817d79526a1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360914, "uuid": "baa038fb-f582-4447-83d3-d5a7a579764b", "value": "49152:zrxlZC/OSVFFd0LDqR2RQWSE+4QJrDrp7yLzLp0VBlLqtOzagm4rIosqf:vmOSVFvi3RQWPVQPrE3lEmgm4rPsqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360914, "uuid": "27b45ba9-662c-4189-830d-a0b89ffb4928", "value": 2393896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360914, "uuid": "391f90e0-d9d4-476c-89f0-9e40f4f1f363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360914, "uuid": "7379c62d-8663-450f-aa9d-9599d6ebf61e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baef09f9-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408355, "uuid": "4eff618e-f8b1-4cda-9eb0-c5fbf8465a2d", "comment": "Malware payload (RedLineStealer)", "value": "e2064ef606045addaefddb9902b3c008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408355, "uuid": "8f2d19b4-39bb-4bdc-b303-a2ec06e21b8b", "comment": "Malware payload (RedLineStealer)", "value": "3daa2955c332201ea03d8f419ba8fd8283c12fe59b83ee3765b7e87eb2bcbf70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408355, "uuid": "e89cdbf5-92e9-4ca6-bad2-6032e814fb28", "comment": "Malware payload (RedLineStealer)", "value": "52db8af1f692efbed0761f7519c747dc23f82cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408355, "uuid": "8bb73c4a-4494-4d1c-8bef-f9baf77dc539", "comment": "Malware payload (RedLineStealer)", "value": "876f8c6ec8d0d431b6588574a841c57119820652e134c73b50bb7e94de9f686226f3d3f22bfe8c491c03f5e992fbb9d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408355, "uuid": "e6ff5648-c13a-4928-85df-ad79ecd5f958", "value": "T1D8840152A7D84173D8B91B7068FA07C30E37BDA05D38835B375598AA0CB36C1A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408355, "uuid": "3a449eab-5e6f-4149-ab77-cf1a9733a741", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408355, "uuid": "98b3c93e-0e77-4489-9aa0-4ca7e11d8851", "value": "6144:Kky+bnr+9p0yN90QECZ6ozg3dNyVYR8tLmCPK8e6agJA0cWhAiIiiyRfUo:QMrFy90cmdqPK8e6iF0LziGfUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408355, "uuid": "82c53bdf-2da7-49c9-a79b-2f08261ec87d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408355, "uuid": "12abe8a7-94af-4cdd-b660-b953bf45c098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408355, "uuid": "56396636-5b69-41fe-9561-e967c03f85b5", "value": "3daa2955c332201ea03d8f419ba8fd8283c12fe59b83e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a31d64a-2b4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690331313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331313, "uuid": "d0ee1a99-6aba-4826-a6a9-74ea97265ff9", "comment": "Malware payload (Loki)", "value": "4c393a4ddc1b9e6307bc172e071d88b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331313, "uuid": "d1727237-957d-4585-aa99-2f65bfcbd25a", "comment": "Malware payload (Loki)", "value": "3dbe655f05f4fb7b25e71f2630e3adce029b0fa2a5eda55a879227fab9e5d74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331313, "uuid": "a2c1b4e6-c8cb-4f4d-a59a-92cc1915291c", "comment": "Malware payload (Loki)", "value": "77db64b2d95a50055df5015b4fb487c071ebd7e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331313, "uuid": "c3f4a486-d4a2-4a81-a00c-f032e636d5ca", "comment": "Malware payload (Loki)", "value": "de62d12c92ecff3208536364ae463ff20db4b09188a650195ae773a1f363ff6476098c93c56e52e47929d23b88aa00dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331313, "uuid": "19710b1e-8cdf-44f4-b657-4e3a22c57a80", "value": "T10344BF22B690C072D06765314930C5A25F6ABCA3EB2486CB33983F3E5E717C16B79797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331313, "uuid": "df451749-10bd-493c-a200-67883c9ba9a4", "value": "5ea05395629dd7cfa2fe7ed080de0303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331313, "uuid": "2af447dc-5a0d-4638-8530-f573bea94e7b", "value": "3072:0UVo9wmeFRg2TBbdPlWKtnS6PeA59oF8RtetM3v:YOZ3g2dbplWISuBZRtWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690331313, "uuid": "97ed68af-2668-4075-9542-2d1f98820605", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690331313, "uuid": "92f62f3b-6270-4513-9dcf-0dd6758e0132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331313, "uuid": "34cb21f9-9eb3-481e-b7ce-5749abbc21f1", "value": "SecuriteInfo.com.Win32.PWSX-gen.32052.3640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceb8976-2bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690379689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379689, "uuid": "5998176b-f259-4260-ad9d-f16fa614aa48", "comment": "Malware payload (Mirai)", "value": "702ba22b32549f5bc5e51e6fdfb60cb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379689, "uuid": "07256d40-f9c6-4ea1-ac11-9806d9f96d3c", "comment": "Malware payload (Mirai)", "value": "3e830bc8dff2e4090b77ea6ceb95f90832af2fab401b427e5dc2b6d32d0af187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379689, "uuid": "2146ce49-2251-4540-81b7-2433086bb39b", "comment": "Malware payload (Mirai)", "value": "f972fcf59bcf516df3ffffb71eda3b8d6dbbde32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379689, "uuid": "d3c1f2b2-bb38-43cc-9c91-e00eaeac189c", "comment": "Malware payload (Mirai)", "value": "67618f44e21382ed4757eb3fa90bc83468875a3773dc9c29a1e0d4a413d1ded46588600c934a96733e3262662c1cc3c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379689, "uuid": "c95631de-4c62-4c70-b501-69d4072f4a73", "value": "T10A633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719446543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379689, "uuid": "2cc64c95-b70c-4466-a2b8-ad111a20456f", "value": "1536:lGRaTYmol/hGIAs4PNvAYQ2Gm75123tSt7l:lya7hJlGmVDdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379689, "uuid": "87fe32b8-9379-447c-8b11-8243a1ec53b8", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379689, "uuid": "ae0c0175-09b3-43c7-81f6-76a487ec37fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379689, "uuid": "5a91f950-24d2-4cad-9924-2134b826c983", "value": "702ba22b32549f5bc5e51e6fdfb60cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cdcdc6-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356345, "uuid": "2c5bf5c2-6535-4103-ac35-703ef1a9f909", "comment": "Malware payload (Amadey)", "value": "8035640b6b863bc71bf72be458c5980b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356345, "uuid": "caa3bc8f-6216-4942-8c13-310d475a0fcb", "comment": "Malware payload (Amadey)", "value": "3e8a573dfdf797555b13733e106df79c711e917c766962451b8513dfbaf04584", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356345, "uuid": "47a4ae84-dc91-45eb-ab6d-4689aa78493d", "comment": "Malware payload (Amadey)", "value": "1524996d398d3a37febc3ee2380c42fd1bec5273", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356345, "uuid": "ace6a0f3-398d-45a8-bb14-67f806c7fa99", "comment": "Malware payload (Amadey)", "value": "3223ea22eed9b43489091cf9bab79efa85fef8f09ce9cfdf1f15437f8c135dbd219165975288d61629253c090b4e6758", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356345, "uuid": "0488a56c-7d7e-4970-bc3a-922fc4f2bf04", "value": "T128840242E7E44072D9B92BB058FB07D31B3AFDA1987C43AF2356991E0CB2690A535737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356345, "uuid": "15ac797f-983e-47bf-ae81-def150c9f949", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356345, "uuid": "91a025b8-9a9f-4803-ab1f-587129954be4", "value": "6144:Kdy+bnr+6p0yN90QEdsC8rMRcTsY2tmTs0NW7dj44d+moCDFJgq:3MrGy90fpRzmTso0/jPgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356345, "uuid": "cedb5c9b-6e08-4c70-a14e-5dc760a59ab2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356345, "uuid": "dad3fe86-8643-4243-a335-b1894bb3e55c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356345, "uuid": "43385a97-c3dd-40e3-bb55-495612f33b4d", "value": "8035640b6b863bc71bf72be458c5980b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c0c207-2b8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690359739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359739, "uuid": "13aec415-d3e8-4725-81dc-4f3ed289964d", "comment": "Malware payload (RemcosRAT)", "value": "cca558a61d6125ecd91f1f5b9b3070a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359739, "uuid": "749ff1f6-2c2b-4cdf-9c35-b3fad3db01c6", "comment": "Malware payload (RemcosRAT)", "value": "3f0f7847996e9d8ef9f875c1c20dafd17ecb2a3eee860b2d08ac5eabab631b4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359739, "uuid": "68c7cf74-ec15-4105-88ce-f9deb2591828", "comment": "Malware payload (RemcosRAT)", "value": "29cc54d6138947c99cb8d91f3534efcf80ada2d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359739, "uuid": "bb1df573-75a7-4521-8e8f-ba20c4e4e99f", "comment": "Malware payload (RemcosRAT)", "value": "46e09294870dd50f1cde5d1692a240f1aacc99a7cb63734198aab540b227cd4a8513db6a1689521a56f31bb66f3192f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359739, "uuid": "f3ca5ef2-1210-483d-8e7b-3a341a259bca", "value": "T145A3E708A3CA5E23CA94663885E3D3306375EDB91703D31769C87E2B3DB7BD92902B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359739, "uuid": "5805fc41-743c-4cea-b9f9-34893207f884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359739, "uuid": "d10b4776-043a-44fa-84ab-3c0757ac27b3", "value": "768:VO/J2ZWAJYp40oxU5apArUinBKj+Qkw4ll3n+eUTxsxK:e2MAJTJO5aarbn8j1J4fn+eUFMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690359739, "uuid": "edfc5cd9-68c5-4ca0-abd6-8e46dec01a56", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690359739, "uuid": "dd31e1a4-e69c-4849-9e23-6b264959bd09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359739, "uuid": "9370835b-1f77-45e1-8f76-61576a0a2a38", "value": "cca558a61d6125ecd91f1f5b9b3070a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7780f357-2bb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690375600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375600, "uuid": "6d078626-f675-4a2f-9953-26e33ed156f8", "comment": "Malware payload (RedLineStealer)", "value": "6f0ddec47716aef2871af4e949a3d6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375600, "uuid": "4d81c07e-7f4a-434f-8bb1-88c1d4c905d6", "comment": "Malware payload (RedLineStealer)", "value": "4016bd6586377b4873e6ee07c8ca0d72616332c3c1c7b82effcb5ba9d5a9f388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375600, "uuid": "673613ce-2e9f-41bb-b71b-81df3f15e56d", "comment": "Malware payload (RedLineStealer)", "value": "ca0094c0248c0e928a3e2f6ad1840ae89881a950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375600, "uuid": "de6ba3eb-42df-48ba-9ac0-0ec70e4c7d8a", "comment": "Malware payload (RedLineStealer)", "value": "87b3ae8cc78d024ccbc7b33faf3e1e9b0352a1a2d43788fa20a968a58e6f6c9b24924a2f413ab8c32d2c173b82965811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375600, "uuid": "8c5bf877-3166-473c-a544-c8cac58e7168", "value": "T1A0840203F6E95432EDB11B701CFB13D30B3ABCA25E7482672681A45E5CB2A94A53573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375600, "uuid": "9d27fe06-13b3-4734-98b6-6cf940fb41a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375600, "uuid": "2984504c-58b6-4e0d-89ea-56f6e4a85c30", "value": "6144:KLy+bnr+Rp0yN90QEN/mkR7fN6KTq61fKf2b/YdQT7LAMzvcwCy4yA9eZLvN8nH5:pMrRy90fTqofKf2C3Xy4yWeZjU/oRp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375600, "uuid": "9cabd923-636f-4c92-8af8-9d59db63fdee", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375600, "uuid": "7514d68f-3cf4-4a53-b09d-f650fcf14939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375600, "uuid": "dcca78eb-3574-4d6f-95dc-9b292fd07f7a", "value": "6f0ddec47716aef2871af4e949a3d6c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81ca630-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350798, "uuid": "2c79b21b-c24a-4adc-94f1-3f6c1a3d4abd", "comment": "Malware payload (AgentTesla)", "value": "427f8c885ff5548c04a5fc718b8aedd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350798, "uuid": "21317204-c507-4b99-ab91-4f6f386496ec", "comment": "Malware payload (AgentTesla)", "value": "4145d8714ef652593f921ff335aa51b47462389a331e42896b45851007ca00d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350798, "uuid": "41621af9-f4c2-4c45-8c29-bd9fb4aee4ae", "comment": "Malware payload (AgentTesla)", "value": "ef82bb319baba3e9f83805c2c87b5112b03fa429", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350798, "uuid": "22f1e55d-b36a-414e-b91e-e9c73df44d48", "comment": "Malware payload (AgentTesla)", "value": "0755bab27ce6469807400ab074b83944a82f44878b552f53fb39505b7bda3adc5eff050f145a5b48b7d43b5ea70e9fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350798, "uuid": "cb654a80-c592-4461-bc32-9e2cf3778658", "value": "T16EC4122933D8CB1BC9BE9BBF05304A5007F1AA7BA622F7086F8C51E80D357272595767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350798, "uuid": "176c996a-b50b-416d-a23e-42b89eeddc8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350798, "uuid": "b2f15e59-b277-4105-a507-951d373d8134", "value": "12288:zXPZgb3+UydwuS+hYBQ56qH81s12dhhq:O7qx1WBuN8S1Whh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350798, "uuid": "004666b7-aabf-4d59-b206-cc48fe3f705e", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350798, "uuid": "9c9586ab-684b-462b-9749-38b0553c57f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350798, "uuid": "a7e618bd-0bfe-48ee-8675-0211788290b0", "value": "New Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e91158-2bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690384023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384023, "uuid": "f0817cde-87b0-43b3-a3b1-d2d74d2549a9", "comment": "Malware payload (RedLineStealer)", "value": "d2d022d67e4b3ebd1d531ac92440e670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384023, "uuid": "a1da842c-9a0a-40f7-9d92-fe42ce1d944e", "comment": "Malware payload (RedLineStealer)", "value": "415f7bd570e760fb5d4b33e87e802d831b30f8659175cbe90d0429206d6be715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384023, "uuid": "91ec2802-8da4-4378-a9a4-049c1fa24bcf", "comment": "Malware payload (RedLineStealer)", "value": "068a5de7d92881dc72bf22c18a8e21411482c733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384023, "uuid": "1f5cc0a7-170e-4cd6-9d40-e324853a625f", "comment": "Malware payload (RedLineStealer)", "value": "28ca83c95755cf08c89460ce12d2b4597b2297352e1cf7a98ad649c3470492fbdc78d68a722790cc790cb51d7f9065f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384023, "uuid": "67fc8993-bb15-42f1-bc22-17ecfcd9f3b2", "value": "T194840256A7DC8073D8F117B018F502930E367CB2AEB8836F2745A95E1CB36D4A07677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384023, "uuid": "a1a27e8a-622a-4a9e-9710-f5b212431579", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384023, "uuid": "cc5ddb69-e501-4e51-adc3-8e9882f0df44", "value": "12288:wMrvy90N/mVhoSYtReigBYCb4+/f5W3l3r:PyyIgtEzs+/M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384023, "uuid": "f1cc29b0-3f15-4944-b731-660db27bbf55", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384023, "uuid": "8c9e1bd3-d994-4d74-8857-41aaf079a893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384023, "uuid": "14c88556-ca54-4e4e-a26b-9f9427913a12", "value": "d2d022d67e4b3ebd1d531ac92440e670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bcff9f-2b5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690338471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338471, "uuid": "c7a5e2c3-e5a8-4c53-b058-2f7f7bb58d01", "comment": "Malware payload", "value": "4804d6ffce0d37864ab01b3e10f63bf9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338471, "uuid": "e73ddffa-48a8-41a5-a334-c67e3ce0a7f7", "comment": "Malware payload", "value": "41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338471, "uuid": "4184f252-f504-4d17-a2b3-8beeeb0724b9", "comment": "Malware payload", "value": "a840c66ccd1761f431e95b40e8dc4daf2551afcc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690338471, "uuid": "adf7f1de-6eb5-4078-946c-7717f2698856", "comment": "Malware payload", "value": "bf26003bf3dc250e5f11576bc76085d728a4ec99485efd5476871bbc18df56da7b69217555812e6ccc8ec2e5bfffc490", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338471, "uuid": "9dff4d25-752c-45af-98dd-92c640445cf2", "value": "T145628D728F438479CEEE2EB849E70D6F5915A514220D11B08F2A0F9DACA6B97FB431C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338471, "uuid": "98ded029-191a-4703-9a9a-d636096ffdac", "value": "6b2143eb6bf3b6b18e23ff7de66e6891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338471, "uuid": "fec3fda3-5f74-4edc-98e2-9be12f24b975", "value": "192:0wsvVONtmUuAX1+ixmlhHppMIP3RmUPM4Llrh5eb4QIxoV+3EbSixBngUB:05syElLIhdP3RmUBNib4QI6xBgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690338471, "uuid": "cbcb94c4-b55c-4011-8530-2f325682a128", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690338471, "uuid": "9065c113-5e66-48d8-9eb6-7f3ab01e525d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690338471, "uuid": "d19393f2-14c8-49ce-9fea-5e44e07db468", "value": "SecuriteInfo.com.Win32.TrojanX-gen.196.15950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fadfec2-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690375936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375936, "uuid": "d2f8473d-7d46-4077-b0c3-f66b43369710", "comment": "Malware payload (AgentTesla)", "value": "7c6889973a8d2dafa2bf586936ab0aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375936, "uuid": "613163ca-bf2d-4452-99af-259469b16cba", "comment": "Malware payload (AgentTesla)", "value": "4203d4bec77286094dae9822544155fa2f46f5fc12bc7766b8691ca2c3a219b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375936, "uuid": "ba4c78f6-236a-4372-999c-e90c074b7522", "comment": "Malware payload (AgentTesla)", "value": "ed4823c982bf04ec337131bac12133bbc80dc2a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375936, "uuid": "2bac7dc5-0e21-425a-b1e0-56489fadc2ce", "comment": "Malware payload (AgentTesla)", "value": "e625bc8c22c2c227d2784a1800d8cf619ac94d09956a1e57866792574b99bb1c31ee9d91b43a0208a389cb11b2073275", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375936, "uuid": "7b0690a8-7c40-4641-b807-98530ad5ae39", "value": "T1A0622C006FA88233D6FA277B6CF253400372E1CA6860DF5E2DCC42AF6DA379499517B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375936, "uuid": "f58dad9b-0b15-4b40-9ff9-ea73d1d73060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375936, "uuid": "c7add43c-5ab0-4773-a58b-e81f99a31371", "value": "192:Va7CwLw7zu/sRffbEyHxjkBiBv19Blci7QYmlan4djlqv3OkNLD3Egrlupc:87CwchRffvOBiV19j3Eda4oVNLQgrlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375936, "uuid": "84c87d08-e3af-4fae-93fb-81e12ef3c56a", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375936, "uuid": "8f6fc3b0-185b-451b-930e-e8aae069c827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375936, "uuid": "5d50d83a-8737-4467-857f-22feb7a4c900", "value": "z7EXTRACTOBANCARIO_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b280c64-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407738, "uuid": "e32eec7a-0021-45c6-b123-d43cf6c80418", "comment": "Malware payload (RedLineStealer)", "value": "2d00f96e74fa01be6c570782f56ca124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407738, "uuid": "29aa8cc1-7135-45c7-8d04-02c6f6645e16", "comment": "Malware payload (RedLineStealer)", "value": "4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407738, "uuid": "4eba847d-67ce-4302-97c2-02326e0645dd", "comment": "Malware payload (RedLineStealer)", "value": "17ed1713ade7f79ea2ed1bb9130871ca56b0c072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407738, "uuid": "174ebf5f-3644-47dd-87db-4e3b45ae5514", "comment": "Malware payload (RedLineStealer)", "value": "43df4b095398791682acca129ee3906660f741f4dbce57b28f65386099260daabac5bd468c7bbb6115c651d2985d41b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407738, "uuid": "340d77e1-a9a8-4c94-b594-7057bbfdc4ed", "value": "T19E840117EAE84073D9B167B068F703830B367CA19978436B3786695F4CB2694E93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407738, "uuid": "b081f0bf-f587-46cb-9a46-5c6cd4c628dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407738, "uuid": "fbf9f00a-cc02-4c20-ac5d-899665f8458c", "value": "6144:KWy+bnr+rp0yN90QE0PZI9HwPGTICcWt4JZe6vzwYFeXx3Rhye2coLju:SMrvy90iXVztj1MNSeB+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407738, "uuid": "52eaa867-0f35-4e1a-9a55-49384864bcd7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407738, "uuid": "2eab6249-4077-42fc-826f-36455c5bd877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407738, "uuid": "903644af-9c8b-47be-a489-d29be9ca352f", "value": "2d00f96e74fa01be6c570782f56ca124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6749a318-2b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690357963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357963, "uuid": "a5b241b5-5d5a-484e-a8df-eeb52ecd726d", "comment": "Malware payload (AgentTesla)", "value": "ced3b387b2109a87e04c1a5ee328042e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357963, "uuid": "9092bf2a-8b2f-4510-8543-6fdbeb17ad96", "comment": "Malware payload (AgentTesla)", "value": "4289df5aa7ae89e51a8f122669cf26566d3e0a3b007500a1d73901d7cf1d85bc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357963, "uuid": "995fd783-8610-4a67-87b8-73016d4abc14", "comment": "Malware payload (AgentTesla)", "value": "ee62220b8cf68c99292658f48e7c0f4757790bf7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357963, "uuid": "2129b2e9-11c8-4aa3-8eb4-09498ee7dfb4", "comment": "Malware payload (AgentTesla)", "value": "97987113bb335a9cba7254779b389169bb2d3ef8d72762b2c6708ead0c76d3425e0c381aaea23f017038c2faf252c2d7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357963, "uuid": "f28b1741-88a7-4176-ac90-5828ec3fc02c", "value": "T117D4335C9F7B9EB2DDC366E15F2A71C203E9EC923582925A53508D01BC9B88D4CD87F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357963, "uuid": "1c202dc1-72b0-463d-bf6d-8baad6a28281", "value": "12288:mN5QdQ8I5L7gh70n0myhqpZ9eEWNKgpIBd/JiSWHntxyIXiG5:mN5QdxgXgp0nvZ9RWEDiSWNxyIyG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357963, "uuid": "cdfc3b96-89bb-4233-9c9f-b94163ae785a", "value": 645990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357963, "uuid": "5d5c18ab-6c9d-464b-9848-4e29787af209", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357963, "uuid": "b9cb89db-b00c-4157-ac8f-d6e6edc6d2c0", "value": "shipping documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e041793-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690365115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365115, "uuid": "6f94969a-03a3-48df-9300-ec23b7fed46a", "comment": "Malware payload (SnakeKeylogger)", "value": "42d97ceb93b1240aaccc61c96ec9dc1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365115, "uuid": "050b9e3b-be60-45bf-a6dc-e8e3a7d2113b", "comment": "Malware payload (SnakeKeylogger)", "value": "42bd29cc174a356112e1aa6b8570da8a4cd775e0a409c767b6a57bcdffed8ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365115, "uuid": "271b8234-e078-4394-bacc-0d88f463edbc", "comment": "Malware payload (SnakeKeylogger)", "value": "0c11a9e59e7f410ec943e93d298a2d57187c85a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365115, "uuid": "e9de9d02-1769-4526-9832-d08f3d82c75b", "comment": "Malware payload (SnakeKeylogger)", "value": "9a0c91a80b4f80c1ef8fa54e76a88aacddeac70cd29d74b052fcd1a82355f6f45548b9107bc27f81e2471d7201da4288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365115, "uuid": "e19de48d-2f0f-4a4c-bf52-c1b62c2b5135", "value": "T140723C10BFA88233D5FB277598F353410332A8D66860DF5E9DCC528E7DE2B459E81B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365115, "uuid": "ee981271-2e69-4318-9e51-d5299e6310e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365115, "uuid": "47dc8f9c-d761-4298-8e64-0d84efeca5e1", "value": "384:OLFcdRff0eWiV19jkTdaQokURs7OPlvX:OLWuda1kkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365115, "uuid": "46f36c0e-73ba-4123-b4bf-f2d475ee26e3", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365115, "uuid": "b95186e7-64fd-4501-9d88-eca417586bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365115, "uuid": "07b01d23-676a-454d-92ab-d6f6c453b6a1", "value": "Aqnib.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b970df-2ba4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690369577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369577, "uuid": "1d84efdb-e727-41ed-91b8-74bda3420eef", "comment": "Malware payload (Amadey)", "value": "33e3fc4709fde1e78a4d43cf4315b6e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369577, "uuid": "50c54d66-f896-48cc-9306-ccbec16ea7da", "comment": "Malware payload (Amadey)", "value": "4312b77e6031b30312b6c5c30180fca1895d4c065914103fa2e4ca9e8da9a0ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369577, "uuid": "bc5f1213-5c08-49ea-8fcf-b87fd5adee55", "comment": "Malware payload (Amadey)", "value": "8df55f1252561a441d7069e4b09c8d5e429151e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369577, "uuid": "07fd7f36-efbd-486f-8652-be9f41591938", "comment": "Malware payload (Amadey)", "value": "452ce1561dd31ae37ddcc4864037d0a0704e071b8fa4f9ad7b086eae6961df37f6c9c6c71667c800bf406568993d1d73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369577, "uuid": "5ea40599-7627-4cec-a4f1-914138dd0435", "value": "T16E8402136AD88032DDB517B068F607830636BDA18D38C36B3651E9AF1DB36D5A53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369577, "uuid": "36dabd9d-aa1c-47ff-a628-344dc20b0e1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369577, "uuid": "622d3c81-7d90-44d8-abba-6839134754bf", "value": "12288:6Mr7y90Ha9/KXa3xvoQrOhOKgBYCmjWwojO:Jy7XvodhO5z9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369577, "uuid": "e9f5a12a-9de3-4d43-83cd-fec6ea95e51d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369577, "uuid": "8d8afe89-2f96-4d81-a646-67d2e7c0d9f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369577, "uuid": "a2dab71f-6763-4eec-983b-91d7839ac34a", "value": "4312b77e6031b30312b6c5c30180fca1895d4c0659141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2f8eaa-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385189, "uuid": "f559d0cc-78c9-4bed-a519-e9d1b783ccf5", "comment": "Malware payload", "value": "665833e8b48802684c9d2ae69d97f0e2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385189, "uuid": "3b787ba8-d5b6-42db-b931-3f79b9034657", "comment": "Malware payload", "value": "43bf837aaf58f51a345ca673154b2fa7a77e5b01de8cf73b80428ce2a20e9ac4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385189, "uuid": "d1a7c175-7f6c-412c-beca-8d32cfecd910", "comment": "Malware payload", "value": "8e49afded8c0e560f7a7a365436f5fab208af592", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385189, "uuid": "4b6be5f8-f654-4779-982c-7597b5b0cb39", "comment": "Malware payload", "value": "07e12b980831257bc7dae7f25c0c7bd600980f7a5fa95e0d80d5e06811aba5b99ed043d4f4a0a987f822d9b6dd19ff52", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385189, "uuid": "d8bae850-4944-4e7f-b7b9-97303bba6b88", "value": "T155D3CE2054DFA49DB2B63F530B9FBDE55F5BFBE1562A51AE2004030B8B96D40CE98B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385189, "uuid": "fe4880f3-4375-41e0-be1c-01463028cf99", "value": "3072:B30UAW/JIFIhgI0uVupuruOu1tuXu4uOuDE1FV/IPVKVXpVcVdVGVNVGV3Vkc:B30UAswbEFIiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385189, "uuid": "e441a99b-873e-49b1-9d18-727d9f6d0aab", "value": 135984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385189, "uuid": "7d279d05-b521-4529-8e4d-a4156af57420", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385189, "uuid": "4e123594-385d-4d35-90f4-75615e8289e6", "value": "pago de la factura 11-369013.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936d34d9-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690377794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377794, "uuid": "86431001-d6bc-4154-a292-6f8a36f154ea", "comment": "Malware payload (AgentTesla)", "value": "cacde1bd1418802e8732213ddd3a2e82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377794, "uuid": "f841e425-2387-4fc3-a173-af9fa727a122", "comment": "Malware payload (AgentTesla)", "value": "43ff819c3d22e9a0b3e1a35411c5f98d06e17ed32896bf9563600d30b928e5aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377794, "uuid": "52aaef77-a943-451d-996c-adadac8d7bee", "comment": "Malware payload (AgentTesla)", "value": "627617fb15b0f5c6214df7edb5c145a4723abf92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377794, "uuid": "e997b623-9e2e-49e8-9490-916e00949497", "comment": "Malware payload (AgentTesla)", "value": "8c3b91cddefc7e03d2a713bfde265d0983001297ab018fd7751e3234c21690db93af9bce80b2a6d8f69428e5aca3dfb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377794, "uuid": "58926e7f-c2ec-406b-92c0-6306b10f3e34", "value": "T16105C34B71DE4177FF551EA01C2A4A288FFDB01D610EB50B7C25CE8A1E7DA4CC1AA786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377794, "uuid": "593e146c-a74a-466f-9f26-0de06927ec79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377794, "uuid": "74c4556a-33a1-4703-ac45-a425b0e7d8ce", "value": "12288:EyvrarYtzfO/9+rsXorytXbG7wsekelZQ:Vrarr/9+aoyXMnteL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377794, "uuid": "3e4d5bad-3439-4be5-8a41-8400c1488e77", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377794, "uuid": "a58e15c0-e492-4500-abf5-ad94d5d1f8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377794, "uuid": "4ace0b2d-b6a0-4314-9e89-76c82d28c568", "value": "Screenshot_20230725_195537_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5dd9a0-2b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690348629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348629, "uuid": "7ae65735-ed2f-4791-952b-740e26589517", "comment": "Malware payload (AgentTesla)", "value": "6fa87097292d2a613d24e8dd53aa7b48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348629, "uuid": "f3771fbb-14df-44fb-9e6c-f16051efb4d1", "comment": "Malware payload (AgentTesla)", "value": "44629b23544b686ea4d3956e054acbeea83904dce8ebc1e6beb8dd4d0b64032b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348629, "uuid": "68b3480a-3c73-4d51-bab1-4833f57a6a1f", "comment": "Malware payload (AgentTesla)", "value": "9a5a5c02f79dd41aaa8d1142913cf5d58744a878", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348629, "uuid": "98fdede9-ef0f-483b-b980-c2b8f5a7f66d", "comment": "Malware payload (AgentTesla)", "value": "dce47d4f96474cda9e5d823fa08030c44884ebd7ca194260eb6c1e41899b6c50d89192eadbaf3dcd80ec7b5488616564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348629, "uuid": "7794d5bf-96b6-43b7-b337-65a2d35fcc63", "value": "T1B1C4126432DC8716C13F23BD5D6082140BF2E96BAE12EB0C2FACA8D59E30B655765F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348629, "uuid": "9e7bfbb1-8027-46ab-8c00-7190242c04a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348629, "uuid": "4d80ef20-ea8c-4816-8ea6-2843aa6376f7", "value": "12288:0XPZOcGdEcH3RLNMM8RH0j4eF9LxoMNRAWkYBP11AwitAG:dvRLuRRH4LLGixTPvAjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690348629, "uuid": "83fe9750-d802-49c7-a819-a8165e7553db", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690348629, "uuid": "fe78734b-96db-4508-9e15-ef16b3469bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348629, "uuid": "b255810b-e1f8-419c-930e-21a79c69166a", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed61b16-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690385007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385007, "uuid": "e7b946ae-077e-4dbb-88e6-8bd94a06cd6a", "comment": "Malware payload (ArkeiStealer)", "value": "1e7935ddfb864069685ee427bd746ff6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385007, "uuid": "bc1e0fa8-0701-4bd7-9ebe-9aab39b428c3", "comment": "Malware payload (ArkeiStealer)", "value": "44b88cc29ae87e1f672466777bbb2327116e383257d933433af48e6f1478505f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385007, "uuid": "87ec7b91-fb6f-4204-9603-d8a8d4ee8f77", "comment": "Malware payload (ArkeiStealer)", "value": "8ef59491ba55cf2d5f107da8335974dbb478b5a3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385007, "uuid": "26925947-600d-4a13-ac9e-2e3506b35ade", "comment": "Malware payload (ArkeiStealer)", "value": "87368009b90415bf863bca991091c5291f22b89a200e86fb35f91fd5f6a7179f73a15e56fe30d26e37f5e3a425f42833", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385007, "uuid": "abae944c-ce8c-4db4-88eb-b0712dbaed2d", "value": "T12E264986A6D111A9D0378174D66D3366F93BF1DC1B288BC3AFB9844F03D6AD46AF9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385007, "uuid": "8d02974d-edb7-40e5-8dc7-e0fdbd63bbc5", "value": "fe1147df2ee30051a844565381a6e079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385007, "uuid": "1fb232e3-a015-48c0-a936-2ba7fc0bd633", "value": "49152:0PE/pCXI4ufg0HiSOUJlWmU1It9nYHQKaAfhpQMzclsV2:QtixCcUyt9YHQKaJRsV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385007, "uuid": "999b48d7-cabd-486f-9014-4edfb9606853", "value": 4439168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385007, "uuid": "2520839a-c7b7-4e1a-9d9b-c729889cdbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385007, "uuid": "9ba73ee1-b553-405f-9b19-34c75017792a", "value": "1e7935ddfb864069685ee427bd746ff6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21883ce-2ba3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690369283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369283, "uuid": "c37b010d-6656-4ea7-b6e0-a03d589247fe", "comment": "Malware payload (RedLineStealer)", "value": "3b7689667520523b286f91256afc93c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369283, "uuid": "b25ff1ae-eeac-4c27-9100-d77063fbb9e4", "comment": "Malware payload (RedLineStealer)", "value": "44c1bf09ce84980c41f9599e2070a3c08624bcbbd75eaf45c157470ed1d5679b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369283, "uuid": "dbc5c5f3-edcc-4dcc-a580-ebd15872c016", "comment": "Malware payload (RedLineStealer)", "value": "fd65de929c87eebedba3fb07ceaeac130c79d895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369283, "uuid": "a709cd45-a9f2-4cb5-b77e-6fc123241bbe", "comment": "Malware payload (RedLineStealer)", "value": "2fe613ca7b666d9edae7e1a01cc08ad1b44bdb41569b6860314675a063902abf380e85788e542a788c607291a5093ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369283, "uuid": "065ecce3-18cc-4163-9aba-15c93eb7eebe", "value": "T1D9F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369283, "uuid": "8eafe9bf-4713-4e7d-bdba-8f6c5222d96b", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369283, "uuid": "f5559d64-1bf0-440e-88a8-a2d189ada26f", "value": 34407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369283, "uuid": "f57dbfb6-a53b-44e7-9703-5c3637c0b07d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369283, "uuid": "666409db-32ab-464f-8897-c3b57d18dba3", "value": "3b7689667520523b286f91256afc93c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb143009-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690383122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383122, "uuid": "5a06eb2b-0785-468c-9d77-a1c90f33f942", "comment": "Malware payload (RedLineStealer)", "value": "a3b12999051bccd12021b96b6f86c928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383122, "uuid": "519b17de-cd66-493b-8d14-5adbe2ddf32d", "comment": "Malware payload (RedLineStealer)", "value": "45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383122, "uuid": "45caa7af-cca7-42f1-82a4-3d45e46832f5", "comment": "Malware payload (RedLineStealer)", "value": "d8fa4600a37079cabc0b61744970a0e1efaeb502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383122, "uuid": "6b60e744-3ebb-4d06-8326-c07943bc6892", "comment": "Malware payload (RedLineStealer)", "value": "53196c4c2a233c96aa00228481d45be249d2339d4fef15e6bc9a9defdd57f67bc2b4e14faf959e20bfa9cab06a35523c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383122, "uuid": "fe75aaa8-0687-4864-96e5-49e1320ddcd0", "value": "T1E9B40213FAF89432EDB5277069F603D30A363DA58978835B2784ED9A0C73990963573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383122, "uuid": "40938070-d4cf-4c4d-b49e-2197fcd9bbc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383122, "uuid": "33450896-35e3-4fc7-bda9-5609c2b73748", "value": "12288:kMrPy90Ptd6fvSMfJOjUlYm3Yw+uMNdwmD+gV3:DyTfqMfJOjQY2z+dwmD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383122, "uuid": "cdf3891b-67cc-40b6-bdb9-bb0c48686f50", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383122, "uuid": "bb50282c-305a-42c0-ae89-16e103eb6a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383122, "uuid": "e8b1d678-4411-47cc-be2a-387114e419f4", "value": "a3b12999051bccd12021b96b6f86c928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267a0c53-2b90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690360861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360861, "uuid": "e7ed88e7-fa02-4272-aa96-5c620cc5d2ae", "comment": "Malware payload (RedLineStealer)", "value": "7510cbe2b2c7b123f2ceb66d70f40930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360861, "uuid": "e6d1ee0c-1cb9-49d9-856f-343387c92166", "comment": "Malware payload (RedLineStealer)", "value": "45c87d777167f21b9126d8bfea5390a30fc44177454163228c0af4548a87bf8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360861, "uuid": "ae2e4874-5e83-4d6f-8523-7dcc2aef6acd", "comment": "Malware payload (RedLineStealer)", "value": "5145e36882accc3390a0d732a4080bb9095d327b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360861, "uuid": "e4276f8e-3f5a-4f43-8075-3fcd9dbc594c", "comment": "Malware payload (RedLineStealer)", "value": "e4a7bf2608695bdebbdd5975cb11f31341d6477776338b4a11f5a823da89d3a552c44bf37f8551c9d75c477975fac243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360861, "uuid": "365305ae-120f-43af-a146-1e1b8b43d23a", "value": "T1DF840103B6D99032E4B42BB058F6029307367DE25D7D837B2752A86B5DB36C4A43673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360861, "uuid": "c6745240-8856-427a-abe9-14a67729c97c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360861, "uuid": "63f549e4-33e2-4276-9267-1646620ec29c", "value": "6144:Kpy+bnr+vp0yN90QE8LjZuBFRHYajEZCPJENbVEp0Fi3TMUgBZ+t4oDMu9F7Muay:zMrPy90KVudECPuNbOZ4UgBYCoz/13T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360861, "uuid": "786ec7ea-6c0f-426e-b2d9-00e6908606e0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360861, "uuid": "18f7c899-e851-4abc-b403-34906c32f5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360861, "uuid": "78590b69-a9a6-4fd8-a306-4c60ee6bc150", "value": "7510cbe2b2c7b123f2ceb66d70f40930.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc32907-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385085, "uuid": "f981a78d-2828-447e-bdb0-df7a57bf31de", "comment": "Malware payload", "value": "3cc042d75731fa68a3909a293a452388", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385085, "uuid": "90cc5062-3d44-4851-96c5-d2834907a496", "comment": "Malware payload", "value": "45db1c99e23dec7edf0d3f957e2d4ff44863f263d44319eefc8e4b4422f2ebf7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385085, "uuid": "13ccdda8-e17e-4460-ba7e-90cca894de22", "comment": "Malware payload", "value": "38ee95ee7d5d340c840b2ddc090b63efcdd3a21e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385085, "uuid": "4e0063e2-5146-4eee-b7a2-f4e53c87d388", "comment": "Malware payload", "value": "54b7e57a60b43374ff99a08e8ca4dd44cc5f7cd0907bb895d2d05556f68a74f95a526f039e07b98ef37d868a6dbe27de", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385085, "uuid": "8f4c9aab-0ec6-4ade-ad0d-647e04c1f8e1", "value": "T13C75F103E8119A87C40C83F47E2329D94F1A7F06E499ACDF15123FAB3A72762895B75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385085, "uuid": "11eaeb98-bcbb-420b-80cc-ea8aede7e080", "value": "49152:f0uPR6VJEFG6VuiNhv3t5csXXnRgWW5R1:f04mJJmuMhrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385085, "uuid": "6d4046e2-9cd3-485d-a658-10ed353d843b", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385085, "uuid": "ebc0f304-e478-441d-aa9d-86d6ad28ecfe", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385085, "uuid": "3395a6d5-6a2a-40df-a2dd-26aeb1872abf", "value": "PO23007014.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec4c90f-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1690365626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365626, "uuid": "91be3980-e407-41a8-907c-5b1d711c6539", "comment": "Malware payload (WSHRAT)", "value": "c1782dd257f96535b081857cd64e2598", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365626, "uuid": "9891279b-457e-4ff0-a70a-4b1e6d9e4d42", "comment": "Malware payload (WSHRAT)", "value": "47ef53bf5833e55b94c424f1a3560baf56bb672760e89fab43a0eb226720e265", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365626, "uuid": "f055e64e-1c7c-4ecc-9e91-745cffa44e75", "comment": "Malware payload (WSHRAT)", "value": "dcfc5c3fe03e591bc9a6cfb7b008a312eedf343b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365626, "uuid": "ba59f0a5-c310-4ae1-8884-f3d5003406b5", "comment": "Malware payload (WSHRAT)", "value": "dc75ebb4364b3b417391bb545c7ee3c798105b44e2811e340d3de07387c2a8f82164cdf4f91886dd68fbb5b7e845d616", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365626, "uuid": "d519af00-428e-4736-b900-0ad55c9c5a52", "value": "T154F4DA723E07FA3D054F2C4066312E362F5DFD67C6A95185220AAF3893A758D2B7F618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365626, "uuid": "93aaca06-a540-4409-9fd4-8b06b7e96016", "value": "1536:/MRtSdp+jIiYowCm2soUPRQnrtIoA7OUzpZeVpnYCsHg6sgxstnZDQUhKKMp:8jNm2LnJIoA7OB/tsRWnZup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365626, "uuid": "4e7d6091-3040-4600-866e-a9253a67b733", "value": 765401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365626, "uuid": "30e7df9a-2982-4228-a1ec-69e30b3dfc35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365626, "uuid": "1e88fcc5-3193-496c-b2e1-3696f9690388", "value": "Purchase-Order-23726.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc18320-2bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690383474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383474, "uuid": "6a32e75f-3c9f-40a6-9c35-9ee2b1eb193d", "comment": "Malware payload (AveMariaRAT)", "value": "46f3099b2fba66786592cea54f646f88", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383474, "uuid": "b52be352-23db-4e49-8727-6ce6ba5532ae", "comment": "Malware payload (AveMariaRAT)", "value": "48e372ac62d22a5acca0020a79dfb233b120faf3d84471ff73ecfeec00395ca3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383474, "uuid": "12280b98-84be-4b9c-ac51-b4c9a1190405", "comment": "Malware payload (AveMariaRAT)", "value": "407dd26d6c8d06b91b8db00a961896ba65efcf2b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383474, "uuid": "6831a984-f053-4ba2-b6be-6e903c2620ff", "comment": "Malware payload (AveMariaRAT)", "value": "bed0fe0a2272ba9017316d9971def6f0713db37cbf66ff0620b1ca69a9a355a1cf18d3e19b1cc96731726d902ab5ea76", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383474, "uuid": "2feafaad-cd74-49e7-b8fe-c8f9d0f10c1b", "value": "T152A35B707A564122C32D4F727D6722EC0633EB29F965DA091D9136CD3A62F13DA827E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383474, "uuid": "222aaf45-3991-49d9-8db6-8131e652a1f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383474, "uuid": "cc5a550c-7006-4072-9dad-595303610425", "value": "3072:P5rfS0p5PLtUs2bePrTj/bUzI8Sil12fAtvlgKxW:PXb6tvlgiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383474, "uuid": "165a9f6b-a4b3-45f5-acd4-d36cd115397d", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383474, "uuid": "9581b722-d2d5-4cfb-98f6-a7dd96799448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383474, "uuid": "eacc2d93-9954-480f-81df-044452ec9c01", "value": "Test113.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7617ec7-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690385559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385559, "uuid": "e5f868fb-52d3-43d2-80ba-f2bfb13b0457", "comment": "Malware payload (AgentTesla)", "value": "60e23e27a3b7c25434b38bbeea3a47ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385559, "uuid": "a81d9550-c893-41e3-8f69-69a3069260a1", "comment": "Malware payload (AgentTesla)", "value": "48eef18edcc14ccc129e3e475e15bb2f16b33e8acb70e0aac29670dd0ce68161", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385559, "uuid": "8c1f466d-abe9-452d-bc8b-402e31fbf2e1", "comment": "Malware payload (AgentTesla)", "value": "e573a43a44ae7a3736f56f4dd6b1104cedd88c78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385559, "uuid": "2c9e7fb9-fd73-48a0-b364-8505b751da17", "comment": "Malware payload (AgentTesla)", "value": "68d175505ba856745a967eafb801cf361a0b6afe9b7ced193caa726c0d3a4f25ff24d0ba8b89ee4b8e620e12b5a064a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385559, "uuid": "048dfd9d-f56b-4a25-94d8-61b79426009a", "value": "T1E0C4122165B99B2AC86753F94B8688440BF3F59EB272C2042DCA61DB4B23F1057D2F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385559, "uuid": "0cbe0d70-dcc3-400a-9279-d32b052fe958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385559, "uuid": "4fc1137a-9f9f-4194-a6eb-1820e949df51", "value": "12288:Gf2iN2GULY7qpxqW5rKdBO5iyB7j5vgm+7/PfVkse8iK3ceH+7Vy4sqeeS1yCTn:Gf1xULYqjqo5Bc7/oRKMNQV1Fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385559, "uuid": "e84f894c-d994-42f5-bf80-430044d79af9", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385559, "uuid": "ff901af9-8da9-43de-ab20-9010035736eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385559, "uuid": "e87759d2-0cc7-46aa-ac03-426cb6ef4241", "value": "60e23e27a3b7c25434b38bbeea3a47ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4cf768-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690377703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377703, "uuid": "fd4d4522-6714-478d-af78-92ca749f1a30", "comment": "Malware payload (Amadey)", "value": "4deaa7f5be8ae8a03818554d9018bbc0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377703, "uuid": "9a1060c8-0784-4e95-8361-77ee3db0093b", "comment": "Malware payload (Amadey)", "value": "49c4a424655e9a1cf36d4fa030a06a15d21ee247a0eb081a1d5539c7097a20da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377703, "uuid": "f3df59da-71f0-4e34-94fc-0a92fb0dc1b8", "comment": "Malware payload (Amadey)", "value": "f81a6d3ddc447d7df09c602c60b4e38af7f89bbf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377703, "uuid": "9d500361-588a-45cc-aad0-e03e76d3fd6f", "comment": "Malware payload (Amadey)", "value": "2498c4b700852f8582f332c5722955db0605daa2492ba3d7ae8a7ed270f4d5e8007b831c41e43586079b5371c539d66e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377703, "uuid": "7df7ad6e-131a-428e-830a-5ef6ac0992f4", "value": "T134840243E7E49432ECB517B158F752930A36BCA24D78C72B3B45A85E1CB32D0A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377703, "uuid": "dfdb112b-90d8-4e84-b094-e40c2295e4dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377703, "uuid": "14cec900-401f-40c3-90fd-98420505d7d3", "value": "6144:KGy+bnr+Jp0yN90QEYyRSyNEJ9K1WtqNL1TfBEpOgBZ+t4WDManxeHtQ:2Mrpy90O7J9K1M+L1TfDgBYCWDxeHtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377703, "uuid": "ad551a8f-f862-4ec3-9689-3d42eff81966", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377703, "uuid": "dbf2dc69-ff4f-4b02-9fba-5db9db694908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377703, "uuid": "f3f31063-e636-4200-b262-4eca2b907610", "value": "49c4a424655e9a1cf36d4fa030a06a15d21ee247a0eb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1061a07e-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690385305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385305, "uuid": "b159bb25-869e-409a-9b54-321953a05946", "comment": "Malware payload (AveMariaRAT)", "value": "6666720ae25d051bb3f975ca56b7d715", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385305, "uuid": "3c9e95e8-95bb-43f5-a00b-548cc03355f5", "comment": "Malware payload (AveMariaRAT)", "value": "49d4d8bdc63ba3c0a2ffb399c72e513ad9ae374a9bddf415ee0f08f06ec64f87", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385305, "uuid": "b594bd2f-de72-46f9-bba6-e92038925c3c", "comment": "Malware payload (AveMariaRAT)", "value": "24b5d343fe6847c256cb45a8df088d2c49e02a84", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385305, "uuid": "b877ca67-582c-47bc-ba86-7ea211ec2fe4", "comment": "Malware payload (AveMariaRAT)", "value": "5510adaf24e88e6a7bff4e8f95faa6c6794288668a5f4046234a3aa8e67a1ba711e42ccc8a4efb267601ceb3e8123858", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385305, "uuid": "5649edc6-66cb-4914-8b0c-e6cde88c116c", "value": "T119D41226966AD54BD1F6EBF49420B3F112FEAECD3C04D9423C96BA8EA474E506713703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385305, "uuid": "f12970b0-d827-47a4-8c15-4ac9f68cdd70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385305, "uuid": "94fd3e3e-dc92-4a9a-a311-436714eb9276", "value": "12288:3BYiIoFwIrG3XCCaSp2grtW4DoVvI4SDIIhEMfpGN8CbQTwfFovlGbb+UMMMDMMM:xHIcTrGCy4gr0BvI4SDIIGMfpc/bHFo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385305, "uuid": "da4633f9-35fe-42d9-a6ab-a58f8fdc8e56", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385305, "uuid": "4f84846d-98bb-46d1-bc91-76c2ff786afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385305, "uuid": "2d1cfda0-ba99-4693-bf99-dbe469b08ef8", "value": "UBB effective 8.2.21.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdf5c7a-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690375983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375983, "uuid": "4564e50c-fa53-499d-be1c-d6a3d282247e", "comment": "Malware payload (ModiLoader)", "value": "5d9332ab72ad2c1140caa4ab6a8c98b6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375983, "uuid": "74d80ad9-3663-47f0-ae85-d96c32c493ea", "comment": "Malware payload (ModiLoader)", "value": "4ad2e1cc69afdd0e85d4dee4f0a4b665e24976e0b80d9f854eaa55d02146f5d7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375983, "uuid": "dc2af6f4-b945-46e8-bf72-d75c80e13de9", "comment": "Malware payload (ModiLoader)", "value": "a1cfcc4fe1cab21ef0799219b411361b0d69c16b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375983, "uuid": "b33a6717-933f-4e04-9002-4ba9e2efea3c", "comment": "Malware payload (ModiLoader)", "value": "70a3f06f8917f6a86488187a0669fdda7a2550c14f106594434644c0943f492f2bdb1ae28195eec34a218ce39cc680e4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375983, "uuid": "387b4c30-5890-489f-8530-0660168558ff", "value": "T16675F129B6D08832D173563CAC069289D46AFE643F30EC85BEFD1C9C9F28E617915687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375983, "uuid": "b7afbcd4-bf78-4591-8a56-9e0415fb39bf", "value": "24576:+bGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptstNN1bJZ:+bGWAJeDingti8P+TwSNO0n9vObJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375983, "uuid": "eed2f5d4-05e9-4bf6-a0f1-e4895181e065", "value": 1656832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375983, "uuid": "de2a8e91-7f68-41a4-961b-76799caff963", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375983, "uuid": "6475f5cc-d059-46fc-8b8c-3cf0e82b9b3f", "value": "nDHL Shipping invoice _621407408,pdf..iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7d2e6d-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690379209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379209, "uuid": "95315062-bf0f-42fd-9375-8e32ec4b26fd", "comment": "Malware payload (Amadey)", "value": "c4606813e08c767a8e8fb729c3a93587", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379209, "uuid": "3ad35ca5-291d-4bf9-90f0-90c7646110b7", "comment": "Malware payload (Amadey)", "value": "4c1fc31ed3d15c4ff3b4ec98b66fb606ef2a1b29d20698e1589a4ca068c36904", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379209, "uuid": "f4c59555-caf7-4e81-a6f6-09b41b51ec82", "comment": "Malware payload (Amadey)", "value": "3db09595fe1618c39d490d65b6b3a11c1c9d8db9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379209, "uuid": "fd70173b-d963-4a3a-a6a0-0c408d37a312", "comment": "Malware payload (Amadey)", "value": "5e81b6075bb843b48eb1574141c0f38ce16d167ced5f30dfa97babac89092876fe5e5190074d96f96681803ef86df2fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379209, "uuid": "2d525f82-ae28-4c98-afa2-ae8d141e1fb7", "value": "T1AA84F112ABE98076D9F507B054F612930F36BCA19D78437B33868D9B0DB2291E53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379209, "uuid": "1878c1cd-bae4-4a29-8bf9-9914acaffb86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379209, "uuid": "46ad7f63-80fc-4e10-8288-7fb9a6c37ca4", "value": "6144:Key+bnr+5p0yN90QEEL91CS+5AnfcQKGsDtBTTBU47XS8mnZ2xUQqwN:2Mrty90yIL/XByOx1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379209, "uuid": "749ec65e-2490-46f5-90ea-3fb12524c6fc", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379209, "uuid": "2703381d-2e77-483d-90f6-8f067a15e568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379209, "uuid": "bb4874b5-2670-4834-9741-4a9906686cbb", "value": "4c1fc31ed3d15c4ff3b4ec98b66fb606ef2a1b29d2069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f9a55c-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408075, "uuid": "342a7ae2-325c-49e8-8dac-a0d9a065c9dc", "comment": "Malware payload (RedLineStealer)", "value": "2c06b7f3a6cb31bd384286d24b1af813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408075, "uuid": "7f0c2d4f-3262-466f-be8b-dfee9d0eaba4", "comment": "Malware payload (RedLineStealer)", "value": "4cad87ec5856ecb95603783f206f220590fae8bed50b92fecfe551ffe08bdec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408075, "uuid": "0d245751-2c45-4e9f-8375-b182cd7f4925", "comment": "Malware payload (RedLineStealer)", "value": "be8fbc82973db128b958ba5ab9410783f25ae975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408075, "uuid": "75aaf7e0-76e4-48ea-942c-1c5a359bf2b5", "comment": "Malware payload (RedLineStealer)", "value": "77d41980ab926680f6614086c68d405026f16b76ec108a20c300bacaf118fbd699fe0123d11a0edb3c456ec2b2ad2d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408075, "uuid": "8dd7ce8e-611f-485c-bbb6-65d454bfaff0", "value": "T16784F112BBE88573DCB523B45CF613C30B3ABCA19968827A2745985F09726C0A97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408075, "uuid": "03a34e14-9a9e-42b9-9921-2841ddc5e7e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408075, "uuid": "fc58e7a1-8e5d-4c9d-a672-95196d6e0aa3", "value": "6144:Kjy+bnr+Hp0yN90QEiCt1z3QG4MftTa/mDnsmPgFbLLP/E/pHxFAm66IxN20e9Qr:5MrHy909H3QJiGcCnP/ypHxmCCq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408075, "uuid": "d22fa131-c5ae-49f4-b1e9-9643e310bb60", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408075, "uuid": "ddadd35b-16e7-45a4-8aa8-4d8a666dd875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408075, "uuid": "7881d8e5-7dab-492b-ae00-6a8ea83118e4", "value": "4cad87ec5856ecb95603783f206f220590fae8bed50b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebe238a-2ba3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1690368982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368982, "uuid": "b11e6720-45b1-47ae-81eb-0d4124f53eb2", "comment": "Malware payload (QuasarRAT)", "value": "3b20a80251740bb4443968cdd125b99d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368982, "uuid": "1a0b0379-1f43-4171-84c0-92a3306ad38f", "comment": "Malware payload (QuasarRAT)", "value": "4d45801772b476bb53a0fed32db423b19b97310d6c5ec2779b108cdcdf1ced6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368982, "uuid": "abac45ce-1e82-417d-8cec-08c80216a04e", "comment": "Malware payload (QuasarRAT)", "value": "d71799b31894752d08b8a0ce5af639ea2cb6abb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368982, "uuid": "94997f75-ee65-4caf-b9e9-d28830981cbc", "comment": "Malware payload (QuasarRAT)", "value": "149b8effcc532522da4a7dcbcab3f4eff3698c045dc8150c442cb943870bba9b6298dede6895d32e7fe2ab7b176a67ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368982, "uuid": "e3bcbc69-0072-4428-b76d-6d7bc6f3ec85", "value": "T106E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368982, "uuid": "9020e495-6e7b-4b9b-8fc5-ba4eaf3b802a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368982, "uuid": "13b82d7e-7289-4418-8292-fd445b224aea", "value": "49152:3vKI22SsaNYfdPBldt698dBcjH+URJ6KbR3LoGd5THHB72eh2NT:3vn22SsaNYfdPBldt6+dBcjH+URJ6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368982, "uuid": "6e6c6a83-02d1-4c8e-bc89-000b5b39da0c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368982, "uuid": "fdbca4ce-0618-4f94-8fbb-58cab43208c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368982, "uuid": "728d10f8-f1ae-41f0-b811-f55790b68ff6", "value": "3b20a80251740bb4443968cdd125b99d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64282336-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690386734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386734, "uuid": "331ba5a1-0022-4db5-a71d-c9454cbeb6eb", "comment": "Malware payload (RedLineStealer)", "value": "c95617370788909544d203e6ca9dd80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386734, "uuid": "67ef3013-0305-4d37-a692-0175bd73f272", "comment": "Malware payload (RedLineStealer)", "value": "4d5a33619c8567d6efd6a3e13c533a3eba0e922838d5152e6588e7c9e95c1c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386734, "uuid": "260c2f95-95c3-4bb4-b6c8-3c83498cc1a7", "comment": "Malware payload (RedLineStealer)", "value": "8a90852aff920d9538ef3aa0ccf0d8420aae00fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386734, "uuid": "4d84db1d-12e2-405a-b092-5c77bb7db54b", "comment": "Malware payload (RedLineStealer)", "value": "7dd547370d1d6b58266f192385ed1f0c27790e68fc3321721fc347a00a097458a0e7a912337c024340af58e2d117c605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386734, "uuid": "0d1a88d5-b966-4e6c-ad7f-1d9fe94c3322", "value": "T19E840217BAE94073D9B5277158F602830B36BC726D38537F3746A94A0CB26C4A87673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386734, "uuid": "10eb8362-a5ca-4dca-a6c1-969b5bc6784b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386734, "uuid": "4f4e92f0-cfc4-4023-9e3c-f409af21e0dd", "value": "6144:K2y+bnr+3p0yN90QEwj2/1ckCiFRHYaAgrDqhQmdgBZ+t4oDi3A9HjZ:mMr/y901ckBAgqhQegBYCoYApjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386734, "uuid": "2e569cdd-34d1-4817-a9c2-d2d5b5aad8a4", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386734, "uuid": "f62c5a86-bc15-4d9e-abfd-3ad481573052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386734, "uuid": "ff38b99a-be8a-476d-b7a8-3a3ea8841726", "value": "c95617370788909544d203e6ca9dd80e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f887376-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690365118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365118, "uuid": "8ce41262-f1c4-48b4-a8bc-3ecf9a3be4c3", "comment": "Malware payload (SnakeKeylogger)", "value": "25abf6aa0f8996e1ff2827b15b6dda99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365118, "uuid": "6a75e647-cfbf-451f-8a81-0052a346a0ed", "comment": "Malware payload (SnakeKeylogger)", "value": "4d87691cc9ee123c1601b86054119c8a202d3f77b51b78306547d900b6a6b7c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365118, "uuid": "3db9bb3f-943a-466c-805c-1de9d56e16a4", "comment": "Malware payload (SnakeKeylogger)", "value": "c3f87fd1441d9be0457ea32821eea89e69c6241f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365118, "uuid": "c37f2238-74ce-4eb0-83bf-7e0017506c5c", "comment": "Malware payload (SnakeKeylogger)", "value": "2c8b38c424513486f019a7da863da2855e83f49911f8a8465454582134681f398cf790cd6777def2b737aea321342e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365118, "uuid": "96c66f5c-fd8d-4f17-b70c-ae774b1a9390", "value": "T1ED055DD1F1508C9AED6B06F16D2BA53025E3BE9D54A4C10C5A9ABB5776F3302209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365118, "uuid": "66d12444-7848-46ba-a7f9-12c5763eef27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365118, "uuid": "a8aa9746-dad6-4cc4-9cfa-d9c0642c163a", "value": "12288:YApJmefaynhsBKwSlDDUYlAGp9piIi+lWF3LXTGjEJY:YA2eCQEKwSdDrrpVxlWdTGjEJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365118, "uuid": "e65b554b-7110-433d-9170-c010c866b28d", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365118, "uuid": "1ff79955-40c5-4176-b07d-5b3435659f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365118, "uuid": "e37f91ba-4ccc-4850-bf0d-bb2aea0c2592", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa70e03b-2b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690354211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354211, "uuid": "aaf9a49b-46fd-4e35-a8a1-78a9515017c5", "comment": "Malware payload (LummaStealer)", "value": "20f0bdb1c1b0fc48e7923a5e9fc65c50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354211, "uuid": "25ee2d56-8e80-45c6-b285-b5f40f4a8733", "comment": "Malware payload (LummaStealer)", "value": "4dc5588ac49fa183824ab585b69a491fd45d1d3b2b01f052adc5062b356e7434", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354211, "uuid": "eaa2190d-e5ac-4492-9339-c1f92a866596", "comment": "Malware payload (LummaStealer)", "value": "7ecef70f5769fb870a1edbd2feb3bdd4b2ac1869", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354211, "uuid": "6cfc9f6c-2736-4a99-90b0-96c5ba838a18", "comment": "Malware payload (LummaStealer)", "value": "478f7740c7241bfd1a980a50770435f051c8776b153f75c51aac68ccf731a1f5a90b31ea7d9bb9645e93418e8223e5b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354211, "uuid": "b6197353-fb77-4eb6-aef1-e8a208b0d607", "value": "T1C5E5336D641BADD2D71625B30B127473A7B19BEDB0823909CE3AA655CF36CCB0C4CD29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354211, "uuid": "f1c432e7-84c6-44fa-a233-2552e4b294d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354211, "uuid": "a68eeca0-622a-4f1a-86b0-2384ad962e39", "value": "98304:nSGqtecGLXDOM19JV9MN14QwqqYoB5pU5SF:SXtaXD119JVKj4QwqqYOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690354211, "uuid": "702df692-65a1-4f89-abdf-19012221d0e4", "value": 3204096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690354211, "uuid": "3cc00b9b-983a-4231-bf9b-f732ec7e7ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354211, "uuid": "14caa769-7b04-4aa0-aad7-b5a6f3766f0c", "value": "20f0bdb1c1b0fc48e7923a5e9fc65c50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a145c463-2b4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690331432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331432, "uuid": "88d63b8c-fd30-4565-bff2-dff90046effe", "comment": "Malware payload (RedLineStealer)", "value": "01d6dc4aa076ba46c70d8327cca3c707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331432, "uuid": "2aea73af-7ee7-4b73-af3a-243320eb8a31", "comment": "Malware payload (RedLineStealer)", "value": "4e3be33b1c0efe3275b4a3a5519f74200c54ea3725fd2f26346e5c059901b9be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331432, "uuid": "5c1e48c5-369a-47e0-84d3-0a026e50841a", "comment": "Malware payload (RedLineStealer)", "value": "aadfd43e180741d455210e9c1cfeeff147ea8e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331432, "uuid": "c1e4cbdd-43cd-4223-a0b8-db6e9f1ab0ff", "comment": "Malware payload (RedLineStealer)", "value": "97fb82a86d266f7625cef3ed0aa095dfa2a8003205cbab86a93fa7eadeda45da6d4d38a92e5dd393237361738aaf7a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331432, "uuid": "16bf2787-0335-49c4-a057-b3212e7602f8", "value": "T10EE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331432, "uuid": "39313e53-d078-46c9-a1b2-98abe8812491", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690331432, "uuid": "cb80db80-4852-4a00-9726-782b963b3b4a", "value": 32242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690331432, "uuid": "336181db-e56c-4ff7-afe8-d349908db0b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331432, "uuid": "70670f52-dda5-4810-9a04-1b42aaf074b8", "value": "01d6dc4aa076ba46c70d8327cca3c707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f78bc1-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690376825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376825, "uuid": "fb558877-fc31-46b4-91f4-da5c3eefcbe3", "comment": "Malware payload (GuLoader)", "value": "0d6ef877ae7e38b4267a81fb519088d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376825, "uuid": "035f401b-377f-47e8-bb25-c44156e9514c", "comment": "Malware payload (GuLoader)", "value": "4e67f85b41d0a2b9a3fba1207339671ed0f9cd3a902bbb47b30ada2663f525f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376825, "uuid": "e48ad9e1-131e-460a-8902-729f8caccf73", "comment": "Malware payload (GuLoader)", "value": "7ab88d3c6b926b2e1ed5983f9c2c50ac31a6721e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376825, "uuid": "e5cfe8cf-af42-4616-b895-31e57215130f", "comment": "Malware payload (GuLoader)", "value": "8c72279086f9513a4150d3f1088cda15f9124fc4f20176ee37f8c86902c7cc9b7242711dfb6b557b455cacda3daf96ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376825, "uuid": "64347df2-71ab-4411-a840-c79f9ea7062f", "value": "T1431412636384DCABC85B87704B79BE71FFEE86019191674B13C49E073911A91C73E2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376825, "uuid": "3d93eec9-df09-4715-9485-d60816938e2c", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376825, "uuid": "db2d038f-0928-4c0e-b9df-326a64b0ed8e", "value": "3072:nwDijpS4DbYcr8bqY2PNVb4pfoyzeKXdbFgmlN01ji4P4gaRYC3rfOB+itzqaXft:nFPeriNifopKXdbFgmmHP4gHBmaq3y0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376825, "uuid": "08e2f570-5984-4f1a-ab2d-df0c98933ae6", "value": 194809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376825, "uuid": "2f73c1d5-c969-49cb-a5cf-06c8bb305822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376825, "uuid": "b54b4396-a25b-4706-92e4-281778e2dbd1", "value": "New Inquiry List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee27c7f5-2c09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690413165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413165, "uuid": "06c9265e-c31e-46c2-a808-d9b0c456bdc8", "comment": "Malware payload (Amadey)", "value": "482b5b5074e9a4dd3dd618255f853f73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413165, "uuid": "4d177d86-ed8c-42f0-96b3-b5f7b990bf7b", "comment": "Malware payload (Amadey)", "value": "4f57ecadcb01211787f5486a7230a8018a0f8a85dfe1ad7b633beb40126c1c56", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413165, "uuid": "12fa6ee9-9e77-465c-9dd4-4684dd9229ad", "comment": "Malware payload (Amadey)", "value": "a65442b85c5fac2fe3cb9b5af4ce4bf6238dd1e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690413165, "uuid": "c5d57e5f-80ed-4ec6-a342-c2371afa8c3e", "comment": "Malware payload (Amadey)", "value": "e6e96899ab3091cc43bbc5149b0253be0f4c6c0b5e5aa8d8aa36e86352f7006af668314adb5af0b481b053fc8039165e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413165, "uuid": "18c9a96a-1f27-4624-a092-048db84ffc0e", "value": "T10C840112B7E86173D8B51770A8F503D30F76FCA29D34432B6786AA5A0DB3684A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413165, "uuid": "23cb5e61-926d-4c5a-8a27-5da7f24af079", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413165, "uuid": "ad24345a-f975-45b9-873a-3995d60ad741", "value": "12288:GMrZy90aJyyFZrk62AYWbT4bPwnzmfhx:XyvpTrn0ba6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690413165, "uuid": "77e7d00d-22a5-483b-9da3-38a77827f459", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690413165, "uuid": "05de4fed-9bfa-4bb0-8d69-dc72adf85088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690413165, "uuid": "5aa20689-b247-4a70-8b1a-872290538a46", "value": "482b5b5074e9a4dd3dd618255f853f73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2cf264-2bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690379505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379505, "uuid": "c95fab6f-c99c-4554-bd41-51083b743457", "comment": "Malware payload (RedLineStealer)", "value": "7b950b64ac08857b3deccaaa87a316a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379505, "uuid": "f84b8e28-fb51-4bdf-84ee-ab06c2f212e8", "comment": "Malware payload (RedLineStealer)", "value": "4f86d48b3d0bdaa6f4d6e224cb3d78d45d0e5ff02992de35aad4053a747106df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379505, "uuid": "11f48496-0ab3-4bc4-9353-3660f0279cb6", "comment": "Malware payload (RedLineStealer)", "value": "9235f96b6b4b5c37b581556dadfa30dbce857034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379505, "uuid": "f5423f48-1f10-4596-817c-435e40c2d1b2", "comment": "Malware payload (RedLineStealer)", "value": "ebb15e1fd9bdcf349249ae18db4b13b3e88e92abe9accb759f683c000ed8a6bad94873c7ab69e7488eff8b80d655cf29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379505, "uuid": "cf7eafc3-3563-446a-b1af-588198daf1bd", "value": "T18C840203E7D99033D9B467B028FA07931B35BDA25D78932B2746A95A0CB27D0E53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379505, "uuid": "edc7852e-2c94-44b2-862b-2e89eb3cd629", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379505, "uuid": "f73dfc2c-1150-43f2-9fff-e9704879a568", "value": "6144:KMy+bnr+lp0yN90QEQ7y6KGyF4tgKY4Jrovv90vgBZ+t4UD9AT8sJeQ:0Mr9y90AyeVY46vv0gBYCU3sJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379505, "uuid": "ef0fa9c5-7375-4fc0-ac13-a46698cec80f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379505, "uuid": "dc1fbaad-b985-40bf-8bd5-ee7d156338ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379505, "uuid": "2bc9f73d-9d07-400e-892c-429bbac1343f", "value": "4f86d48b3d0bdaa6f4d6e224cb3d78d45d0e5ff02992d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e6a865-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385207, "uuid": "6a6c199b-a908-4d5b-a43f-f548684896e7", "comment": "Malware payload (Formbook)", "value": "0c0f4b29d8f22a68af63878473d05f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385207, "uuid": "18e5d756-9b6e-4c87-acf6-25f35d357209", "comment": "Malware payload (Formbook)", "value": "4ff429625da9915e133c7c495e85cd4235813784fbc251d7259db33c77b81f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385207, "uuid": "f47c62dd-8646-4e3d-ab83-19a3e3974521", "comment": "Malware payload (Formbook)", "value": "fc4a68398d978e96ff1a4e608b0c5e8e85f8a9b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385207, "uuid": "216ee893-e4db-4a90-ae2f-76c3d068f956", "comment": "Malware payload (Formbook)", "value": "a4d4f7ad0265485dce34b4c990048adee4d564a67554cffe3a4afe6762fea75e2af811037832ba8b03bb803f4f8b842d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385207, "uuid": "f6aa92b6-a906-4ec0-b79a-fbf5fe251fd0", "value": "T136D4220073ECBFA7E13A97F24652144547F1DE67981BC2596FC120D2AEA6F154BB0E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385207, "uuid": "36356a13-82ba-4daa-9f99-016ba2234148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385207, "uuid": "cd1319e1-9b6b-409d-9582-ab83f8376803", "value": "12288:WJmefaynhgq63ZGiNIkW8tUZyyYy5ANvaqF+THb4or+SQk22:veCQgq24kW86y/fvFMb7tD22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385207, "uuid": "07b077b2-6575-47d6-a2fa-71d9d032eb64", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385207, "uuid": "601a37e5-1fdd-465b-b318-27aad08bd23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385207, "uuid": "03a0b48d-3240-46f8-9488-77910f7d7cf4", "value": "FEDEX_AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766a6989-2bb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690375598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375598, "uuid": "3073ace6-524a-4bde-a7d9-23eed8220e2f", "comment": "Malware payload (Amadey)", "value": "5c83578a8fc7e5cbf40a49f1b248e057", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375598, "uuid": "150ef3cd-9e37-4164-b6df-799c26567ddb", "comment": "Malware payload (Amadey)", "value": "503c41e4f5ca8a6b8967b6a120302825d282dd17f2561bbc1fd246bd498e2937", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375598, "uuid": "4adc9b35-327d-4400-9c2c-54d3f0275c5d", "comment": "Malware payload (Amadey)", "value": "016f206c37cda35f49bdca5678142f086f71392f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375598, "uuid": "c4a54e49-81ce-4865-b889-6132b8f963d2", "comment": "Malware payload (Amadey)", "value": "da5cea21cee7bbe10ff1a003cc46f0a1f1c8a63ab5192c22b8666b3112a9b5cc54835a86f64a3d2154b1ff187b5301d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375598, "uuid": "b2e30817-47fc-4dcf-aece-744cc83d147d", "value": "T14E840247BAD95172D9F91B7018F602431B32BCA26D78837B2706D85A5CB27D4B831B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375598, "uuid": "54bfddb9-7a7a-4a66-ac07-b4f6907e053f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375598, "uuid": "ebe95798-328c-4cea-9337-e37f8af85218", "value": "6144:KFy+bnr+Dp0yN90QER/nDPvVb2DJr727unUj5SkU06mgBZ+t4QDOc1QcHW1sLzes:HMrPy90LnD0FK7lpUmgBYCQFHW1G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375598, "uuid": "78c73a5c-f847-401d-a404-85ad5b5f0a50", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375598, "uuid": "16e4c7db-b8a5-4358-8bda-9868b6534493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375598, "uuid": "e2d4c157-8c39-49d6-bee7-c4d90f79d526", "value": "503c41e4f5ca8a6b8967b6a120302825d282dd17f2561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9646d537-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361478, "uuid": "1df30de2-175a-4e32-b6ec-d45b3a08770c", "comment": "Malware payload (Amadey)", "value": "f7169a7176ef6d7608d559d58ec6cbd4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361478, "uuid": "b238f9e0-a75b-453e-b580-6d30c7851014", "comment": "Malware payload (Amadey)", "value": "5117a1cd94819346490bfaa1f7fd64837214b9a803501a53c6e2d49780aba439", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361478, "uuid": "bb98722b-e96e-4dfa-b323-8e43ac9c4c23", "comment": "Malware payload (Amadey)", "value": "fbb75200df42a122bcf856b232fff82feb660206", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361478, "uuid": "241cfc28-b5de-4eaf-aa33-3d8b0ca8a304", "comment": "Malware payload (Amadey)", "value": "08017ab716fe3777b895a93ba2d741d3162d26b55e29007057cbe83bfb28d0cb5f7c42376b8938974562b84069adf0b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361478, "uuid": "ab97040b-157f-4d9b-a8ae-41d0f610bce3", "value": "T11784F153F6D84072D8B517B05CF602C30E3ABDA1AD78936A3785A85F1CF2694A53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361478, "uuid": "88d388c0-81b9-4f0c-9ef1-d016c79a5fd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361478, "uuid": "2c72ed57-b2e7-4275-93e1-5bfb7326844c", "value": "6144:KMy+bnr+ip0yN90QENyvlbeVw+C/q//rV8lSkfV7V8hSjeJGlIkixImznO9cP6wH:cMrOy90qN6VB/rV8lSAySaxpOOP7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361478, "uuid": "e1ede323-360c-4976-a5d0-4f5769a5f839", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361478, "uuid": "c5baf4b2-bd84-4233-9b7b-b72330808036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361478, "uuid": "c25ba84b-eda4-4e41-9f6a-8b2b26de58c4", "value": "f7169a7176ef6d7608d559d58ec6cbd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b28c44-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385321, "uuid": "9dc5ff3b-54a3-44d1-8b92-3da85e9cc918", "comment": "Malware payload", "value": "89fe85fe4913b28c33761050e124fcaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385321, "uuid": "bab6ba33-9830-4e61-949d-3de1e481a088", "comment": "Malware payload", "value": "5215c07ba9ff4bdd0f28ef0a419e85806d27c8916b96c517dd1592032f71212f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385321, "uuid": "882e3607-590a-42ee-a8dc-8ceaad159249", "comment": "Malware payload", "value": "16cf3509b14849e2bd89ebe69ecc029222971197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385321, "uuid": "1812deb5-4a19-456e-a292-d4a755bd8055", "comment": "Malware payload", "value": "5e673b7670d5779064503fabe44780d5db07862b93b139eb6148c898dfd658fcf1d6808f8e423ecfa12c7caecde86caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385321, "uuid": "95285c01-efb3-4de0-a8a5-238ef910581b", "value": "T13FE4BF266384AF5FF1BD77B89122191483FADA572228EADF3FD610CD18D9F008751A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385321, "uuid": "b8316cd5-cc2b-4671-b572-9ca84586dea0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385321, "uuid": "48292618-8ca2-42de-afac-2a7a60793d1e", "value": "12288:1xhIutSVAzrzS3CmRv5Hf6tsMfhvMgZ0kXfofasAI6EBz19o25ELGh:BIutSVEyRRvOpqL6EBz19t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385321, "uuid": "5b030211-7070-44c0-b9c7-526db815b132", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385321, "uuid": "93131b28-3e4a-4385-8595-ee86476e8cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385321, "uuid": "1fc65228-bd65-4b5f-aef1-e361d603dfab", "value": "PO- 216238068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a894eb92-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396298, "uuid": "b34af22b-089f-4f05-9c34-d180d499126c", "comment": "Malware payload", "value": "36a70d169326b9f4d2643a54fbfa38fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396298, "uuid": "1a3fd9ed-3469-4b15-ac84-02c60a576802", "comment": "Malware payload", "value": "5318febd4bf291dde9eab892579318b77ab7eace482811138cae7aeda518f6fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396298, "uuid": "45be45d1-f465-4fc8-a171-96c3ba73a1c5", "comment": "Malware payload", "value": "c7afb9998b0e4cfeca1d08c1fdf7e99410b2429c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396298, "uuid": "49e9c0b2-8076-4e14-a274-8c2aaedc8cb7", "comment": "Malware payload", "value": "974dd44f0a5c0c96eb9b50dbada07e6b442468921b330d218e7cb12567bbad7c72393ee87d68d1f3f69d64712cc9b05d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396298, "uuid": "f588214a-d2b0-4bc8-b855-0a9f03345b3a", "value": "T13464AD12B681C031C17F02306529EB5456FDFDB18AB5CA4BFBD80A4E1F756C2AB26763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396298, "uuid": "fc9b5521-aac8-4da5-b333-90c49a244e6d", "value": "62949029d554636ffef7b6e235a05232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396298, "uuid": "2ff43337-179c-4530-b264-3e4053b526fe", "value": "6144:bHGGBJHzYUcd6/SU49iGtGMAZS2K6Mr1W1kWa+LT5v4:bmMHzY64U2GHKbr16a+Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396298, "uuid": "db21e951-efe4-4e74-bd6c-91662911ba36", "value": 310792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396298, "uuid": "2506acd3-d997-4157-931d-41ad07efde1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396298, "uuid": "c0be2b79-e9d1-43ee-afb2-b24697170c7e", "value": "SecuriteInfo.com.Adware.Zaxar.111.16621.29357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b1a803-2bdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690395132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395132, "uuid": "20093e65-30c3-4f8f-8a2a-9614a7f114de", "comment": "Malware payload (Amadey)", "value": "12460a690d836526812cc6b4d2b6f928", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395132, "uuid": "66ae6b2e-17d4-40cf-8c56-382506e64331", "comment": "Malware payload (Amadey)", "value": "5359ab3843a9f4f37837480396dd5eab34b401ecd67cffebaff1fd162b9fa59c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395132, "uuid": "68defea3-26f1-499c-bc3b-4e457238e8a0", "comment": "Malware payload (Amadey)", "value": "c7d776256ac1a077e25ae75790268740b853374c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395132, "uuid": "d11790bc-5615-49e0-99b2-de01248799f9", "comment": "Malware payload (Amadey)", "value": "2dbc54e6c55fd00ceb1c85b68ae8590b3e729c20f070c6fa95bfff2d667931605c6194fb97fa33d4d5ae2d8adc63cec6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690395132, "uuid": "d2ad918c-13a8-40eb-9a94-a1614f3e1072", "value": "T14FF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690395132, "uuid": "a6930d13-d84e-4aba-84be-652cc08a9aef", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690395132, "uuid": "3310c537-0083-4007-9741-2ecf93aaecc7", "value": 35682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690395132, "uuid": "5cf1826b-57a0-4fe5-87f2-36787c528e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690395132, "uuid": "26ff8370-f760-457f-b1bc-9300374f10bc", "value": "12460a690d836526812cc6b4d2b6f928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54815131-2c04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690410760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410760, "uuid": "20afa47a-06fb-4297-8ef8-25b729912d4f", "comment": "Malware payload (RedLineStealer)", "value": "3bc5b2426cd5cab7c9ca7e5737d6d7c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410760, "uuid": "b61b475c-cce2-4896-8589-6017b571c8ae", "comment": "Malware payload (RedLineStealer)", "value": "536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410760, "uuid": "05322258-0a21-42c2-ba3b-4a4373f14e71", "comment": "Malware payload (RedLineStealer)", "value": "8fae227b631bd835a2fcb586a104949bb6759045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410760, "uuid": "f2766d28-8a0a-423e-8afe-50ce23d47e2f", "comment": "Malware payload (RedLineStealer)", "value": "89e6d62a3a08e33d8d07d9450d90b675e620343ebe1a98e4455e6aefd66abf7575b7f0aba287f712106228f4e8c08c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410760, "uuid": "11f270b3-df77-4e72-a275-61406e6b4b0f", "value": "T17F840102A7F88072DCB113B068F707C31B3ABDA1A97483263385A95E5D737D0A57676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410760, "uuid": "0a0ea96f-11fd-460f-8234-922646ac6f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410760, "uuid": "c1f64cb1-0e4c-46eb-aa77-ad624bd01b86", "value": "6144:Kdy+bnr+4p0yN90QEfWPhKGKoAptKI8B5qf03QyCFcmRQoIe0lfrmkzOScRIvN:zMrky90xWPMpgIb0gyCFcpTeIPLvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690410760, "uuid": "be74380f-b757-4518-9b89-25c7ddc4ccc1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690410760, "uuid": "2bf42926-b4f0-4703-8784-1d90688d70cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410760, "uuid": "8e3026b6-891a-47c2-89c2-31bab0eb1e3f", "value": "536536221030ca60a298f443a202be11047ecd20614f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899b01d7-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351149, "uuid": "605ae576-cd9f-4dcd-a8bc-77c04da8571c", "comment": "Malware payload (AgentTesla)", "value": "f3399962beb81d870b7f5e458f364441", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351149, "uuid": "1e4a4c60-2eac-4df2-a2bb-acbc879e044d", "comment": "Malware payload (AgentTesla)", "value": "536c73689bb26537f1a86d96a8d413c5995d7dafe185c276735ff8fb4514b964", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351149, "uuid": "4a1be826-f358-44cd-bc59-6330736e76f1", "comment": "Malware payload (AgentTesla)", "value": "1c3edbaf2f08b5080991a48377e0ab86dc3551cc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351149, "uuid": "81383785-9a9c-4d1a-b45a-362e0edc237d", "comment": "Malware payload (AgentTesla)", "value": "4ddc76621315ed2e2ebde677364bd6e55aeae6b6a30e93bdfe389acfe0e07d0c17e137bd726ac076af4344389503ca6a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351149, "uuid": "b24b3042-21f6-4a82-8e63-8149d6b7a9ff", "value": "T1B7D4336E28B95F61E805F6C6AB447A27F7B0161374CB56BB793429C09F6B84C30CB063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351149, "uuid": "9e55f964-eafc-4a55-95a1-c0d125ae40ec", "value": "12288:V8Aw1E2hdLdM24rSzWa3RjPCe1uOlq+8mhSQ02p/w8jbSP4G6KSiZRY3nW:qhdLsAWa3RWcfDPSzMiZC3nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351149, "uuid": "b3886342-229a-4509-9402-ec0016db92ed", "value": 644705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351149, "uuid": "353a093c-c188-4a3d-a66e-8d68c6a822aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351149, "uuid": "3e5a92b3-acdb-445e-b876-6a0b06481506", "value": "shipping documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0b332d-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690381622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381622, "uuid": "31b7dc88-366e-471f-adb4-c109c52b1a68", "comment": "Malware payload (Amadey)", "value": "0b1ce353968b0c3b2460ee1c970494bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381622, "uuid": "24f14066-948a-4177-b96d-910ad6d37866", "comment": "Malware payload (Amadey)", "value": "53cf9b6e163fb85f7a2983777330f4b842b13db5809af32dc4a7847702037208", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381622, "uuid": "6ae41e37-43f7-4f3b-8b97-73417234ff73", "comment": "Malware payload (Amadey)", "value": "0ad9526a8fd38865222352522661dda4646a7c3f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381622, "uuid": "f2a955cf-cf80-4226-a745-bcedfc363410", "comment": "Malware payload (Amadey)", "value": "76ff87e725b782dcb20c7aa186b14da7b1bc1a57cd97ec2819ac20dbc2245ac820d12fcb2f64b4e60b05cb2c56e86019", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381622, "uuid": "c356aa39-792b-480c-bba4-dec24d47654c", "value": "T18E840142EAD95132E8B457B164F703831B36BDA25C78433B2B46998E4CB36D0B53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381622, "uuid": "32adca89-6844-4cac-a0a1-ccf5ce73f289", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381622, "uuid": "c74076b4-99b7-40b7-a6f4-6b9147256a29", "value": "6144:KZy+bnr+fp0yN90QEMhQGyF4t+9hRuXhVZzbqQvNU0ngBZ+t4yD/FJgvCuMd4f:bMrHy90Shfo3uXhbbqa3gBYCyDtuMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381622, "uuid": "a5508921-e26a-4a72-831a-aac597953f39", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381622, "uuid": "a4b6a255-5c25-478a-a998-16330cef4a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381622, "uuid": "9598c371-0e59-40f1-aaf2-ab9e61e918fa", "value": "53cf9b6e163fb85f7a2983777330f4b842b13db5809af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3b46d2-2bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690390934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390934, "uuid": "0474ef59-fb29-4e74-927f-6dad34c277e2", "comment": "Malware payload (RedLineStealer)", "value": "078626b761eeae2941b894dfc3f1933e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390934, "uuid": "48b7e7b9-4dcb-42b9-ab29-397dffe374c6", "comment": "Malware payload (RedLineStealer)", "value": "53ed719ce1e9ef92a3c8bb33b3e372d0a82ed4d4ea224866031bf10b3be36bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390934, "uuid": "27e516d7-8285-448a-99d6-42caedeabbe8", "comment": "Malware payload (RedLineStealer)", "value": "460cc562bdf35ea3119fcb7085b67670aa03c3b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390934, "uuid": "3d766081-5807-467c-91e3-83498c5f5b80", "comment": "Malware payload (RedLineStealer)", "value": "2a44a4a6ce55bf44dd640abe89a946fffea6f173051297b120760e85df7ae303ed29d906ff15c794301e7ca867391eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390934, "uuid": "b0c34c1e-76f8-4e57-b05d-b70ec0262bfd", "value": "T1BEF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390934, "uuid": "38e1ea33-2845-4e7d-8705-5172876ecd2d", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690390934, "uuid": "9ea1dd5f-4b93-4960-99b8-e8e45d2edbfe", "value": 34826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690390934, "uuid": "ea8894c0-0ee4-441c-a0a5-9c31c4605b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390934, "uuid": "4738c089-3bc8-468d-83ed-b8b72fc5d86b", "value": "078626b761eeae2941b894dfc3f1933e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c677857-2b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690357972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357972, "uuid": "2fa643a0-5965-48dd-b412-d131515eea06", "comment": "Malware payload (AgentTesla)", "value": "fdcc34dbe7d347f568c9c83d783978db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357972, "uuid": "f3dcae34-e493-4093-ab4f-e4c17b2c2544", "comment": "Malware payload (AgentTesla)", "value": "540e1e3418af9347bb2e87117af7e7a70a5fbf1bf00948d83020f4dec1b1466f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357972, "uuid": "33c18f3d-2e76-49d9-b781-aa239ecd196f", "comment": "Malware payload (AgentTesla)", "value": "1152c57bd61fb43bd4595acd619ccc6e3cd3499d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357972, "uuid": "fb62a6c5-853a-44f0-890b-8ec78bfc8104", "comment": "Malware payload (AgentTesla)", "value": "2e16f7394f4a8a54e528b163ef21ce72336264d9c5fad0e754c4c0c424d465f5da045caca84bc4e18c6fd8a9bfd6d39a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357972, "uuid": "ce86fabd-a06a-4f2f-8e68-e358929ed2db", "value": "T1D4E41244719C6F8BE9299BF8065154894BF0C9B39A26E38C2FC670C76D69F111EB4F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357972, "uuid": "1c1a00f4-8f01-45a9-aafe-f21d1068e7fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357972, "uuid": "34439ca7-fd23-481f-a8fa-e063b3d27543", "value": "12288:VokZmefaynhvPezKGWKEZynE7s48/YJilnWes6EEHY1+G95TUbl:VoheCQvPejWKEZynfNYJUWeHEEM+kRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357972, "uuid": "6e2f83ee-469f-4f37-b208-a32eb7f3ad78", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357972, "uuid": "842d4d45-322a-4a8b-a08a-8d6bc2a99c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357972, "uuid": "881670b1-740d-4cba-8842-8d06292f85e5", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b977f9-2bb4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690376503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376503, "uuid": "ff24535f-fb86-4962-9cd0-dc210b6a3e22", "comment": "Malware payload (Amadey)", "value": "1b4800daaaa7c169f68ec120ba2c3d92", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376503, "uuid": "51c300b6-bf33-48c5-86ab-722ff46b7c39", "comment": "Malware payload (Amadey)", "value": "559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376503, "uuid": "3eeffbff-7004-4749-a08a-eb36086cf20f", "comment": "Malware payload (Amadey)", "value": "a70c58e128758611b3a359e6620c3a3e81bcf767", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376503, "uuid": "3be65963-8ae6-410c-809c-898bbd2d5fb3", "comment": "Malware payload (Amadey)", "value": "4a099ad729aacf7fed450536e52f3c6b9b7ba42340ad9743ce9c977ea4378bb395de4edf26547d4995fe6f681e3c9f80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376503, "uuid": "6e230e7f-2f65-46f0-9c75-b93f8ff99bc2", "value": "T1BC84F113E7E49532D8F51BB05CFA02830F3ABDA19978836623459D5E1CB36D0E875B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376503, "uuid": "8f93db5c-8304-4f4c-8efe-fa97c394c926", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376503, "uuid": "01a17b1f-d1b9-45e1-a2fa-c21fdbde6806", "value": "6144:K6y+bnr+np0yN90QEo05rDWFqSlrjVfhz4y7mqtimt3n5jkH3IQ:6Mrvy90m0kBBF4y7mqtpZUIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376503, "uuid": "2fa7ea68-ddaa-4c7d-be33-278c5248f8fd", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376503, "uuid": "8d2ed1f2-0a5d-4a5e-b6ce-6e243f74199f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376503, "uuid": "ef967343-8db0-4d1c-bb5b-a635d8493750", "value": "1b4800daaaa7c169f68ec120ba2c3d92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9929e4c-2bbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690380408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380408, "uuid": "69c976ba-b488-4521-8b2a-528215309246", "comment": "Malware payload (RedLineStealer)", "value": "a5290f41b140199f65e9e9b7d2271a3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380408, "uuid": "33051cf2-8f7c-4fe7-b12e-59bbb573c35a", "comment": "Malware payload (RedLineStealer)", "value": "55ab9707d2ed04fd65eb47b64da270cf7fa47cedb721831c5dd0567bda7cc950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380408, "uuid": "6da99cde-5993-4dd9-a0b7-c40b43f5ba17", "comment": "Malware payload (RedLineStealer)", "value": "15492c7db927b054e4eb813b426d5c8642ab22a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380408, "uuid": "9437acd0-1e0d-4e45-b2bc-f388ff2b6e09", "comment": "Malware payload (RedLineStealer)", "value": "9c3b6aa09b37bfc5fe44402313e977f401633987eb77f7c71a796e3e2c9dbc00f5ff6e11e17ca16deade59b318c85670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380408, "uuid": "31026777-85df-4610-b197-a87df79d73d8", "value": "T196840113FAD84432C9B517B068F707930B367DB29C68936B3345A96B0CB3AD4953276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380408, "uuid": "14d7592e-93cf-4c92-b1bf-881a0e96639b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380408, "uuid": "1ea54beb-7774-4946-8956-6fa9f080e0c4", "value": "12288:NMrAy90Y4tMhulGOAFfgBYCifwu9GVtJK:9ydoRAFYz8M9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380408, "uuid": "ba9db1cf-6f46-4f31-a488-9c040aafa9a7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380408, "uuid": "c9c118a2-2a7b-4599-8592-cfd046e3f584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380408, "uuid": "4177e29d-6e82-4411-9e18-0746c9353da3", "value": "a5290f41b140199f65e9e9b7d2271a3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6524a3ee-2bbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690380723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380723, "uuid": "ca4f9864-3aa2-4e04-8ebe-658a5208378b", "comment": "Malware payload (StrelaStealer)", "value": "278cfbc19bfc3ab84c26ebca719d411d", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380723, "uuid": "a4a2f201-ff0e-420e-922e-73edda1a7d6c", "comment": "Malware payload (StrelaStealer)", "value": "5646bd0d0ff3bd5c00722c535cd7d898991d800d61f63df99e62dfba1c6b2d01", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380723, "uuid": "c0e1efce-c3d9-4d22-8b91-900bea208eee", "comment": "Malware payload (StrelaStealer)", "value": "fa26f49992d8d8cbdad3890802fc132027b3bce2", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380723, "uuid": "121270a9-7008-4e03-a2a0-e256b1ad99db", "comment": "Malware payload (StrelaStealer)", "value": "6d7869da24f5bc1b5fc57d87e4d33d6a8797c89cba4d8ff98dc7d9b4e5f2b3e361fee1922ce9501461cbf187733a7ecb", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380723, "uuid": "5a773a29-cb15-4602-950f-31e4ede9c067", "value": "T19EC41BBD65EB654AFEA19C302FFCBBA1C77724A9C657C7F045E9A03024204A7DC12927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380723, "uuid": "b9a29ef2-59f1-4c7f-a948-aa3d70279cb1", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380723, "uuid": "4f070a7c-20d9-47f3-b879-7d62da8025da", "value": "6144:eXFyEBRqv40/8WQ3sP0uiy/9PHwMNqOYg8+NB6tJCvWc8WBmORKwFvwaVPTKcM:e1yGM8WXPVmOY9+NBayXBtRVLK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380723, "uuid": "9094a0c1-11d6-4a15-9d98-7aedb5388757", "value": 567477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380723, "uuid": "d5a2c09c-604a-429f-b0e0-8d724fff3cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380723, "uuid": "04cc7e51-20ba-4ecd-ba17-87c7e09bb4cc", "value": "rokuwphutgobcvluzdpazvglblkcifmijfegfxswjhjncfarix.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c3312b-2ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690371601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371601, "uuid": "8667331b-9ef8-4c0d-b9fe-90baa55f6bd1", "comment": "Malware payload (RedLineStealer)", "value": "6056578d92284967594aaad32f893fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371601, "uuid": "8a298e8e-fe4b-4f37-b483-2e7a39b6603b", "comment": "Malware payload (RedLineStealer)", "value": "564c208ba53b8946babcb535a539d028e5d4a2ee99b3c083f1dc6452bea01dfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371601, "uuid": "bd24b566-7372-468c-aa79-c812224d9fb5", "comment": "Malware payload (RedLineStealer)", "value": "b008fa5d4c4ac6d751712d0d1453a6c34084269a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371601, "uuid": "51e31dc5-477d-4d7b-bab1-d7fb7e1ed9e1", "comment": "Malware payload (RedLineStealer)", "value": "965e6f3c6407bf7cd6b08c16a7690c668008c992662e70d10bb1f5a90091b8a8c1f2d7f65e01ec99813f688d4037660b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371601, "uuid": "9652d867-e3e3-4b45-a185-7ae25f83b992", "value": "T174B41203FBE99571D8F127708CF712931E367C61A9A987BB27C2684A0DB36808535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371601, "uuid": "2f83accb-a180-412b-800d-8c8b5b177558", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371601, "uuid": "8cac4336-b14a-4b09-a82c-a69b6f821d2e", "value": "12288:zMrOy902dH8Mj8GETGGR6V6t6a6157k8EDNnD:RybvdgGGRi6tknQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371601, "uuid": "6279a281-5505-429f-b2e3-f7afc7413971", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371601, "uuid": "b0385f37-c13e-474c-859a-e22df7b84167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371601, "uuid": "c7ca287b-9d31-4a1e-8759-e556cf864e17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ad8793-2bda-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690392752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392752, "uuid": "198b2415-30b9-4349-876e-3086c956c37c", "comment": "Malware payload", "value": "e191df8044ec1c40fc57ac967b4a4128", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392752, "uuid": "118ce9e1-ef7d-444e-8bea-6d71548c2daa", "comment": "Malware payload", "value": "5658c5fb0bbd14e00ed5cc25d50f7898f9d0123c6dfe8ff66b8bab0321ea5f51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392752, "uuid": "27b290ec-f0ca-43e1-a19d-e51619479502", "comment": "Malware payload", "value": "b963e0c4ac737261fda4263f933869df353aa7c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392752, "uuid": "9296e8c9-267b-4016-9267-86b53557a9ff", "comment": "Malware payload", "value": "e689466323c39db6db1ace8b092fd5a0b5ca01327f39f02ebe9fe803508f988788301c3527a7060eb6643c7c341ad71b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392752, "uuid": "5d2483e7-cd56-432d-a6f0-5736e43a8e66", "value": "T125427E35CB4705A4CF8E5DB08BEA689E5A51254EF19C02A0CB710F4E7C712BBF95714A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392752, "uuid": "23d2feeb-9dc6-4588-addf-a2e0c253dff3", "value": "3fb7ec92dc5428dc25b22a2c07c4e9d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392752, "uuid": "b250dee4-9036-4386-a269-14cc18eefc39", "value": "192:4PuMnNWUKiopleop9FAl1kV9pxmHxJP9gqTPvKAqcZofCKXttwg9:4P+hDtrFAsV1OxJSAaBGo6K9twK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690392752, "uuid": "351d2765-fe8d-47dd-847a-e5b5dbecbed4", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690392752, "uuid": "71e71d24-713c-467f-b2bd-82d9361470cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392752, "uuid": "01f7140c-4fe2-4ad6-9593-0305914cfd7f", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6960.13864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498561a6-2bbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690380677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380677, "uuid": "ab6d9190-6a7d-452c-a676-95f62870d5b9", "comment": "Malware payload (StrelaStealer)", "value": "122b6cd55c089895184d62f138ee2079", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380677, "uuid": "43115edb-b584-4468-a6b3-3d634ad52680", "comment": "Malware payload (StrelaStealer)", "value": "57a16acfe0f135b21b225b8c1d26c045d5b581f5d666c7cdf8f43f977eb7a199", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380677, "uuid": "82170ae7-e3f5-4be4-b8d5-7dbf0d20fdee", "comment": "Malware payload (StrelaStealer)", "value": "7060c96dcaf001519e2e81bc808d85e95ef7820b", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380677, "uuid": "afaa79c9-c84b-4404-9ec3-93cef3e05eed", "comment": "Malware payload (StrelaStealer)", "value": "c6a78839e4b563684166e990f8285fe55a564f411e9ad3bcbd600c4cfa187a058430a9cf6f07ebcd88952a9df40eed33", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380677, "uuid": "786208c5-64a5-4dc5-90b9-b3aff78cf4e2", "value": "T129055CF0B6E077D30FB5195D778E41B33D54B863F0AD9D8622890E2F92842598DEBDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380677, "uuid": "95b09bba-1132-4535-bfc2-8719f91ecaca", "value": "12288:QCbxItjm+UBsOg8hhUofPrMNDbcepn8qZitVZGn/4xw+wPzwjMww:Am+CguNfP4nfn8qZfb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380677, "uuid": "ea6918f0-cd0e-4f84-98a0-079d051a2419", "value": 821506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380677, "uuid": "4a8b9365-23ba-400b-91ce-78367160a2c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380677, "uuid": "f7636e26-b0d9-430d-a26c-9ce070e461cc", "value": "PDF28287120615092.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6540d90a-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690386736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386736, "uuid": "fd2b470b-cd19-4842-a868-f712e2d0d61e", "comment": "Malware payload (Amadey)", "value": "fdc49f28fd09960457b60aa6343cb411", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386736, "uuid": "99779d60-8eba-426a-b36d-aaecf5ec7dbb", "comment": "Malware payload (Amadey)", "value": "587e65b428fab372ddc3998373df6a86f1b7ae1c12966a63166dd3bbb0891b93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386736, "uuid": "64e0cc33-0f48-45b9-8e39-463a17057092", "comment": "Malware payload (Amadey)", "value": "fcd38505fe422a63b29d55945a09918a920f400a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386736, "uuid": "71e60158-081c-4dfa-99c7-3d8da14d93ca", "comment": "Malware payload (Amadey)", "value": "531123a304c4470db37f0f48d3dc93267f1f931d747d15a6276ed0fd22a890251785430b923b0e2da1edbe01ceb49397", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386736, "uuid": "42aac890-45bd-4fd1-a421-1fd122330f1a", "value": "T1FA840153E3D84037D8B82BB05DF703C30A367CE199B497AA63466A8F1DB21D0657672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386736, "uuid": "b1e3c4c3-de2e-453d-9f0c-ebe90987ed5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386736, "uuid": "1b31f60f-3db7-4249-a8ca-81573ac2d265", "value": "6144:KAy+bnr+5p0yN90QECY/QbrXBV/qzfzmLRwCmQrEB9VIQpThApa:sMrhy90qbrXBV/qzrYRw7BvI8Apa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386736, "uuid": "10c71e50-cfe1-49ec-bba9-f9c5c83c744c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386736, "uuid": "18ffc033-ac71-4b28-b941-da9a19330709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386736, "uuid": "904591f0-7bf8-4e7a-a47c-b564206710bf", "value": "fdc49f28fd09960457b60aa6343cb411.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f2f567-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690385748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385748, "uuid": "4bfec2f2-b39a-4b60-aaf1-d4ef63e54dce", "comment": "Malware payload (Fabookie)", "value": "ab8153a2a33a0f1dc49d73f8911bb0b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385748, "uuid": "931107c6-8568-40f5-855d-9f1085a4e596", "comment": "Malware payload (Fabookie)", "value": "58aa5bae6252dc48f6bab06664b0cc4e52663b2fbf19cc3d17283322c8e23f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385748, "uuid": "360299d8-7070-48b6-a871-bbcfbaeb8a1d", "comment": "Malware payload (Fabookie)", "value": "4fc8fef6df8baef8669f4758e82ade2a3ef3ee04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385748, "uuid": "83ecd0c0-8289-42ca-a222-ebdaf38948aa", "comment": "Malware payload (Fabookie)", "value": "4d542aff0652e73811e91ec21023de7147c8c4d755b159ac59a013ea9c40cb8449161100a81dd24a5d7084617e3fb639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385748, "uuid": "197045c6-341e-4b32-9898-83bfadc366aa", "value": "T1A4D47C51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385748, "uuid": "3fabda6a-603b-44d0-9280-ea8a77c21b0e", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385748, "uuid": "5b5f36a0-d0b6-4996-8ae1-f29705622dff", "value": "12288:Te79CNmn1yjvZvHTJBxPTXzGPDJcaMuGEPnW:q79imn16FJBxPTjGPSaMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385748, "uuid": "7fc84aa7-9bc9-42be-bcba-0fe69e7e1bf6", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385748, "uuid": "1a7e9267-8647-465a-ba75-4cdc2abeef6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385748, "uuid": "052fdc0f-ea29-421f-bd66-c175d93ff721", "value": "ab8153a2a33a0f1dc49d73f8911bb0b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e75e52-2be8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690398731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398731, "uuid": "533a5f47-86d6-4a53-8c6e-ed99535da8e0", "comment": "Malware payload (Amadey)", "value": "0f48c5af86633f921e293f8dfaeb4ba6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398731, "uuid": "d3170ee5-b865-4ebc-aa63-e2b11025a1f8", "comment": "Malware payload (Amadey)", "value": "58ac39bbc629fc59614b3b5578967a587814d2de70f8a9cba5090cdfbbfb469e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398731, "uuid": "165be9de-e311-4c0c-a462-10af4710cca2", "comment": "Malware payload (Amadey)", "value": "9432c35040d8c06cbce9bf056a7a2db4fdfc5331", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398731, "uuid": "010d5074-2f71-47af-a4fe-bbd0f5797cc5", "comment": "Malware payload (Amadey)", "value": "3321df24a17ba3e6472917bf8775d75e96c5cfd69bd616220a98a5c209782a7a7ebd926fe8c2074f84f7637628ed0f74", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398731, "uuid": "122c0ccb-4959-4ad1-9e25-180702db75ce", "value": "T10474F157B7E84073E9B05B705CF603831B32BDA24D75836B2749A85E0CB26D4A87673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398731, "uuid": "f8e2d343-0abf-44f5-be33-7ca7e62b5594", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398731, "uuid": "a55867ca-b828-49fa-974a-e3e10e5ec1ce", "value": "6144:Kqy+bnr+cp0yN90QE8k1UgFRQpsnz9PUITrnHvOfwz/FYT:iMrMy90CpgFRGspfTjIwz/Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690398731, "uuid": "4636a940-f78a-4335-9dc9-f472b60216d8", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690398731, "uuid": "a374e867-40c9-467b-ab70-200269d087dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398731, "uuid": "dc30c218-819f-4161-acba-1a0a65a439d9", "value": "0f48c5af86633f921e293f8dfaeb4ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7ae36b-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385653, "uuid": "99a73aa2-6247-4ff0-89a3-49119aa08bf6", "comment": "Malware payload", "value": "f8af9db50c4d60d744118c399a6ad1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385653, "uuid": "9c718002-a106-4661-b2d5-cb31b14e4673", "comment": "Malware payload", "value": "5943fa37287eb5085e5be2357f3381cb4ce0d60762bba4394675c1e93d605c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385653, "uuid": "2bacac5f-4bf2-4aba-ad29-739272be7ac5", "comment": "Malware payload", "value": "37b01f8cf746383050065da552baa2e6c0fcdaa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385653, "uuid": "4b35ba12-5862-417c-8142-98f8f0340bc1", "comment": "Malware payload", "value": "3c74af910b45e4794ca2053889b25ca88cf3303faface2348fd1615a77d80d4925092e0eb366d858d1837dd6d1f7d4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385653, "uuid": "f2d6ea85-59de-4cea-a869-c6133e580acf", "value": "T181C4CD00C48CA49EF9F09C3A3EFD0B9CADE6698B961D0FCDD3895037D67A4B97941885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385653, "uuid": "a7bfdf6c-dcac-408d-a50f-adf1c6e0f184", "value": "12288:toCpSqXUvgW6wJDGGzlaN9Z18n8evQsk/lYYjltcBkFpw/m7PHw:toMSQKgW6wlFGe4skdYUt978g/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385653, "uuid": "aac373e6-c677-4477-affe-60e2047e8509", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385653, "uuid": "96381e04-5fc6-48c8-9137-43a8d77aae9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385653, "uuid": "97377a81-8859-41e8-b274-e04e9671231a", "value": "f8af9db50c4d60d744118c399a6ad1bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bb75aa-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408353, "uuid": "b6f8e690-a6db-4d90-9396-0fdb265b327b", "comment": "Malware payload (Amadey)", "value": "674f568312cd04d72fdbde0d68c141d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408353, "uuid": "6639edd6-4b9a-4b0c-bcd3-72acefee869e", "comment": "Malware payload (Amadey)", "value": "5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408353, "uuid": "087d4ce8-22ea-4dac-95d6-6fc9b7935258", "comment": "Malware payload (Amadey)", "value": "feb25de484a1e0340f22dd4dced0b7a2698c5277", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408353, "uuid": "e40efdd8-5949-4a88-933f-b2cf88cab71c", "comment": "Malware payload (Amadey)", "value": "5469663554f542654e4d2c6784a87ffa305ea43780a0b521f1c4dbcebc1b8eb68fbc97e375f7bf532581dca04a6c381b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408353, "uuid": "d172ef8c-ea8c-4d8b-a1b3-5c3a13985be4", "value": "T1B684F103F7E99432D9B517B058F603C30B36BCA29D74866A27856D5F0CB3AD0A57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408353, "uuid": "b21fbfb0-b4ce-4f8d-9b21-50b72e19cd13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408353, "uuid": "9f8acaea-33f8-4bd2-8dcc-989a45eaa082", "value": "12288:JMr5y901c1gCNbRA4eredqAigBYC9K4Jj4qxj:IyecxNbRHTRz04JjP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408353, "uuid": "64517ac6-405c-450a-a2e9-a08e3c6493c7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408353, "uuid": "af92cecf-27b7-4a99-8e39-c00740282ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408353, "uuid": "ad4b542b-953b-40d1-9fa3-1d2425e140eb", "value": "5951daaf249b9db6c83832a3b7a244dffb52f45eb746f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2071e0f-2bb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690375752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375752, "uuid": "faa9a1cc-1580-479a-9ce1-1672e307cecd", "comment": "Malware payload (GCleaner)", "value": "421a20af80276f07fda02ec19cc98608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375752, "uuid": "1d712c5a-6d9a-4ed7-9c90-8f0b0182e1bd", "comment": "Malware payload (GCleaner)", "value": "59eec0291982627f2173cf765b4205736c4f4bea3ad6a5b6995dd83215487c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375752, "uuid": "0f9362fa-d0ec-4c53-b1f8-befd7b10df63", "comment": "Malware payload (GCleaner)", "value": "dca83228c41f2d099553678b80e945e1cc436804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375752, "uuid": "e50fcea5-9799-4fba-82fe-c3ed070f14b9", "comment": "Malware payload (GCleaner)", "value": "84d30039f5feedde08f7cb193ee110a2d6867baba3dfc6e0278ee3ffa8c6df9e9eefe4a1cea5be0284ed6f515a980095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375752, "uuid": "0f2fc475-a61d-4ecc-a727-ae0e2f5c605c", "value": "T1CD4523638696CE39D25259340F35C364E57F3E8598BDA8083CEC6B2D1E770C2E912767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375752, "uuid": "a9579413-27e6-4243-8041-ef980eec4ee7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375752, "uuid": "957fcfd5-fddc-4d55-9448-db0ce42dbba0", "value": "24576:+2lxbmryUfx0fb2ph3S3j9KpNRFUi1ssMh9GxanV:+2Ttb2hvprF3MhMxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375752, "uuid": "807d2f17-386b-4531-a0f8-ef7ccacd9173", "value": 1193247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375752, "uuid": "7bf181d6-e3b1-4467-a261-0035eb36e96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375752, "uuid": "6b206535-8cb2-4ade-b3b2-9561ec603047", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2414420b-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690385768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385768, "uuid": "54d42179-3289-44dd-aa5b-9353367fc85f", "comment": "Malware payload (Stealc)", "value": "d6cf4262e813fd2cf5ceb5740d38ef92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385768, "uuid": "82d9863d-5233-4080-94d7-b95e215e05d9", "comment": "Malware payload (Stealc)", "value": "5a18cd3d6cb8563c29b68b71d892d90945bac08b3e5c79a4597e98b40d7720f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385768, "uuid": "de7be72f-60ae-460a-8ab3-f15a5623b9b0", "comment": "Malware payload (Stealc)", "value": "1cd27cee73aa7a4f6174a0394a6a84e36d06f0bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385768, "uuid": "9c1b8282-54e1-4c85-b874-58a5631eebe3", "comment": "Malware payload (Stealc)", "value": "95acff4f47c720ae8656eb748c4e5b39323d6ad3fbecd4ea53e8b857ead36e019540d0ce719aeb5768ffbaf8f0138e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385768, "uuid": "4c250a96-c122-4253-b0f7-c10664216c2c", "value": "T13544AE123590C032D46369315970C6A21B7BBCE29B7886CB33983F3EAE726D05B75B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385768, "uuid": "fb2c6d67-eecf-488b-b1a2-4fe325fc62cb", "value": "5ea3be81e8b97dd70aa776c5063da42c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385768, "uuid": "eba2f294-d507-4005-95e1-ad37dfa2c6e0", "value": "3072:8IshrTU85g7yxVdvOnXt/4GihBrGE4EVbDwFuPwQ+GIx3TjoRIL:8RIKg7SV5On14GUG/EbEyd+vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385768, "uuid": "43cb149a-61a3-423b-abf9-bc0dfecc58eb", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385768, "uuid": "962b6b25-fa3b-4120-8a2a-06fb8d8b1819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385768, "uuid": "a87fda70-73d2-4048-947d-788af7a21a3a", "value": "d6cf4262e813fd2cf5ceb5740d38ef92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3153c2b3-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690365604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365604, "uuid": "a1a4b4d9-cb6e-4060-88d0-1f91624dca14", "comment": "Malware payload (RemcosRAT)", "value": "44e7e3db3778b24cad055059380b9095", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365604, "uuid": "6889dac3-2882-4dda-a161-fdb52a1cee85", "comment": "Malware payload (RemcosRAT)", "value": "5a75fe1cf3080ebebe25f007556f90488da3fa50f4f0fe40215b7fb9b0403d4a", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365604, "uuid": "c1977761-2aa4-46ba-9a98-c793ad2690a4", "comment": "Malware payload (RemcosRAT)", "value": "7dcfd7394539d89a60fd4f32abff37ee77857b61", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365604, "uuid": "f87a6734-af0f-4bd6-aa71-7ea5b291c4cb", "comment": "Malware payload (RemcosRAT)", "value": "9e51a090de0350bcc576427b1b05924afe0bfd5f1cf4955b1895f2402c9f5b433adb3b79ca47264a022efbac01e853f9", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365604, "uuid": "6a3b75b5-9838-40a4-b633-12f98e6df15d", "value": "T10483CC162C5ADDD2F2BF75081C899184A7D0E7A70FB34864F46BC1F06F62699E2E07B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365604, "uuid": "1c648106-9ed8-4a33-a5f4-eaf41d6c7b6b", "value": "768:fXWKA2peXp5Mx0WUgmQKmGpN7UqwUXiUsHDz0RCw+:PJIjMx0WWpH3jiUsMRCw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365604, "uuid": "e6b4f4f4-13a6-4a73-98d2-3ccb579aec3c", "value": 85618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365604, "uuid": "62823624-6e62-483a-8c5e-4eef6e6ea108", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365604, "uuid": "e68c27ea-6675-4f2e-8ae7-0706efc995c8", "value": "Q and T - 20230609G.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5b6f93-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690365594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365594, "uuid": "e104a932-0952-437f-a34b-c8076879dbea", "comment": "Malware payload (Gafgyt)", "value": "f629021d7743d52ac61ce5e16a66bbdf", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365594, "uuid": "fcea48e9-4859-4b34-a9af-6c3bd581cf56", "comment": "Malware payload (Gafgyt)", "value": "5ab43b9950301b264d92d1a43dbd146b3997e3cbdd91e4ed266e4b196b7b0a7b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365594, "uuid": "af5830c5-4dbf-4ada-b280-b9803140f47e", "comment": "Malware payload (Gafgyt)", "value": "bb58ca02acfb5b91ae4852fa8efe66bf47c6d92e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365594, "uuid": "ae38ebb3-bbef-42a4-9d78-5eaa287e6bcb", "comment": "Malware payload (Gafgyt)", "value": "f305421072cf3118598d2e43dcc5d85716b0200e6ea3cdacb56e61ce18706c7e42a9cd808f0dcf914aacf362992d8d4a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365594, "uuid": "1698c3ea-6364-4178-8ab0-3b8e7bafe48d", "value": "T1A0133913758180FCC89EC2B55A9FA539D937F4381335735A23E4FE627E8AD106F6AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365594, "uuid": "f9e26571-c2d6-4215-a81c-6352c0c2b15b", "value": "768:+Aiqh8pVxoU+6Ykk2TjCKpJYIbAXkoHS43BlZQaJW3NkTuIN+:V/mpjDJ5pJ3Sfy4iahTuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365594, "uuid": "7a002816-4f1d-4a09-86dc-6f3e0e84df67", "value": 43048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365594, "uuid": "39821d1f-6c22-4150-a3d9-a0a285c9563c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365594, "uuid": "3246435f-85a3-45b7-a1a1-5b611156a560", "value": "condi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b463836-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690365647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365647, "uuid": "3938c6ba-bddf-4865-ac0c-902134727917", "comment": "Malware payload", "value": "000acfe327140da35fc4ba06afddfb4f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365647, "uuid": "a8aa3c89-db0f-460a-a016-9fb23e829f94", "comment": "Malware payload", "value": "5ae0b1bc5c8c0eaa93f5e8c5542b7ed6ff7501e315945516187ca02905d631d9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365647, "uuid": "bc89f625-f7f2-491f-91b1-6e8bb456e80a", "comment": "Malware payload", "value": "35693e683a7b01c25edb140222bde93a962718ad", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365647, "uuid": "f55932a8-a2d1-4763-9bba-299766990421", "comment": "Malware payload", "value": "8661340ce0e18d317f1ea6af020f561467796d533d7e0d241c2363149b18852f5508114c2c6773f785fb67dd31248f09", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365647, "uuid": "c7f6948d-2848-47f3-984d-d49ffb622da7", "value": "T146E4230074C6964FD442A2B24EF761DF414EFC219ED9B5D37069BBAE28B9E35E023742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365647, "uuid": "6c484838-ff08-4817-80cc-fff518df25e9", "value": "12288:XvOiRBC6uEkI7mBC6uEkg8VhqUu9VnegXtclplOFOjalkVebmy13pSx+R6kf8:3w6s3w6sbju9VNtcpwzZ13pA+AkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365647, "uuid": "57f9eb84-d2ff-423d-9bbc-9a717e66cd96", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365647, "uuid": "93a3f049-d872-4def-988f-8b722d987ea1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365647, "uuid": "4d8e901f-679a-45fc-8dab-7b842de3de11", "value": "\u0421\u0442\u0430\u0442\u0443\u0441 \u0437\u0430\u043a\u0430\u0437\u043e\u0432 SLB 25.07.23.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043d5a61-2bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690383996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383996, "uuid": "4175f829-3452-4181-98ef-54ee90fb11b8", "comment": "Malware payload", "value": "e0d96c0fdcd06ab07d66a11b57a0c6ce", "object_relation": "md5", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laststage", "colour": "#98CB59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383996, "uuid": "d4c9db24-f03b-48a3-88d0-ef6928b6be8a", "comment": "Malware payload", "value": "5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2", "object_relation": "sha256", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laststage", "colour": "#98CB59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383996, "uuid": "39d9c939-5956-48c1-94ca-a5cb0db6da63", "comment": "Malware payload", "value": "d0d59ce7c7a5845100e05d899c90267a7c97356a", "object_relation": "sha1", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laststage", "colour": "#98CB59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383996, "uuid": "8198df74-1ae0-483c-b9e3-818621554cb9", "comment": "Malware payload", "value": "3f988be8bc7d2e78d04ca15133c35708c1b9bbca203db28953e3b40eec9c3c65f82b9bf4cc40f07e2b935bddb34df558", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laststage", "colour": "#98CB59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383996, "uuid": "2ef0a548-4e68-43b5-bf53-c98017378316", "value": "T1BCA45C36F5C0C477D1754E78CC5BE2D9942DBA606D2898077BE4DF0F8A792823A2B1C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383996, "uuid": "52326b40-56f7-4969-a040-18a1e0c36d27", "value": "fb5ae4b5aa4e7030af93ab337228f91b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383996, "uuid": "91678fd7-1914-43fa-9222-5ffd4231677b", "value": "12288:K4i0blotKmmt1seWzDcjEmXQmrZV0e2xvG6JimJP7RnBqnu3/3em:Kv2onmt1xWzDcAehrZ72xVJV7H+uv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383996, "uuid": "f6fa2654-9b11-4f3d-af30-f6acf441a0dd", "value": 487312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383996, "uuid": "d5e8d34c-0633-4113-8a24-3a45e1b7af6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383996, "uuid": "6ad6cf11-45fd-47f6-9044-b0b15d3fdf4b", "value": "darkgate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06edbd32-2c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690411059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411059, "uuid": "4c53a905-3874-4550-b2b3-89c22c521b00", "comment": "Malware payload (Amadey)", "value": "534b11bbb630f8c25186321ae0f252f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411059, "uuid": "790ada04-9d8d-4e04-b446-bcfece3ae516", "comment": "Malware payload (Amadey)", "value": "5b40b40392ea725fa92bcb37f2a49aaae3a20bcc6b3f6cfd3c35c6c6cb153fea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411059, "uuid": "7d98f28c-e078-499c-a138-57687ca39285", "comment": "Malware payload (Amadey)", "value": "b451aba0a5ccba15c6b2744f4bc4e79e7e0026e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411059, "uuid": "f0a5e947-3470-49da-ae88-e6f63a4d45de", "comment": "Malware payload (Amadey)", "value": "6b3cbf144f8bc3b838314045222669394783b941eed6f78574d65218563c0d168f40a56d1938319ef14e97fe86c6c318", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411059, "uuid": "265bb0f6-4920-41b2-b3bb-4003d7b83759", "value": "T1C7840143A7F99032ED752BB018F612830F3ABC95AD78436B3345A95B0D73684E83576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411059, "uuid": "00a94cbb-91b0-4e83-b291-223b717b1498", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411059, "uuid": "abf6ee8a-7f71-4f88-9887-44dc84a2c19b", "value": "6144:Kcy+bnr+Zp0yN90QEqoJ6OOfkW2nZNWumLsyS1nSEEfgv/17mdE0joUCo9RYPC0X:QMrJy90AIOOmghSESixs3CnPtlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690411059, "uuid": "da6719f5-6116-47f4-a431-377e6b575a54", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690411059, "uuid": "3ee3b01d-a968-4da3-9ff5-5e16866c0457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411059, "uuid": "34faf82c-df8c-426d-821b-13df37236eb4", "value": "5b40b40392ea725fa92bcb37f2a49aaae3a20bcc6b3f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ad5b13-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408042, "uuid": "ffffdee9-c00c-4d28-990c-f6c4237b0305", "comment": "Malware payload (RedLineStealer)", "value": "c2d23a53e4099c1c7126c1e6e332fb12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408042, "uuid": "6a26da86-3a95-48fb-8597-1b14de2c3471", "comment": "Malware payload (RedLineStealer)", "value": "5b49e20d688471002a1cc866e323e32a0e0a2f1e92fd2f057979cd27a850f44b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408042, "uuid": "af522c20-334f-41cc-b445-a225f04305a2", "comment": "Malware payload (RedLineStealer)", "value": "22f111c42bff48f88be368920886195dc990b3fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408042, "uuid": "880c0403-1054-4f8f-9bcc-5f5e9d817d42", "comment": "Malware payload (RedLineStealer)", "value": "32c00fe1a580be11f7bce993db48d221d8158eafb80db369dc3a441863f40c527d78408e3cb6c820260a9fb4882b2487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408042, "uuid": "cb86ee88-ec46-444d-baba-73c570992237", "value": "T140840103ABE99133E5B5177058FB03C31E367CA1987887AA2385695F0CB26D0E57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408042, "uuid": "48774558-9b5e-4fd7-ac37-71f79af55811", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408042, "uuid": "fd764895-390c-43d4-b971-64f711c74e94", "value": "12288:5Mr/y90WOOEnMEY4/7kJByGYpEzPCGDk:myZpEYgO55zaGDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408042, "uuid": "26e0b1b3-e7af-46c3-9b2f-2d1ae05bc17d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408042, "uuid": "c198ab7e-1e61-4efd-ad86-7fbbd9fa9889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408042, "uuid": "e17e81af-e6f8-4c80-90d9-a5c61b8ff4c2", "value": "c2d23a53e4099c1c7126c1e6e332fb12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1090dc59-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408069, "uuid": "e6019f7c-06ae-4467-a333-d08a00e429b3", "comment": "Malware payload (Amadey)", "value": "90a1351efa21b2e57a8c54b5812ce7c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408069, "uuid": "2162baf5-99d1-4dab-aab4-cd6508940228", "comment": "Malware payload (Amadey)", "value": "5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408069, "uuid": "b99faffd-7e0f-422f-8d92-f3717c80e486", "comment": "Malware payload (Amadey)", "value": "2459edd54e8d8413286c252735945d9b894796b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408069, "uuid": "d84187e7-f2a8-4837-b42e-86ce97b3b3f4", "comment": "Malware payload (Amadey)", "value": "b93f34270650bbb06b60e837cee9085e9b85a8e52545036e7501b8c317c5945557c0d3791e11353cce3af249217a46ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408069, "uuid": "b64e04b2-1450-49a9-b9fb-19f0898ced9f", "value": "T11B840213B7D98073DDB11BB158FA02C31B36BCA19D3483572788999A1CB22C5E97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408069, "uuid": "32706173-da1b-4238-9896-3aa441be8f5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408069, "uuid": "b72e10e4-fbb7-4b5b-88c5-da5211ab791c", "value": "6144:Kpy+bnr+xp0yN90QEezQF5w6ZMxThr8t+PDhCI7KEx/wOJAWscFhiiIHYH8:XMrhy90DMx1rxPDhCI7KEZmWdzZrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408069, "uuid": "06faf36a-6859-4cea-ba36-97f3e0a69085", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408069, "uuid": "3c2547e9-c324-4ec3-ad87-e1664bf8ddbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408069, "uuid": "f49394b5-7719-49f7-acb3-746d1f928403", "value": "5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e956.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184c48bd-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356972, "uuid": "4ac8ab3b-bce2-488a-8b23-0a2e282b9d17", "comment": "Malware payload (Amadey)", "value": "fbf093c79741e8a2b20defe68a6764d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356972, "uuid": "cc797097-0c47-40f8-a929-e12fc7ea8815", "comment": "Malware payload (Amadey)", "value": "5c7b063c275697f4d926e840f711d88018315db9000ed454f3ba98537fcbfe91", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356972, "uuid": "974d70cd-a291-4e97-9d70-da8e2674a054", "comment": "Malware payload (Amadey)", "value": "f44283854e58fd4dd0ba7acfa6b6a1f72c4bfdab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356972, "uuid": "02f6ba3a-a3fb-41e2-8231-64f2e8fec83e", "comment": "Malware payload (Amadey)", "value": "13ac219721ce8911c0ddefe2db96f26dcb198524f43f8a6d8af8c0aa90a5cb96462a96e16b61bdafe563b516870d2d59", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356972, "uuid": "97613178-f48a-434c-ac34-69df26f29cb9", "value": "T1E7840117ABE85072D9B51B7054F612D71A3ABCE11D7483AF3B855C9A0C33AC4AA7133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356972, "uuid": "ab5066b1-7a52-4cd0-9a9f-77b0af8582ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356972, "uuid": "1bc2b953-bfef-4999-ae8c-4c62d8c9720e", "value": "12288:QMrvy90kwpkZPWIITwHacG0A0RKBHzeVfX:vyAaUI0w6cK0a0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356972, "uuid": "f319b4c7-8950-4b54-93dc-c4a6386fe62e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356972, "uuid": "b7f3f8f8-9a8f-43cd-a2ff-591e4190df14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356972, "uuid": "2849f575-bf36-4d8b-a149-139f453dc962", "value": "fbf093c79741e8a2b20defe68a6764d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06601d8f-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408052, "uuid": "e26d9ec5-e9b6-468c-a037-189aef126d99", "comment": "Malware payload (Amadey)", "value": "e598775fc37619da44da83d03e5aacae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408052, "uuid": "3972f515-8b38-4e49-b9ce-78d510f0e241", "comment": "Malware payload (Amadey)", "value": "5c80cdcc67d58ba1c2bcbfa41652871a2e9810cef280e782ef5edc4eca752aac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408052, "uuid": "abe56bdf-6048-463d-9e92-51f01f193ba8", "comment": "Malware payload (Amadey)", "value": "91d5612e2855939882508f7183668368ad73a424", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408052, "uuid": "e905c9e7-89d9-402b-943f-225fae15a288", "comment": "Malware payload (Amadey)", "value": "ccd6813041c4093c8cd7f91263c48851bd57bc314d782fee3ca9120e5f8e26155a4b4db52b3fbc75f259a79b343bb22a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408052, "uuid": "558f7b01-5fc0-443c-9191-f9a4d37e685a", "value": "T124840203A7E85033D9B1177458F613830F39FCA09D75836B27859AAA0CB3A95A97173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408052, "uuid": "9176a4ba-6240-467b-a921-c84c03b7126f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408052, "uuid": "96ba64a4-5e5d-4c9e-b8cc-fe344ca12ca7", "value": "12288:0Mrty90GP/KftGEp6ZXeWRG4yTf5tO3vNC:ZyflEp6ZuWRGVaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408052, "uuid": "a48c39d3-502c-4660-95a3-44313374af30", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408052, "uuid": "44918f5f-b6a7-4ef2-93db-ec4ca545b37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408052, "uuid": "62d84e8b-7074-4635-96c8-c74794865e98", "value": "e598775fc37619da44da83d03e5aacae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e85adca-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407743, "uuid": "3f8241e6-f9b2-45eb-b8f1-f8b470bd5bce", "comment": "Malware payload (RedLineStealer)", "value": "7674f3a3dc593ef671ad27906a79bc72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407743, "uuid": "bf4a81e4-4730-41a0-9368-ab1ec77cef04", "comment": "Malware payload (RedLineStealer)", "value": "5ce65049eafe1af54a5fd1c1752c1084d0de8cdc8ed2c81b0cd638c29b9436ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407743, "uuid": "26824d1e-e456-40ba-8425-a33fcc59c815", "comment": "Malware payload (RedLineStealer)", "value": "729182047873e7a648e8391150af4f291f32359c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407743, "uuid": "7be7842d-5417-4cc4-9085-269326c4966c", "comment": "Malware payload (RedLineStealer)", "value": "8ef4d8d9cc5a7184b4940f448b4cf44d623d7015d112c081edd1bb00dc6a55729baeb20de43d7f8dc7e7156771564ea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407743, "uuid": "b4c93103-d21f-461f-a5c1-7a1352c2b2cb", "value": "T19DB41217FBE84031D8F557B068FA02830F367CA19DB8475A57996D8E0C73A84A2357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407743, "uuid": "db2091d7-653d-41a6-9f33-8375c9adf14b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407743, "uuid": "e9809600-94cd-4127-90b0-ef27bae18209", "value": "12288:NMruy90NbPWJzG+/W7mMQkJqBTbWNqQhpOEn6clxooR:HyibJ7JqBTbaphVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407743, "uuid": "99c9446a-8275-40ce-b0c2-d07b57467d56", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407743, "uuid": "699864a6-d662-4316-8dd8-8fc9b9a62720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407743, "uuid": "21386aff-3d3a-49b3-b439-2541c9364e75", "value": "7674f3a3dc593ef671ad27906a79bc72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33d7e04-2ba3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690369285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369285, "uuid": "564edb64-13ae-4603-b408-65c19a5c1c3c", "comment": "Malware payload (RedLineStealer)", "value": "3b7c6dc70d05d9cbecc9b9638c72179b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369285, "uuid": "92aa8415-bc5f-4f4d-8d58-cef9350507a5", "comment": "Malware payload (RedLineStealer)", "value": "5d09e9e394586ef03efb7b30c220c654bb0779b6415bda6eed955611680762cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369285, "uuid": "e342f5df-7a51-41c8-bea9-1b4d48b93cd6", "comment": "Malware payload (RedLineStealer)", "value": "8da690051c10cefc18bb015d70844e8bb3110381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369285, "uuid": "3b9d7576-02a3-4cdd-9e16-dd631930a28d", "comment": "Malware payload (RedLineStealer)", "value": "da7c3d96d8495e3fdf03525a00e7af723169d3f6f62bc645bb7f5b7b4cf9b989e34d7ac658e8fdc5371ad42a737b76bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369285, "uuid": "5f325356-af2a-44b3-a4c8-6e56a3fab597", "value": "T149F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369285, "uuid": "8f15da60-90af-4085-950c-e18eab064211", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369285, "uuid": "7a6e4696-fd19-4d7b-9c61-4f3bb9b502b3", "value": 34750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369285, "uuid": "c212c8ff-1294-42f6-99fe-d290547ba58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369285, "uuid": "54b4465f-34f8-4a7d-9528-2b14048949aa", "value": "3b7c6dc70d05d9cbecc9b9638c72179b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8084ffed-2b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690342973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342973, "uuid": "9625259b-c589-46bb-a3d9-12ebd3bd500a", "comment": "Malware payload (RemcosRAT)", "value": "3cb728d677770e263fda3a64aaacd4e2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342973, "uuid": "a443682f-910c-412d-8da2-4f418bbc581e", "comment": "Malware payload (RemcosRAT)", "value": "5d7c8615bb6de60921617077b76af65c8b003463822d2a56f1c01f2094ab2eff", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342973, "uuid": "d11008ea-ea77-4064-a008-233534ce1ae2", "comment": "Malware payload (RemcosRAT)", "value": "18594898bec0b1ba6de62d258d2128e31c6dd9fa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342973, "uuid": "7638f8c6-2f04-43a2-8807-e7f5cca9cd13", "comment": "Malware payload (RemcosRAT)", "value": "0c50536b65ea4e5375ceee6d7f21216a3a5136f25a5927d9863c5a98dba679bd905d69dcffb5472a1cbb9d80dbead112", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342973, "uuid": "20a88975-8d41-4a16-9935-6bf42b68a25b", "value": "T1DCC423C82CB9F50E0F74A71D34AE39585AD37FEAAD48686364A0218B3CDE1377447678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342973, "uuid": "b7eb8cc0-b3a0-43dc-928e-fd750f8fed1d", "value": "12288:aBZFoGMo1n8TH3q2FzZCniZNjAnqX79aA4SVc7ZQ1lrUBdB3YarAyLSp:aBboGM4n862FiibGqXRaABVcF+4Bd/ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690342973, "uuid": "1a5220d8-63f3-4742-b5cd-1501caeded73", "value": 597190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690342973, "uuid": "79868f65-d425-492c-a05d-a140b37f63d5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342973, "uuid": "51876f1e-866d-4828-b3be-12eb6fe19f93", "value": "3CB728D677770E263FDA3A64AAACD4E2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25839a8-2bb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690375296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375296, "uuid": "a8ca7caf-994e-46a4-b5c0-8d6f6c3b15ae", "comment": "Malware payload (Amadey)", "value": "f532fb2eb5b30f18c37e7a344e5ed7f5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375296, "uuid": "74df5638-59e6-4ccc-95f7-ae687c9cbb9d", "comment": "Malware payload (Amadey)", "value": "5daea8830b5fd8f3902061a5ebe366f9b313ec1eeca2af1a497573f1043818b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375296, "uuid": "55dc40d1-3c1b-4f68-8181-183fa17bbac9", "comment": "Malware payload (Amadey)", "value": "962e7f5d8e4749d019e690265cc92b4bc54dcfec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375296, "uuid": "e75e0411-cda5-43c0-b597-9a7d769f53a0", "comment": "Malware payload (Amadey)", "value": "44ebf664e615ef0f407cab6cd234400435f8fdfafb677f052b90046d7a06bc810258e8579eb464a72fd354161b0d2c50", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375296, "uuid": "b7ea0d59-ffca-437a-8103-3d911896ad00", "value": "T12C74B78383A1BD44E9254B729E2FCAF8760DF6518F4D7B66A138AF2F00B55B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375296, "uuid": "2d531fc0-8c5a-4bac-97a5-73d40e4f2ffc", "value": "23b1f12acfdc16a0095d4f2599c53eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375296, "uuid": "3e5a187f-77f0-4635-9d35-3be5f9fe2d50", "value": "3072:kBO9PsFtLggyFmBN7xcyJyjuGGF41NuNzo1D59yPx5g91RgwlGvPGT1lTU0:SOWFtLggMmfxcBVuNzIus97gjv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375296, "uuid": "273e65df-7cd4-47c0-a9c0-08076d51537b", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375296, "uuid": "5fbbb5c4-1abb-4475-83f0-62eb48056b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375296, "uuid": "d4476751-7e8a-4717-9940-342de0e5103a", "value": "f532fb2eb5b30f18c37e7a344e5ed7f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b1b3a6-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690377828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377828, "uuid": "a1e2f637-4564-41aa-890e-e4b291d2d765", "comment": "Malware payload (AgentTesla)", "value": "d89f1f6e5a9fca34199a89a50ce03903", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377828, "uuid": "0336d5f6-f373-4251-a2cc-b428d97fe6e1", "comment": "Malware payload (AgentTesla)", "value": "5dd81b46f9b2a310868ab2b1ea4d61619ab039d8d19e8abff4a559930be4fe19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377828, "uuid": "fb1a5765-9b7c-4c05-b810-a41e895d067a", "comment": "Malware payload (AgentTesla)", "value": "113b4dcaa72bdd9af7fc25fe1de1dcf41aef59db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377828, "uuid": "e700974c-9a96-4572-802b-807eff9a4daa", "comment": "Malware payload (AgentTesla)", "value": "19eaa0f687a7fcc2700784e8f7f161bdeccc6253b6a043d35296debc01b008de6d129f60678bd227aa0f2a6252e0441e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377828, "uuid": "55bad3fd-2f50-4671-92fb-9c0b36de02fd", "value": "T113033FAC726031DFC867D472CE994D74EA6078BB831B4217A06726AEDE5D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377828, "uuid": "9f4497d1-b7cb-4f69-8d12-8594cb37a6b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377828, "uuid": "458483d9-c882-4807-b5b8-9e15a59e7da7", "value": "384:/yt0tE/iKqMQ5EU/7eLLUni0+QN8U8WNQFCkEG3lFonnUd6WUhEYDLYbjmjI:/o/jqnEUDeLIiKq1VFIz2yjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377828, "uuid": "3ddb5674-e203-442a-b69e-c1c0e540d323", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377828, "uuid": "4eda0e05-9091-40e5-a6b8-d032b9156d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377828, "uuid": "74489de9-2a0f-4871-913d-7dabc7b5d4cd", "value": "Gelen Para Transferi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175d6213-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408080, "uuid": "c4821e10-2638-4142-8783-2b8fe9a85ff6", "comment": "Malware payload (Amadey)", "value": "3dee56ba521e96a95794f221e916bd10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408080, "uuid": "2baf4eb5-13fd-4079-ba99-890620ebf98c", "comment": "Malware payload (Amadey)", "value": "5e5f4b95850a30136ca278ff32ed5599ad86c43fe4430cba70e2f3f6b2a565ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408080, "uuid": "275bb25f-3431-48f4-bb09-4622cb165488", "comment": "Malware payload (Amadey)", "value": "900b3f33baba830d3fc02d13f4ca29a28e787bdd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408080, "uuid": "df6794fe-2ebc-4397-b003-0ab2e73403d1", "comment": "Malware payload (Amadey)", "value": "68c7ca8a78d34fe1d8daeef1093b07fb2f78d7a7fd7efe629324e779a4909dadbd137e67f3e2139bd982643c72c20fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408080, "uuid": "6af9b2cf-967b-41b2-a9f9-d396a4c2a42a", "value": "T156840102A7E85473D9B607705CFA07D30B3A7CA1AA78937B1386688E0D736C4687577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408080, "uuid": "4717d0af-0983-4358-a5c9-71513897e397", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408080, "uuid": "c5826c17-a53b-48d3-b86c-8db758edfc75", "value": "6144:Ksy+bnr+7p0yN90QEt40OGz1yRlXOg6iu9PnHhHLsbYEud:QMrvy90fTzpvNhH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408080, "uuid": "afc501b8-f154-4b23-beaa-f3b95f71c7af", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408080, "uuid": "43ab86b8-4342-459e-ba1d-1a4039868108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408080, "uuid": "4f4d09e9-1766-4bc7-b8f3-dc2b440acb62", "value": "5e5f4b95850a30136ca278ff32ed5599ad86c43fe4430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863ccfb2-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385074, "uuid": "1d3bf31f-ab68-4985-913b-634136ad17dc", "comment": "Malware payload", "value": "a3d55dea07b83b3fad6f9444941a99a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385074, "uuid": "9ee58d33-8b8a-4171-a560-2b0fb72c069c", "comment": "Malware payload", "value": "5e6c05f47399616a63798cb40df75b90912f3dffa84b310ee26db960fc62522f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385074, "uuid": "7bb2329c-6095-4f45-aa20-dd0ee29f6711", "comment": "Malware payload", "value": "1475962413b6a1272b828d7f29a6a7ceafd087ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385074, "uuid": "00009267-b58a-47f4-9ef2-de055c36c5c6", "comment": "Malware payload", "value": "f5164c4f3877bb9127a136e92c110b63a8e022e26f6cede85d272d390a014f3359bf4ce0ea4ab06f66ca0bf0bd3b27a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385074, "uuid": "8f45a9c2-5748-4805-b9d9-83aac9c70a4f", "value": "T182061846E7D111A9D0378174D6693366F93AB1DC1B288BC3AFB9844F43DAED46AF9300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385074, "uuid": "86608b73-93f2-4b17-9d7f-ef4e67eb2990", "value": "fe1147df2ee30051a844565381a6e079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385074, "uuid": "cee615d5-9b83-40a7-ad87-2beabfca7a67", "value": "24576:rBgras1tXpG+imFFYsGw3MLsI1ZNIHrAcEmGBKJEc8X45wi35fzLRGSzMHjwomBt:r+rPpG+7Ys4TaAjmU1It9nY59qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385074, "uuid": "e30ab164-fbe0-4506-b621-5b7448b7ba0b", "value": 3695744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385074, "uuid": "5f5917f7-bc1b-4776-a78f-85e0188c3c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385074, "uuid": "ac9dd8d6-c7c5-41fe-9729-0878428e9517", "value": "a3d55dea07b83b3fad6f9444941a99a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a943364e-2ba8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690371388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371388, "uuid": "2345dfb1-0886-45e9-8450-75e5e49d688a", "comment": "Malware payload (Amadey)", "value": "dd64d0bc1378b43f8b5b17327b4994cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371388, "uuid": "5b34095f-c35f-476c-9972-33c066b28312", "comment": "Malware payload (Amadey)", "value": "5ef552b6bb693a4a1fd4080dde4a0b15f3e16ed38100206f010af28ea94212b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371388, "uuid": "25bdcce0-713e-4d21-ab92-254266325211", "comment": "Malware payload (Amadey)", "value": "a58efecc35cedbeefff5c553e8b4eda92fbb0ade", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371388, "uuid": "a540fd91-a521-41a2-9029-0885b0b34ea0", "comment": "Malware payload (Amadey)", "value": "ffadff133cb1ab915d88845248af74bce55c78451b80c4a8623bd2f5a3eb74ab752fb9c2fc0a333bd89e05e9f66198b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371388, "uuid": "8313cfbf-e8a6-403c-89b0-71d197d07ded", "value": "T1F6840112A7DAD072D8B11FB098FB02930A357CF66C7D932A2745A55A1CB27D4E53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371388, "uuid": "81682f71-9a42-4d15-afb1-0bdd4ffb25f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371388, "uuid": "3a01d448-ca0d-4b47-b238-50cc163e5260", "value": "6144:KCy+bnr+Fp0yN90QEKnhAY8Nye+XTYcWEmfygBZ+t46DpltOYexlze:SMrRy90oiYayxXBWugBYC6Dexde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371388, "uuid": "f68cd24c-2fcd-4746-b975-f86a21d242ea", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371388, "uuid": "6edaf564-c52e-4b74-aab1-3b063240c1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371388, "uuid": "0196d7a5-eaf7-4eac-b877-ebbf1efabe19", "value": "5ef552b6bb693a4a1fd4080dde4a0b15f3e16ed381002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bcb809-2b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690360566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360566, "uuid": "7aca6105-44f6-4431-a6fd-d736017bd6ee", "comment": "Malware payload (RedLineStealer)", "value": "4f9eae8163eb74ea6341d26715141926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360566, "uuid": "9656f3f9-7443-4681-8674-2247ce91ec02", "comment": "Malware payload (RedLineStealer)", "value": "5f5f56b07b7fb522a28191a45d5417cb336b942b5e5940b7f13f9b52e65b67d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360566, "uuid": "a68bb952-a563-4ce8-85ce-a76f9f2e2628", "comment": "Malware payload (RedLineStealer)", "value": "3a87d2a8eb9fe8062e71c396ecef8389b312a363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360566, "uuid": "d2a51bfd-258f-4b25-99be-5dc0200994eb", "comment": "Malware payload (RedLineStealer)", "value": "5e342b3236bc520850106d6158ad648b084f203b266b9d6c90993d2222060d748ad00b09f9ba9fd2b88637716af70cd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360566, "uuid": "eb6c2df3-9235-4d71-bc02-4fdb65e498ef", "value": "T115840203A7ED4033E8B41BB159F207D30A3A7DA29D7C836F2386995D0DB26D4657272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360566, "uuid": "52bbbeb4-5445-4c67-becc-9afadabd83b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360566, "uuid": "7999362d-bd0b-49c1-92c3-e39d9159e4bd", "value": "6144:Kwy+bnr+Cp0yN90QEFpI2AAVaL2vvKahFDi2YYLYOLGAgBZ+t40DB09SJRztwP:wMrWy90xIsYSNhbYYUWZgBYC0CSPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360566, "uuid": "6e3b023b-9570-4589-abf4-1bc516069234", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360566, "uuid": "ae64fad0-3b4a-404d-954c-97ed2f642e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360566, "uuid": "99544320-4e12-4ae1-94ec-d78be32b2090", "value": "4f9eae8163eb74ea6341d26715141926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eddeb6-2bb4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690376621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376621, "uuid": "c72d5bf0-fb8a-482f-bdf9-3a6df3a8d607", "comment": "Malware payload (Loki)", "value": "e12c3e76b3483c20ff27864e8f1a54c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376621, "uuid": "e51bf105-dc29-4818-adcf-6bd75d699607", "comment": "Malware payload (Loki)", "value": "5fa291124c627e04434ee0e99b4509d3e4bc2c6796661458aee6a7b9065119ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376621, "uuid": "e95646c3-3805-4a74-a4db-cb5c900e8d05", "comment": "Malware payload (Loki)", "value": "e17834fd789ba9cabd99cd84d367e380177a71b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376621, "uuid": "1884d693-81de-49d1-90df-d8d709d5b2d5", "comment": "Malware payload (Loki)", "value": "b91a7f673017da21037b381dd8dae6c623f231f57db6f3db32833d3f8c2e266b31637d8dbe15673be2f3cf62445b39fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376621, "uuid": "6d74afe7-baf3-4af4-b249-f2cb372d8d34", "value": "T1B7E302112794C0BBE8D213B11E7B566F2AF7FC024968861F17706F5B3962683E61E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376621, "uuid": "730f0b5e-d26a-4dcb-9b24-bbf9ac00db6b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376621, "uuid": "7e0f650d-f4c0-4beb-8f44-e48590a0cd29", "value": "3072:XfY/TU9fE9PEtuXodb/srEXRLK04Cj8ng3H8DtpuBKSIq64RcI84Lct/UI:PYa6Cl4JgkXuTI8RcI6t/UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376621, "uuid": "65802fd4-b738-4956-b5b8-06a59122ca53", "value": 151335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376621, "uuid": "2242a83c-0f49-4edc-8e05-8db0e96a85fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376621, "uuid": "eb0e809c-8480-47c1-9524-1e8d6620ee5c", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003aaae3-2b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690353925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353925, "uuid": "e242d55f-a344-42e6-9a0e-3d7245c56983", "comment": "Malware payload (RedLineStealer)", "value": "78f22849c3ce939bd4beb2216f049ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353925, "uuid": "9e4caac0-ea83-40c4-bdaa-b896accd4c53", "comment": "Malware payload (RedLineStealer)", "value": "5fdcc133a36a24d2b315190f395c4be383eded2b6280376530e01c84469c2f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353925, "uuid": "fdcae77b-fd92-4c3e-ba68-291f28089df1", "comment": "Malware payload (RedLineStealer)", "value": "203c03a7cd7a01941d6a1c59182fcb1a62661041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690353925, "uuid": "e84515ab-8860-4eb9-96bc-dabbd0f42dbc", "comment": "Malware payload (RedLineStealer)", "value": "97ef5f190c0206949a183c07265d5340e905523fb3653ed7578252d89d43543d3f1d202f9bc1fcec81924eb7219c4085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353925, "uuid": "e32d5781-526d-495d-ad1e-36c9db11e108", "value": "T10EE22A187BDE6236C7A8697DC5F7518403B862FB2703D70A6ECD22980C43BED6916F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353925, "uuid": "93dceee2-881e-49bd-a8ef-4e16288de9c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353925, "uuid": "79ad1635-470a-4437-b46b-401172fd0134", "value": "768:hArX29GPoAiBxm5rW7CKGAJzpNj+AOe0l:hqX4GPoDs5rUGA1jZOhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690353925, "uuid": "8b19e542-551a-4c7f-af4a-6d26f04dabbb", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690353925, "uuid": "6f396f6d-fa21-472c-b31d-5fba94a1e306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690353925, "uuid": "7a2a8dde-4e4f-468e-8a1c-3e2a2f4958c9", "value": "78f22849c3ce939bd4beb2216f049ca9.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174228af-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690365560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365560, "uuid": "b25813fe-479c-4eaf-bd75-ebfe68510e5e", "comment": "Malware payload (AgentTesla)", "value": "20312403971c1cce8736ec420b2fa8e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365560, "uuid": "70338ac7-1cde-4910-b963-ba4be912196f", "comment": "Malware payload (AgentTesla)", "value": "60035c20c6889c26178deeba950e22da4224795ad96f4d3f3eea3ad77f031c85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365560, "uuid": "f2402466-0db9-4a34-927d-4f00c28e45f7", "comment": "Malware payload (AgentTesla)", "value": "0c4e4dff9fb3beb98e53e5d87b5aeaaa93d22797", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365560, "uuid": "bc108b5a-fcae-4ae5-9294-a9493f0e2872", "comment": "Malware payload (AgentTesla)", "value": "4c84901797084b1d3bc27eccae92a2ef416bb06ff82347a039e5f2d041f55a1abe713cb33a5d2699d33c3cbedc2fc484", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365560, "uuid": "10481d7a-5f17-46cb-bddf-72fca5bc3e93", "value": "T12D0341DC722032DFC867D0728E995D74AA6078BF831B4217A06725AEEA5D997CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365560, "uuid": "8e433758-4eed-4e46-9a64-1a22bd0d3276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365560, "uuid": "00a56539-819c-46b8-b576-651a5b8fd1a6", "value": "384:SWtiyRTtmhxZ/RvD2eylDO2w9arRlSN8U8WnDp3a47PxZ0hEYzLYbjmjI:7NxArJvD2ey42w9auDH730GyjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365560, "uuid": "c1ef329f-3bc3-463d-a80e-3d362b13f0b2", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365560, "uuid": "ad489d60-1cb6-46af-972c-41e8c6182a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365560, "uuid": "e39705e1-ba69-4ece-89d4-2c58b4d143ad", "value": "dhl 6833295033_AWB_23199_2026-07-23 (21).Xlsx 6833295033_NPG_0235200266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f39f04-2ba1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690368266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368266, "uuid": "2317681c-ea63-4d5a-90f6-2a439ba3916e", "comment": "Malware payload (Mirai)", "value": "28c8ce053b8c0bf87ced4947daa0a7ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368266, "uuid": "edf99a30-ddff-450c-95e1-662bc9d20374", "comment": "Malware payload (Mirai)", "value": "601264fc10df0f936d37fc3319f12050a0dbb9a01cdd0f58753fd60a067a4e48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368266, "uuid": "38c07349-56ff-4abc-853e-1591bd8c48c8", "comment": "Malware payload (Mirai)", "value": "87e3e1dd4c6678582368c793c7982b605dfa0413", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368266, "uuid": "64769ee5-9f0d-406b-9bf7-ce6f57a6b1b1", "comment": "Malware payload (Mirai)", "value": "5cd9957f6e87af57e2b2944890e0d0235afb22dc5c9a1fc19c01fb8e78b9ae413e1d602127e371b85ee6dce3aea11bed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368266, "uuid": "9e223c0f-c632-458c-8e0f-45edbeae8fd6", "value": "T1C2336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368266, "uuid": "ef66a8f7-7060-42ba-91d8-2f85aa76f61e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368266, "uuid": "647829b7-8677-4311-8675-c78c65258323", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368266, "uuid": "609cd7d5-fab2-4148-a077-b73e1bd5bd98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368266, "uuid": "99dd7321-fdca-4bb7-b75b-d0bbea69c910", "value": "28c8ce053b8c0bf87ced4947daa0a7ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b2bb9c-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690356300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356300, "uuid": "6b19db1d-8392-49e8-a14e-0fc7493cd2d4", "comment": "Malware payload (RemcosRAT)", "value": "86984510bcb877b4f0a01fc0bb9641af", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356300, "uuid": "93547e0a-8e46-44fb-8b11-fece5b832ea5", "comment": "Malware payload (RemcosRAT)", "value": "60871c0baf919256971f8e03a23a9879dd5febefe3f70a19b2086004b7c32d33", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356300, "uuid": "28c45727-02e7-475d-adb9-ff5201b5a01f", "comment": "Malware payload (RemcosRAT)", "value": "4b646d426a2e34b9df8bcf471bba6fa6d0e862c0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356300, "uuid": "8be3a3c3-b1f7-4465-adc1-8ed411f308a3", "comment": "Malware payload (RemcosRAT)", "value": "61690cc30439e759c9a1faf88c3ed8f3c8655f9e1d1875f9bcf5de9af23a346009e384ccf14346bf7f71644f16c270ee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356300, "uuid": "3dc66124-2b27-4338-b686-038992bdee48", "value": "T1A875F103A8059F87C41E83F47E7329D90F0A6F09E99969DF14123F9B3A32B62595B34D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356300, "uuid": "50f7d22f-eca9-49eb-900c-2626beb0baf0", "value": "24576:Y4u9VNZylw6VZOZydw6VqViNhuuvvtZ3oqVUbXQwNgZffsLMy5w3xq:Y4uPR6VZYV6VCiNhv3t9MXXNhLr5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356300, "uuid": "f2af6b33-fe94-417c-8ff7-b6f9ead567ca", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356300, "uuid": "b04f3dcf-8251-48dc-9750-2c00036321f2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356300, "uuid": "a69dc385-1e0d-45e2-b682-ae68f042623c", "value": "ORDER-CDC 1500010.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53cb949-2bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690374093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374093, "uuid": "7f440b5c-0228-4277-bf7b-db30cfb98b69", "comment": "Malware payload (RedLineStealer)", "value": "621cd6167fd30d3fc216c453ec0c6867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374093, "uuid": "d82b4c19-f0cf-4839-ac73-a72780438185", "comment": "Malware payload (RedLineStealer)", "value": "60a0c0cffe39eee70251f5da0f2016b1a97d4e6536bf7739cbd9490757446236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374093, "uuid": "09319123-aeb0-4e97-989e-08f3fd33d226", "comment": "Malware payload (RedLineStealer)", "value": "2082fa4f6788c64c5f57651400697b14fd8eb77e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374093, "uuid": "b3c3883a-9d82-426e-8df8-9704418b6a14", "comment": "Malware payload (RedLineStealer)", "value": "93693b90bdf06eae02ac9b97d47ed0a8482f02ce5f70d6ecd9ff184a69ecf244833053405f214f611b546495b4899268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374093, "uuid": "2926ea66-81f4-4bd7-8b1b-4b5fda4d1818", "value": "T1EE84F146E3D99033D97917B058F606D30F3ABD62DD6883633345A95A0DB3680EA3673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374093, "uuid": "926bbdb0-f686-4161-a0b1-f20e8d3d8011", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374093, "uuid": "d0811a29-1e7a-4e68-a80b-7db71b1cfc9a", "value": "12288:fMrRy90lVpukRq1vgB8Acl+cpcgQnpxNQ7:eyyukRaLAclYgQ7NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374093, "uuid": "f5bca75a-1046-4b9e-b0ae-de076d72d6bf", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374093, "uuid": "dc22d2a1-98dc-402f-99c2-52cf621ab765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374093, "uuid": "a40b013f-6b43-48e5-b952-5ae6628c3a87", "value": "621cd6167fd30d3fc216c453ec0c6867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da85c039-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690376196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376196, "uuid": "056dfd5c-5499-4612-a471-6f15ed5dc450", "comment": "Malware payload (RedLineStealer)", "value": "0476a1ce759c7ebb3a07670a93af7c97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376196, "uuid": "5517b07f-595a-4e72-a0af-a8fdf223af77", "comment": "Malware payload (RedLineStealer)", "value": "60e7e1ac00410438a148bcba6a92dbac02c94531491c577d988a49e9c281cf07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376196, "uuid": "8444d173-e3b4-4675-aa24-a053e3c09391", "comment": "Malware payload (RedLineStealer)", "value": "8d7604fd59d976b0a700dc5b824c19a4953e25a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376196, "uuid": "8e0c4c7b-ad6f-477b-8465-34fcbc8da7dc", "comment": "Malware payload (RedLineStealer)", "value": "6bcc753d3693a4f810c19f1e6a6b5ab0d40085c5a917a33f583a506f6b851998443d3f183a75585f53b074b55d5ced50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376196, "uuid": "75318d36-9b03-480e-9c59-568e766ebda1", "value": "T1A6840143EBE88077D9F51B3058FA03931B35BD915D78C36B2789591A1CB26C0A83677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376196, "uuid": "0ca46caf-1631-4a3e-b005-71824d0064a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376196, "uuid": "190ce0ab-e4ab-45c3-8c46-1bd42ad9da3a", "value": "12288:RMrfy90WeNjuicYFuPmhdMc5MiQp8j7e:mybeNVcYQOLMDce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376196, "uuid": "4b942b59-e640-4cc8-ab27-f7cea530c449", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376196, "uuid": "a4a52867-aeaf-4950-811c-bb9996de5317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376196, "uuid": "ce8434ac-959e-4f71-b88b-b37acef2172e", "value": "0476a1ce759c7ebb3a07670a93af7c97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f85b160-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690376794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376794, "uuid": "4242ace5-68cb-4a16-8829-05614271d2e1", "comment": "Malware payload (AveMariaRAT)", "value": "4ff1f2169fbe591daa8769de2b00dfa5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376794, "uuid": "8ad21d9f-084d-4467-82b8-d473de8a6c5c", "comment": "Malware payload (AveMariaRAT)", "value": "611b04b84657ad8fc5c4c61f7534b9e8e5ed714708600cf6b5eb384119b142bd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376794, "uuid": "dc367b96-d346-4629-a385-5878f26152dc", "comment": "Malware payload (AveMariaRAT)", "value": "eddea06cc3f5e192b4013d8e14a430cd7fcb4aa5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376794, "uuid": "758d3689-0434-474a-a76f-f754af86b25e", "comment": "Malware payload (AveMariaRAT)", "value": "155d5f960355b937820da66eb1f66811bc5893108dbe962b8e25093c9cda6bc1959d4d71906aa7317a7622db5b810521", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376794, "uuid": "bc55cc25-1ef4-42aa-ba3a-de43b46c8951", "value": "T15B14025A53DC607ACA3E13711DF36E4B5B3065A3D916DA2BB0DE4026BF13A12F6421E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376794, "uuid": "eb48ea7a-aafb-4ecf-82c5-9f6689aecae3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376794, "uuid": "154eb4bc-8d33-4117-8b5c-350e3e45aa05", "value": "3072:keOLRveLpmUPgXFIB3AkugT30rHNyihIzVIJxeto:NOLRvUzu5klT30rcfSJ4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376794, "uuid": "1ae57708-3abd-4fda-9558-3ff4ebd5ab54", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376794, "uuid": "0f2e6b02-1cca-4600-9dd5-a4af08d1aee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376794, "uuid": "040059e1-65b4-49bf-8a80-99690d0d8c3f", "value": "Ref PO-ADH_561002682-QTY73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49c11e-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408065, "uuid": "64a6e63d-2748-48b8-8760-3c4d96d9d777", "comment": "Malware payload (Amadey)", "value": "1602d64d0a81f84e8fbf24150b9e5cc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408065, "uuid": "dbd5dffb-02d7-4887-9dae-748f36c796fb", "comment": "Malware payload (Amadey)", "value": "611b640fd7c9e06cb4ffde1db21b1f9ace29ac4c504fc14569faf426b234ec5e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408065, "uuid": "013589eb-6e88-4a9d-8bfe-fb7368e124ec", "comment": "Malware payload (Amadey)", "value": "ec4e0320a3700cacb7f21891710c7bc83b2f9ae5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408065, "uuid": "eed2003f-45df-4817-89a9-c0ff8ac06af8", "comment": "Malware payload (Amadey)", "value": "b9b0e1a94859edb888acb13d452dcc42772404fcd2c729bedf44ca6d926bebadf28f7374676b1db5b5f66b9d930c17a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408065, "uuid": "1720c6a6-ac2e-4fb0-bcff-9b2ad18c6c8c", "value": "T13C840213F7E49032DC7567B058FA01830E32BCA6ACB8D36B2745A9591DB39D0E57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408065, "uuid": "826bc8cf-060c-4ec2-a50a-b5e683a128a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408065, "uuid": "a9741d04-01ed-4df2-ac7c-97595cb66e2e", "value": "6144:KRy+bnr+Jp0yN90QEda+mxeyHanMZ+gpv9LBQIhcgBZ+t4ED2RcbuvhPcfY1UT:fMrVy90VmAy6nST3LBQIGgBYCEarZsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408065, "uuid": "7cfc703e-9c1a-4682-ba09-d120fd5f8468", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408065, "uuid": "55b2a2b8-012c-4cf0-8eb7-438e59f10b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408065, "uuid": "3d190445-d677-497f-bbcf-d4430d9f8527", "value": "611b640fd7c9e06cb4ffde1db21b1f9ace29ac4c504fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1561966a-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385314, "uuid": "83a10418-c62e-43ff-bca7-794de73047e3", "comment": "Malware payload", "value": "1da0ad74a7eb5324fd6846b3e4b6c535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385314, "uuid": "4c51bb5e-4095-46bc-a2d1-3fae5c3a69d2", "comment": "Malware payload", "value": "61cd040366ea4116433848a0fab8e737da6e7e1f32f14176724bf8a5af49e3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385314, "uuid": "7e9800fe-d360-4889-9f3d-0a1586b4d12e", "comment": "Malware payload", "value": "883c17e292e30fa34204e10df499175c041e0be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385314, "uuid": "4d3679a6-5bf7-4a91-943a-18d228fa7684", "comment": "Malware payload", "value": "5211829848b3cbf1e518fd79025b8b8d5bfea0e9c6b05f6b623c06dbf059983a3e8cc720dee532cc7927abc3befad05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385314, "uuid": "d1a20d52-8f47-4959-a808-7d169ab08a66", "value": "T19D84124122A0A8BBFAF44731CE72EF379FE7CE2958B5640A5B26B5453E335A3001E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385314, "uuid": "a3977dbe-de80-402e-9d5c-4b8ea66e2f62", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385314, "uuid": "b772f116-6fda-4cf6-9af0-3e3b90027728", "value": "6144:Bp0guF5p4b7XfnHRTQum26BtcwNmrPO3PhxRF1lWT7iLeaPKaCs8UHk3:IguzSPfxTRwNk23ZzFnWT7iLFix/Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385314, "uuid": "6f62bfbb-7ced-422f-b1b4-673d6b4fb628", "value": 374720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385314, "uuid": "9ac94b82-27c8-41d2-8fd5-f06d1041787a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385314, "uuid": "139fff3a-8548-4a62-bcbb-bdd1bcaed83c", "value": "Payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ee7eb1-2b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690347918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347918, "uuid": "c442685a-dac1-47fa-8e46-6606015d0595", "comment": "Malware payload (AgentTesla)", "value": "77c072639069ee92d0b532c75e52a2c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347918, "uuid": "d6055912-b6b4-4dea-8612-706a98052fae", "comment": "Malware payload (AgentTesla)", "value": "61e393b46867ae6a3123d18fe655a79b72a9ca620172b1296f73c8039cb6ae27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347918, "uuid": "2d8ad756-fa7d-499a-8761-2fa6622a7f4b", "comment": "Malware payload (AgentTesla)", "value": "24b4086acadda429d8823f3044b2bc0ffc1393c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347918, "uuid": "68c328b7-a443-4752-aeb0-4b28b896e19b", "comment": "Malware payload (AgentTesla)", "value": "328b9360be27eb1b1afcffe7e27c1d7a2c0facfc6b2567adddaeca42bb7b3b2cbdea1bbe8e6b5a179ce3ae37e81ec4b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347918, "uuid": "bf221a21-7ed5-4239-8e65-833b8d742f38", "value": "T102F4BE22634AEB5FE17E977891216A2043F6EB563130F6CBBFD640CE18D5F40C790A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347918, "uuid": "2bee2509-a1e4-40e2-b0ec-d82c3b628ab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347918, "uuid": "6eba7fcd-a9e2-4fb8-b208-99c122b2402a", "value": "12288:J9v3Pps3v4ryWaxkmgjw9Q/GQP+9GXrnuZcdDxZ6n2t+tbF0gmM+5ELFbMUQe2ld:P3Pps3amoweCa6+pxZCW+cj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347918, "uuid": "67f5f44e-6d7c-4941-8dcd-3394ad3a3ecb", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347918, "uuid": "e42a7432-94c7-40df-8b3a-ba6a652cb527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347918, "uuid": "c14b4e09-3583-4706-9d42-48bdbb95c076", "value": "Purchase Order 0042040896.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feb369c-2bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690373010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373010, "uuid": "9efee636-c359-4d9a-b305-7c035fabd136", "comment": "Malware payload (RedLineStealer)", "value": "7b2c575f99bb5d5415ecaf2ab05e783d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373010, "uuid": "fb5290da-69f1-47ec-932a-10d509760168", "comment": "Malware payload (RedLineStealer)", "value": "638d68f45252800527efdd9cdecd1816bf14b714b33db87a918a143c474a1086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373010, "uuid": "a3bd9878-a441-449e-87e9-8d061d740d9d", "comment": "Malware payload (RedLineStealer)", "value": "2755ac2f3fe8e8899708c8fd245010abc96409ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373010, "uuid": "f5d5b79a-5616-42e7-8bab-4ee6a99aac74", "comment": "Malware payload (RedLineStealer)", "value": "691e5861e2886167991335d79ebac165f1abeb0820967bcb73c42e5afaa94dcb71903586ba5253364c55a847e9e5b394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373010, "uuid": "3e94997f-e839-4c00-b3fe-463997ef43c8", "value": "T17EB41212DBDC4473E8B5277118F603D30A367CD45E38C3AB2759AA1E5972AD0A47237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373010, "uuid": "28cb01a9-c14f-4579-bf54-8b13219d8ab1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373010, "uuid": "a4f41f6d-94d7-4b9f-b82d-2802cecc3872", "value": "12288:pMrTy905C/CIZGb/bwDh/tp+OChT4hgWu5NhBz:2yt/C8UjMtcOCz5Nht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690373010, "uuid": "7413607f-e0c7-4f69-8d6f-4454484c8c46", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690373010, "uuid": "8d30026f-6901-44e0-81b5-aa1735bc4373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373010, "uuid": "dad54698-d4ab-4c2d-a372-a5c14d820018", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f098e4-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350549, "uuid": "127ddff1-6606-4a14-aed7-68a444c7070f", "comment": "Malware payload (AgentTesla)", "value": "30c32733fc5d13871fea450291452245", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350549, "uuid": "e74e9074-887d-4f77-905f-3726f732bcf8", "comment": "Malware payload (AgentTesla)", "value": "64161ec24e0ee9eb72f85bc37af3739e4788cc2c1a206339619550beda37f92b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350549, "uuid": "24101f52-da75-48e8-a7a2-69e3af259b4d", "comment": "Malware payload (AgentTesla)", "value": "79feab08e9413e7e0d66cc8300d1dd1905a9956c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350549, "uuid": "f609c82d-4ee7-4ec1-b28b-91dd1f24518d", "comment": "Malware payload (AgentTesla)", "value": "e0333de742dcb9b45e0b3fdb2a5ab15ee3f05f7b5edee2f11af409d42ec186fb47b4bd9eb910bdddbfdea5ea52133bf4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350549, "uuid": "c8585eb6-cbbc-4478-ab09-fed49d6f9efd", "value": "T1F3326C2A5AC53D6EE7073535C1501304F6F86093D2AA9E0BBA31EF76CB76DCD5A00694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350549, "uuid": "d3bd0f6d-1bd4-46c6-8bb9-6d313fb273ea", "value": "192:Tya0Nob57W1ARgZVPCK44AG9xXSJ+Ej7xJY7KwUKsHZWY7cWe/l:TyXob57W1ANK4499xXSJf7xJY7QcY7Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350549, "uuid": "ed8cf7be-2923-42a5-80c1-5098aab52658", "value": 11085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350549, "uuid": "16cbd417-7a15-41c4-8545-6ebcb1b89a8f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350549, "uuid": "b181d352-711d-44aa-a289-8fc9b7a6d54f", "value": "Scanner-payment.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b68afc-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356964, "uuid": "791e5e05-9237-4b54-b4b5-5b5678f054bf", "comment": "Malware payload (Amadey)", "value": "0f8598fb85f2093ef6d50320bb154ef9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356964, "uuid": "38f1d2ee-3ed3-4b0b-af07-543a319cc6a3", "comment": "Malware payload (Amadey)", "value": "64792ffeeccbab6bb3d100eb7b35cb61c8c90b802e42d83350baf6d1ceefbb35", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356964, "uuid": "94b66d75-7858-4dee-a195-fb8463555b18", "comment": "Malware payload (Amadey)", "value": "2c59e4a20dfbf7509be558e6d23a13b885643055", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356964, "uuid": "659bf97e-ff6e-4b67-a302-f27e86bf47bf", "comment": "Malware payload (Amadey)", "value": "851215041af454d040555f33f275c3b1af04ecde0854ba76b1022ca5aa3e57ef846ff21e1cb25fb54d60ae968a416a61", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356964, "uuid": "f6966059-355f-4039-983b-f077c223e14f", "value": "T133840202F7E99872DC792BB05CF603C30B36BCA59974536B2241AE5F0C72694E531B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356964, "uuid": "f44218d1-5b9e-4575-b90e-5741f968a400", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356964, "uuid": "b76a4327-6b33-44b5-b180-32d669cd7b30", "value": "6144:K7y+bnr+mp0yN90QEkE/euW+jgZlHyZgSKaFSJV1MA3lm7ZP1bj40:NMriy90GxufjgvyZtKOSJxabj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356964, "uuid": "8aad14ec-2dce-461d-b3a0-961b8964109b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356964, "uuid": "eeb57c6d-d84b-4918-b026-43d2b4cac3e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356964, "uuid": "3701e736-c9de-4897-b82e-dbc31937eee7", "value": "64792ffeeccbab6bb3d100eb7b35cb61c8c90b802e42d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7077166a-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690365280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365280, "uuid": "b06ee16d-681a-4a63-8bc3-98444c1944ca", "comment": "Malware payload (Formbook)", "value": "e87279fec2b6dc8604bff1934336d6ed", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365280, "uuid": "6410cf3f-3588-4866-b0c5-d68fe5a406cc", "comment": "Malware payload (Formbook)", "value": "64ca19cc5dcb0e550f501b188a04ca6380816465870deaadb1d3c519aeba1d20", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365280, "uuid": "52b3bba8-b5b1-4f80-b6b2-18340d739455", "comment": "Malware payload (Formbook)", "value": "9cfd9341bf50cd55c58749b3438431ff8cea27c4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365280, "uuid": "55fb8d5e-4445-4d35-a6c5-083686618e31", "comment": "Malware payload (Formbook)", "value": "fef008ef096d513ab0f898c60676897db95be288d5bb6017fc274d3475b0237084372f8a37505818e2fcb116b301961f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365280, "uuid": "91892373-5d8f-4bca-8ec1-1c294cdbc1ce", "value": "T18C23395AE78F02A48F911377531B0A899ABDB23EF35440B1786C837433ED83D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365280, "uuid": "538850ba-ba8f-4270-a8fe-2af73ef22952", "value": "768:eFx0XaIsnPRIa4fwJMbOdyjNcfcnHKHovaavwLyZ10LuRQE8:ef0Xvx3EM8yjvqHoxwLJwQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365280, "uuid": "70f92cea-5bbb-4694-ad32-57b4a5412b4d", "value": 46362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365280, "uuid": "55c9312a-9f51-4a47-8e9b-d400f8eb1155", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365280, "uuid": "525a3689-4593-4217-9f66-dea22711b7ba", "value": "e87279fec2b6dc8604bff1934336d6ed.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c603ec3-2bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690374776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374776, "uuid": "bfd3a83a-9aae-4d26-acee-e44c4df4090d", "comment": "Malware payload", "value": "26407dcc6b4ed458f0cc3f1dbc141390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374776, "uuid": "e6835f3f-4b09-40e3-8f6f-660bb9249806", "comment": "Malware payload", "value": "64f50d3236ee106ddb9a19a05db68d03065c7e4d5ba4817316b0ae037a718dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374776, "uuid": "8c58d16e-dca6-4845-bfd2-28f4ad97c260", "comment": "Malware payload", "value": "4b4ce002b02e3e20345c5182b287fce740f02e14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374776, "uuid": "73ac1dd5-99ff-4763-a7e9-4833582c754d", "comment": "Malware payload", "value": "ebe1987cb4b6f394a3190b40911e49779f0242cf9e6dd8e854810a5b6e0594a5ea01384e59f5a48fb55f0b14bff9e2c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374776, "uuid": "d994052e-882b-4715-922f-f1f235c97a65", "value": "T1EB447B11B8D48432D97328324638D2B24D7FB9304E659B8F77D9097A9F34681E729B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374776, "uuid": "a554c70b-0249-49e2-aa38-2f5ce76aacdd", "value": "a1b5839c70e4f1ab3c74bfbedd6e3c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374776, "uuid": "27c4a9f0-b46c-4bfb-9ff4-f6a2796671c5", "value": "6144:cbV9arKQMEa2deAqDyUhPYt5u2M256SZEL9dgHnCNKkgY:mV9BQMEa2deAqeUhPYm2M25LiLAnCNKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374776, "uuid": "270025e2-a398-4a6b-a975-18fc6ffe437b", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374776, "uuid": "a0604c3a-e86c-4701-8e76-a6576ea7e406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374776, "uuid": "a194d387-6526-4560-be71-a95c89d62c11", "value": "SecuriteInfo.com.Trojan.GenericKDZ.98337.7752.29947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a41acf-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356343, "uuid": "4c8bff92-c113-4ee7-aee0-8f61a18c6974", "comment": "Malware payload (Amadey)", "value": "9e2da7747eeabf282fdd29584aa0a363", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356343, "uuid": "b000e246-12de-4f57-9421-80f02930d603", "comment": "Malware payload (Amadey)", "value": "6589478ce4fe80a7692732c5d5150e2b19dd68d7c6b21670cdad39deffe3131e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356343, "uuid": "2851f115-af5d-4002-97cf-e640fee47942", "comment": "Malware payload (Amadey)", "value": "28eb9adddbed12adc0828513eea69aa0b11e5230", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356343, "uuid": "09cd3c2e-4828-4bd0-9604-e35e8a24eb3b", "comment": "Malware payload (Amadey)", "value": "d4504f724223fb6e255f482b603f6b71441adfba78a9a7481664cbdd4f236c68371190da6009e2f06c5bc903c36e4dba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356343, "uuid": "9369fabe-562c-43f7-84af-a970575c652e", "value": "T165840257ABD85432D8B117B058FB02D31A39BDA66D39832F27859C4D0CB2AD4A57233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356343, "uuid": "6ee98c35-e96b-4a61-9bee-10788dd03e78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356343, "uuid": "60465b7b-9ac5-4737-8914-e26038116ad7", "value": "12288:zMrAy90qcYerLAWzjDryud8gBYCuqEQSo:nyrcYYLnr/zvEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356343, "uuid": "f4a7d783-b669-4044-976c-29208436972c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356343, "uuid": "6d31c753-3963-4ea5-9bc2-4b04e8777093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356343, "uuid": "7a22dcca-47e4-4d50-920f-4cbbe9950242", "value": "9e2da7747eeabf282fdd29584aa0a363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c9ea45-2bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690384021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384021, "uuid": "67e15a93-047d-4059-89e9-2b63292b870b", "comment": "Malware payload (RedLineStealer)", "value": "29dfe0bcbc16089e569919b85c5a7790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384021, "uuid": "74a5ed64-9f82-47eb-a5cb-b1f4c32021b4", "comment": "Malware payload (RedLineStealer)", "value": "660944c2e28e356790c36fcc99f1413b6daff34f154aeeda556c351fc695e812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384021, "uuid": "8c0784d1-a3dc-4d0f-ae68-5f7485564293", "comment": "Malware payload (RedLineStealer)", "value": "0a2e017700ed6019d90506d0f309795934f216b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384021, "uuid": "f034f4cd-943c-4456-bcfa-154b22ec042e", "comment": "Malware payload (RedLineStealer)", "value": "d35a925cbfbbc63519d5a129816d4a77844de5c229d73d2d9942921d7d74f9772fe63d02d20b55579c15b94b0e29e61f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384021, "uuid": "8a741794-1841-4dbd-9dcd-3a252c6854cb", "value": "T197840256EBE89033CCF51B7018FA12931B36BCA65DB8831B1785E85A4CB26D1B532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384021, "uuid": "7a7919f9-aa68-4d49-8fcd-75782801bb6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384021, "uuid": "cdc7685f-9dd3-46c7-bf80-b8470d441838", "value": "6144:K/y+bnr+np0yN90QENy5RPekKFyJzuw6UyecP8KoaH7dmktY0gBZ+t4+Dsu007cb:xMrDy906RPeTyJByecuiZK0gBYC+4VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384021, "uuid": "334773a3-2183-452b-8ada-00459552b183", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384021, "uuid": "2f815f72-5c2f-44c0-81e3-818cbc5b0fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384021, "uuid": "27a70c43-7046-4c15-b3d4-d220e2e86bf3", "value": "29dfe0bcbc16089e569919b85c5a7790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3bdf4c-2baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690371989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371989, "uuid": "2a3fd5ee-bd14-4c92-a4f2-24ade3702424", "comment": "Malware payload (Amadey)", "value": "9a556bba2a655828e40ac7cc2a0c2582", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371989, "uuid": "52b95e2e-6cd9-4e0a-8107-57c9a65008e9", "comment": "Malware payload (Amadey)", "value": "66d5980d8091747d1940c88de45d3178941e68faf4da7d54db10c95019f62a92", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371989, "uuid": "731b74fd-5205-4571-bbf5-f3585377cad2", "comment": "Malware payload (Amadey)", "value": "cebd2238937c6b8b1d8056969e63e940620599c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371989, "uuid": "f1a86a89-a614-473f-9793-b2ef2356092a", "comment": "Malware payload (Amadey)", "value": "238e1b6d6ca2c7d5160d5bd75c3bf52fee0d1d98afc6e9801c232914da4396296f1d9f7b6b657b9d62761d7e82302b07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371989, "uuid": "5f64cb01-5920-4c64-9f63-ddf8332632ee", "value": "T1EB840256BBE88173D9F417B068F617830E357CB19EBC832A3781A85A1C736D4943277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371989, "uuid": "dc6575b1-b96b-4a31-b6c0-00b5c58f2835", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371989, "uuid": "da899efa-ae1e-421c-894e-054dc3183ebd", "value": "12288:NMrqy90kx3OASG4giL0YzF6QgBYC/T25da:HyBO3gyz0zr+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371989, "uuid": "48772ea8-fbd3-40ff-9673-b025189d8d07", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371989, "uuid": "c6aa5fee-6f6d-4c33-91bd-4d6046e01e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371989, "uuid": "c29b6067-5968-4890-b40d-c2a634024355", "value": "9a556bba2a655828e40ac7cc2a0c2582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa232566-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396301, "uuid": "dd9a6721-9574-43c7-bde2-b595ee2e99ba", "comment": "Malware payload", "value": "1ede21252b019b147e834a9ed86b2716", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396301, "uuid": "a3ff8886-7855-4ff8-bc77-a4ff00e4d7a4", "comment": "Malware payload", "value": "6716a9f2c2e48d790b1b9eaa039fd1c51ba6edc7b10a7aca3e468cd06a62244a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396301, "uuid": "ed06eed7-302c-45a1-a956-74e9e0198f2f", "comment": "Malware payload", "value": "bb3d221471cabd6c2b0b5718d3ed2a278ec2be25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396301, "uuid": "bef4c123-d7d9-4944-ae99-ec608c90ad80", "comment": "Malware payload", "value": "b6a84e7c4cdbf611510b8c9eee0886c460abf6fa261256bd78cd2da3aa2137706bca5288635e7494be4a3aec1b4998d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396301, "uuid": "f515a9df-6315-49c4-a87f-d3426f796999", "value": "T173524AF24A656493EA4A4C706BB4902BAFF3F2A21B654079A69F85811DC0FF1FE5810D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396301, "uuid": "d1c92759-a80b-4cb6-84be-a7cd7b8eee9f", "value": "8700d0ebbb41c81ea52718af1ab70a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396301, "uuid": "0ebb10e4-36db-4bfb-98ad-1d2e043b7acb", "value": "192:M/7UG7lhvov36S5FcUjliSEI5LuQHnYe+PjPQmGwg2bU5bbhXH87uGauospvxp/Q:M7UUhvU6qFRMSEIdvnYPLQmGWU3riK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396301, "uuid": "4ca01fe9-b708-47c7-8ec8-de62e8904d49", "value": 13832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396301, "uuid": "66cbcf8b-828f-43ea-bc24-c129a2d48e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396301, "uuid": "16ef959c-128b-47b1-ac6c-0174e7a6eebf", "value": "SecuriteInfo.com.Adware.Zaxar.111.31899.29655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2ee0ce-2ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690371927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371927, "uuid": "add57bff-5574-48b0-9fcf-88956cc06504", "comment": "Malware payload (RedLineStealer)", "value": "1aaa434406dfe8a9f9832cef05c224f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371927, "uuid": "d5a30fdb-ee66-485e-92ff-93cdbae226bd", "comment": "Malware payload (RedLineStealer)", "value": "680fa23ffd5f8185eb50f54932becc71d2d3b51b39033f853c4ea2e8737e34f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371927, "uuid": "10a3363e-4370-42f7-bd0f-d02f61d6434d", "comment": "Malware payload (RedLineStealer)", "value": "3394604f1168eb67a2d6b0d151b71d05ce7d79fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371927, "uuid": "bf3550b7-c761-40a7-bbb9-a2d841e13abb", "comment": "Malware payload (RedLineStealer)", "value": "0c7d7e0ba99ce102cd02178384f8f34d8a1edca51ab09696fffa5fc16879a7a62fc4d812ddbf0c87dee358d823e0601a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371927, "uuid": "69e791f4-7f73-493b-a022-83d0a58ec989", "value": "T1F2A4094383A1BD54E9258B72DE2FC6E8760DF6718F4D7B66A228AF1F00B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371927, "uuid": "ed7cf49f-229a-4fe7-8a1a-75d23638db37", "value": "28e47df11fcc31ecc5eec0c4cd0746c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371927, "uuid": "1c245e22-0696-4c9c-a95d-92c02742893e", "value": "6144:qlUgLNFhK7YQ/FJF6MQgyuvckovIwk27Sjv+HT:AUgpFhKcQLF6zLuExDSjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371927, "uuid": "37b83e87-6a2b-49c9-9d19-f1404a964c82", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371927, "uuid": "a9d83860-8ad2-4713-824e-3d13bc0643ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371927, "uuid": "b56768a8-5239-413c-928a-90565b170725", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdae97fb-2b77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350485, "uuid": "6c2cb2cb-45da-43f3-a287-ea4425f8963e", "comment": "Malware payload (AgentTesla)", "value": "f58878d201c8823098f6319366656312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350485, "uuid": "280af0bd-f6e2-4fcb-9872-f76a93c9dbb9", "comment": "Malware payload (AgentTesla)", "value": "683568d99336f284738255128c424498fe2bfac750f23f68c525f7cf66597eda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350485, "uuid": "c5448c86-c9e5-4892-8c1d-a71cce1c06a5", "comment": "Malware payload (AgentTesla)", "value": "96b5a100dbae21d4c9a694f17f7cdbed75265762", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350485, "uuid": "d9c94e42-658f-415f-9596-5832b3cb96af", "comment": "Malware payload (AgentTesla)", "value": "7bce035add14bef18cf9eb0f63ef3f58af7b7a3667415d520a1f8c34f3abaa9014e503dab3a438f02392487e4958a4c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350485, "uuid": "f9f9301e-4d72-4072-9220-a4c2d28b9ec3", "value": "T15CC41222163CBF1ECDBA93F519A194004FF6E55EA172D24E2DC670DB8A13F2106A2F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350485, "uuid": "84ff783a-ee40-4cd8-ab2e-9c8358239a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350485, "uuid": "9abb351f-4c6e-446c-b9c9-82bc3f092bfd", "value": "12288:qf2iN2GULfLCbKa1NjWhTa1EKVOwg+HN34c/dopdyPDeyZ:qf1xULjZaDjWcVOwHt34Mdopd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350485, "uuid": "b3352e16-46e1-474f-82ed-93b44eacc49c", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350485, "uuid": "35c8afda-07cb-44db-a691-41d09ac2a4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350485, "uuid": "a4f1763b-dc2b-47fd-bd9f-24e8b87c4b5a", "value": "UuiG0JUlzhD7P04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df85b02e-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690379210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379210, "uuid": "e59c7f4b-3253-45b5-8935-b1200eda889e", "comment": "Malware payload (RedLineStealer)", "value": "6f81fbc5c01c57356dbfc4304c0ce6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379210, "uuid": "a8f27d4f-4b65-4962-8672-fcac79eb24a8", "comment": "Malware payload (RedLineStealer)", "value": "68514e46d714b3d8da00f149141fb8f7d50add951742f92f5cf353fd02e463c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379210, "uuid": "f5e85c31-8698-4de5-946b-34b352de5987", "comment": "Malware payload (RedLineStealer)", "value": "74cb605de4eb0b28b731b3b91cdce932258f6031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379210, "uuid": "6f9572bf-a5df-4e91-b8cb-7e9b283f3e46", "comment": "Malware payload (RedLineStealer)", "value": "db4489dedcbe93479e00bd06c3704b49d87b69bd68f3952ab47f3e6caddd3cabbb89cd61ea301f974ae2167d43f505e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379210, "uuid": "f0ec0630-f8e6-4757-9197-9040576369df", "value": "T1A1840152F7ED5033D9B92BB068F603830F3A7CA09D74536B2745A99A1CB3580A47672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379210, "uuid": "8de7b132-0a59-4a56-9977-33af0938aa41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379210, "uuid": "92d864b8-cca7-4e1c-92ad-34e7bdc14fd4", "value": "12288:mMrsy90O8+NjLlnf8/FW5qSGyQR4TLGn3G:KyT8+NlfI4Y/RJnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379210, "uuid": "61e3984b-9ec1-4fc2-8019-b71a3f93df45", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379210, "uuid": "6a10bf17-3e1c-4e30-8cfa-cd0098ae3266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379210, "uuid": "f7b0a63c-e359-4720-8db0-157ee1752b61", "value": "68514e46d714b3d8da00f149141fb8f7d50add951742f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4716d280-2bb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690378096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378096, "uuid": "d2a839d4-50d4-4056-b9ec-7fd05b36cda8", "comment": "Malware payload (Formbook)", "value": "71c0a5043a21ae67b76f291325de7506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378096, "uuid": "5c82e496-8af4-462a-a578-75c1b433d07c", "comment": "Malware payload (Formbook)", "value": "68addcb8c42d515cfcd4a89bb5d5dbe49c5cbc576ce8c13d9a660d584950e04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378096, "uuid": "26017187-9b9c-41fa-a98d-6ce086b58502", "comment": "Malware payload (Formbook)", "value": "87c2525c9b0cf03d662bf7b2affd6db3b30ee58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378096, "uuid": "660f68aa-a01c-48cd-b043-dadb4e72fe40", "comment": "Malware payload (Formbook)", "value": "6b7ba773c62069f6ad3ac2904d8eef691bfa361a152c5c2e228f7151a00181c32e8c38e0cef0f2ee80f7f5d410c4656d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378096, "uuid": "99030798-45ac-426d-b4ed-945a4ac2c720", "value": "T180B412C09214C20EF3AC1B7896770E3DADA75917CBEC8553F8D82BE324B758D706469A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378096, "uuid": "e07308c2-b709-47b3-9f14-cea27f1af1da", "value": "12288:FPeGh7uxZJG2LryEU5b33RXe6Imee9LaAcY08/+3KWOMdwz4RqoWFm7PH1:pesKHI2LryEU5b33RO6Dee9aA3x/KKWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690378096, "uuid": "1f97821f-ee42-4219-9d78-86389b402302", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690378096, "uuid": "f8c30003-bb54-4d39-8382-6552291b40bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378096, "uuid": "f45bd3e6-3898-4da8-84f9-13edce85c3e6", "value": "yzhuQFZOKoMax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd3c023-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356953, "uuid": "52d55448-08a9-4b67-91b7-830e6752c957", "comment": "Malware payload (Amadey)", "value": "d6b5d668d3ca578c416c1bd5f8a176f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356953, "uuid": "03c87ebd-1282-4d91-a2f4-1bb6993db3ea", "comment": "Malware payload (Amadey)", "value": "691c893cd04c2e13ff9680e619fc9cbca5e9c9d8f5c5acef63ece9e66f572020", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356953, "uuid": "ccfc194a-ccbd-49ac-a34c-3fe324e5ea4d", "comment": "Malware payload (Amadey)", "value": "a01fa86ec152a54afb7fe4cb715b4dab355036a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356953, "uuid": "ee435664-ad91-433c-bed4-106acd1fe892", "comment": "Malware payload (Amadey)", "value": "e1d8ddbe3ec880bea9bb5df0a64b8b1e641f253aef957632d76b5ee42091cec46089cdd1a124f1caec76613db01b28b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356953, "uuid": "cbf1b068-f8b0-47f6-82fb-0c0083d1eb3a", "value": "T122840252B7E94573E8B527705DFB16C30B3ABC628C7443AA2786990F0CB36D0A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356953, "uuid": "490310e0-d99a-4599-857b-fac9634f7b36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356953, "uuid": "ae3c677c-94c2-4ce7-a6c7-7abb98c90f87", "value": "12288:mMrey90tjmq61/HrWXNT2RX4XUL6ZLxveM0:My4mqirWXYX4XULSLx30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356953, "uuid": "93f7b643-5943-487d-abbe-954f573985f9", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356953, "uuid": "0a666c5a-5750-41a9-a813-f137b6884c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356953, "uuid": "f9a89fa9-1f46-4879-986d-06ec96309d44", "value": "d6b5d668d3ca578c416c1bd5f8a176f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fb38e1-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690351069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351069, "uuid": "98c34f32-cbb5-4796-86a6-55d611e4ca5c", "comment": "Malware payload (Formbook)", "value": "27b325b6edd74e1da3e266db4161a68f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351069, "uuid": "2a1b8c38-97b3-4cff-a9dd-d4bbc6c90bfa", "comment": "Malware payload (Formbook)", "value": "6927b3018771717685434bab51c0bcef590d1c38c55cc205d356c9ef771ffbe4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351069, "uuid": "9a27afb9-ec8b-4b6e-9e5a-eafe90891ec2", "comment": "Malware payload (Formbook)", "value": "19f87958459e5c06d868da0f80202def6addf9b6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351069, "uuid": "242ec295-b6ff-4dec-a5aa-bcee5424d067", "comment": "Malware payload (Formbook)", "value": "f4ceca9d5c2b47d9a064447d577b918029e0465a2ed3e9dfdc119285529c56cb22fcc8e0c83a0682fb2cd42cd22faf28", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351069, "uuid": "a300937b-dae7-4bb4-9081-2d5eaf26f08c", "value": "T1CB326C3A9AC4186EF606503580A52207F7A473A392299D8F7A30B959C7BD3CDDE013D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351069, "uuid": "eafb3cfa-8406-4ce8-a4f1-af857dfa6716", "value": "192:Zya0NG/fnWHARgZVPCK44AG9xXSJ+Ej7bJYZKwWKi9TWYFcWeiU:ZyXG/fnWHANK4499xXSJf7bJYZ88YF9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351069, "uuid": "8393b612-c162-410f-81ae-809a3f75614f", "value": 11082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351069, "uuid": "16915451-bb50-463f-a132-3944e64fefb8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351069, "uuid": "f0a2183e-636c-47d5-b469-8b8a2523a009", "value": "New Order_letter.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3227636-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356050, "uuid": "65323fc9-7f4c-4a84-b24e-3aaee372c696", "comment": "Malware payload (Amadey)", "value": "37e149c79f6c343a6e5e070bae845e45", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356050, "uuid": "c57c3bda-3a94-44d0-9291-6412f48bbe40", "comment": "Malware payload (Amadey)", "value": "69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356050, "uuid": "66e1a5c4-7a8c-4f68-974b-17e9dfc7bcb5", "comment": "Malware payload (Amadey)", "value": "fa31552438049bc5ac502c437a18a522e693c644", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356050, "uuid": "8acd533f-5924-4323-8d17-3d33184f84bf", "comment": "Malware payload (Amadey)", "value": "ba5ef37b46c3eaf5adf02cc53bc586802bc1ed78093a8f5e4982bf4424259e7cdf0fd1103ce80bffade60a3bfdceca36", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356050, "uuid": "fe7b1125-9fef-4537-9b6e-7a599b9d4518", "value": "T197840203BBD55032E5F2277018FA13C31B367CA28D78962B2B46995E1CB36D4E53672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356050, "uuid": "c5ca1873-4ad0-45fc-b559-0c135d4ff42c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356050, "uuid": "07940d18-1a69-4720-808a-5ad960c81b86", "value": "12288:tMrcy90kZOXq38EVpLdCLA9sgBYChe8WkPObqU:1y3OO82pL4LAxzToV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356050, "uuid": "b802834c-906f-4d01-af61-512981f06c70", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356050, "uuid": "a0d8095a-5439-4937-b657-f26255897933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356050, "uuid": "c8c6a25a-ec00-4dfe-9091-85b3607ee591", "value": "37e149c79f6c343a6e5e070bae845e45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d3585d-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408044, "uuid": "6a8f3802-2c8d-4119-9bf2-ed3398245892", "comment": "Malware payload (RedLineStealer)", "value": "c3231c15ce1be7ba926a1ae99ffa06c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408044, "uuid": "44023ec7-62fd-4963-a014-c31e50e45c90", "comment": "Malware payload (RedLineStealer)", "value": "69c0601f58668a211ced8974a3c028210c968f7a63fb9b18ea9b83b8fd640bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408044, "uuid": "c0681f5b-590a-4928-8453-ef624bf98306", "comment": "Malware payload (RedLineStealer)", "value": "994713e89dd9072c6ba7b6406c764455d92535ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408044, "uuid": "8de864a7-bff2-4bef-a8ee-9daa0773c9f2", "comment": "Malware payload (RedLineStealer)", "value": "265269af227369b19f7289de829a084cf3db574e574d1b0ba1061e38354830b5eb4507ffac7b8c851e5cfe6a1351f2e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408044, "uuid": "1edbf0e9-9957-486f-b1de-28dba769a5cc", "value": "T1BE840242B6D88073D9B527B068F607830B36BC525D78832F2B85D95F0CB36A46975B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408044, "uuid": "37c5bb92-38ac-4ef3-a04d-0192bf208f79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408044, "uuid": "2c8f4677-3b57-47fe-b18a-0dc93bcacb3e", "value": "6144:Kly+bnr+Kp0yN90QEna1epa4PuQAzS8gtbQGdgBZ+t4fDDsY7EZH:DMruy90c12aanRdQSgBYCfTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408044, "uuid": "c6978428-ea47-402c-9920-b799650419f3", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408044, "uuid": "9f8d3e78-f6be-47b1-9c6c-e326d8aa3f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408044, "uuid": "d404fb66-dd65-4773-871e-b04e4b4c5b17", "value": "c3231c15ce1be7ba926a1ae99ffa06c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc8d4df-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690385031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385031, "uuid": "475629c7-4c61-4c98-a0dd-4a36f689effa", "comment": "Malware payload (RedLineStealer)", "value": "ce922f2abb3915f3e01a3c29d8e4f053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385031, "uuid": "23395d45-0561-436f-99b2-4eec838d8cd0", "comment": "Malware payload (RedLineStealer)", "value": "69f441f66922d545a3dc154f0a844a7ead9755d60b48961fb5bb7fa79171d9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385031, "uuid": "5af0456e-88c5-40f2-a20c-bbcc0c56847f", "comment": "Malware payload (RedLineStealer)", "value": "a5a4f205a02a0334997ff7ae2a9238bdfa925d69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385031, "uuid": "abc57ef6-078b-48c9-b600-26b7a0cacfe9", "comment": "Malware payload (RedLineStealer)", "value": "4c69dacbc2607ccc4d39e8445290a677ba2aaac7ca2f57aa632182f7d34df61d6a59dfd7c4b03f11497df5359477de4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385031, "uuid": "8942eebb-a90f-4ffb-a077-0d78cd0421b1", "value": "T16544273A20A144ABD8A99D35FA4BD8C035566EF4017D500F3FB36E786BD24938DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385031, "uuid": "3a6017e7-7699-4ae7-893c-ddfba9856fb6", "value": "d72a2586f64f6075cc377ca31f78ef3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385031, "uuid": "82c58592-8b29-496d-8dd5-655b8110ccc5", "value": "3072:s1XnMaQwm/33uzEvrpJtxpUuzE16ENNyFmonQnfWDrncByRoq9Qz:s1TmWIvrpJtx2smonQnfWD02oq98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385031, "uuid": "42ac2745-a21d-4ac3-b594-e1c5190d5632", "value": 262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385031, "uuid": "a308bc36-f8a8-4e25-a117-ee7cfa8ed205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385031, "uuid": "4d929e97-4bb7-43bd-960f-4ff296cdfe9a", "value": "ce922f2abb3915f3e01a3c29d8e4f053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4d4e58-2b77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690350459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350459, "uuid": "970e76ed-f914-4c38-89c8-803682948aba", "comment": "Malware payload (Loki)", "value": "8fb6b2919bf9289dc8e89d6a93d12352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350459, "uuid": "6bde7774-6ebb-4974-b58b-4c8e8ba04626", "comment": "Malware payload (Loki)", "value": "6ab1469b64fcfb38f3e8f7536a3e4005794b13efc0fad4a3b4735547903dc845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350459, "uuid": "7fefe389-8ffa-4fe4-8f4f-c12b2f444e0e", "comment": "Malware payload (Loki)", "value": "e630f7c4a3c86b60855f3b99f37dbe52e69ba830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350459, "uuid": "f6d1e5f3-b2f3-4466-bafe-52798fcd3b2e", "comment": "Malware payload (Loki)", "value": "8964520c0d91f0c8c717ac074a266907c933418d5da0f48de6c383646ad5520ffd028c0f9435f0061902cea9a3bb707b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350459, "uuid": "ec8f19cd-d0ef-47d6-af29-7c7c69b90309", "value": "T185B41222A5AC6B6AD97B43FA055094000BF1E94BE135E3091DDD30FB9633B6127F2B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350459, "uuid": "d416cb53-9c4e-4be1-87f8-974349fdecd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350459, "uuid": "401b74f4-7498-43f1-9e9a-ad65d20bb81b", "value": "12288:vf2iN2GULQTTR9BUUVeDFWKyU6286JIPVzKarjMlWpsCk:vf1xULQTDBUUkZWpUhr2gWpsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350459, "uuid": "6d9427e0-843f-4019-9b36-d19b597b9a80", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350459, "uuid": "8d7d49df-82e6-4d24-87fc-68d32e60ec0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350459, "uuid": "ae5f9fc7-6711-4778-9b09-b82620aeb120", "value": "DHL Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001e49e6-2b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690347912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347912, "uuid": "1f51fdba-affb-4184-b0da-f417ab7f7097", "comment": "Malware payload (AgentTesla)", "value": "7dad7a460ce20df94b89412351b74e64", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347912, "uuid": "dfb2f428-584c-4081-b150-35ffd97b73b1", "comment": "Malware payload (AgentTesla)", "value": "6b5291a43eeb21eb9c96f0c034024c9caebec65df775acd344a69664cada8425", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347912, "uuid": "41f3d0ce-16bf-44a9-9450-00fd7f01fab0", "comment": "Malware payload (AgentTesla)", "value": "cbfcf8eafe85fe435591c35b9cfe6a7085051143", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347912, "uuid": "e25a7258-894d-4c68-9a02-07290ec43a77", "comment": "Malware payload (AgentTesla)", "value": "cadda12491ee877390d78e5ebd676af4a5b9646c15e3848bf6bc3d234ff8da614f5de5ea7d176f393fd72243acc0b45e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347912, "uuid": "0991fab4-4d97-4585-b341-0513361e057f", "value": "T107B423B1B09C8A0EE1FD1B0E637A5B7A0357BB21163EF3D6D5E54E65A8406A2E0F400D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347912, "uuid": "fa157f30-ad00-47d0-8eaa-37f4fac1f58a", "value": "12288:U88aTrjw9L9GQP+WqXr/uZcgDgZ6nWw+vbFMMjlqMeszG:JT/wxJ+y+ggZCb+3l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347912, "uuid": "0e510c8b-6b58-4a76-a854-0a56ff01e0ad", "value": 518929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347912, "uuid": "a0a042bc-f170-4a3f-896d-37bc19467f3c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347912, "uuid": "09dbea52-1574-4998-ab26-4bd61749679f", "value": "Purchase Order 0042040896.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1eaa9e2-2bdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690394274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394274, "uuid": "9b3cb9c9-9909-41a7-94d8-8baccb5554bc", "comment": "Malware payload", "value": "5faf36ca90f6406a78124f538a03387a", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394274, "uuid": "1870cbe8-7f81-42e7-a506-bfbd611a1e4e", "comment": "Malware payload", "value": "6c121f2b2efa6592c2c22b29218157ec9e63f385e7a1d7425857d603ddef8c59", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394274, "uuid": "70757fc9-e39a-404b-8964-bea0968f7cca", "comment": "Malware payload", "value": "9e9a5f8d86356796162cee881c843cde9eaedfb3", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394274, "uuid": "30491b7f-748d-4e34-bbfd-729b260abd62", "comment": "Malware payload", "value": "a331d2e8a9d39f8a6e0e9f37373fe8d79d6e939fe6892a173357aaf47b13b9a2a11f7b97704bcf0611b2d3563a8ff4df", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394274, "uuid": "1f8d3c51-7cb5-4a8d-b30a-5fd2b5bae787", "value": "T18E13F703F7081816D4DA81B596EF43875260F5693F64635FA3C1A2A87F48FF5B362A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394274, "uuid": "ed2e80bf-43f6-4877-a58c-9f2b47c14615", "value": "192:0AKOw1lUzKkc9bTVXa0TKmtqoacStnDsTYLIkHvS/hLa4eLb:0AKFUzKk+VqFmMrtsTYLY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690394274, "uuid": "2ab962bb-caa4-4bc6-b692-0c2cd7710e93", "value": 43139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690394274, "uuid": "68f0c068-9a87-446f-8eac-51f8649c5146", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394274, "uuid": "852913b5-094d-45e2-bbed-afe956936918", "value": "UpdateAgent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c18afca-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361461, "uuid": "8f28a32d-47f7-4b42-94e3-1e8a9e47845e", "comment": "Malware payload (RedLineStealer)", "value": "11154b27576c4246f2e8eb83278bc984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361461, "uuid": "d9ff77a6-a377-4df2-8e32-06bc477c4464", "comment": "Malware payload (RedLineStealer)", "value": "6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361461, "uuid": "33062132-4e5f-407b-b307-19cc46d99201", "comment": "Malware payload (RedLineStealer)", "value": "83b173354ca803be9f5fdf756544b600dc3fb825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361461, "uuid": "71977122-680a-4826-ac7c-e55ac8934048", "comment": "Malware payload (RedLineStealer)", "value": "0abf06074ce7acbda6a758c4c06c28d7b3a0dbebe385b1a42957ba104b2bbf2b9da0b10d31e916ed93f1dafe2560a29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361461, "uuid": "e5906037-039c-4abd-a82a-503322fa5351", "value": "T128840263BBE89033D8B517B158F60293163A7DA26DB8836F7341995E0CB26C4F532736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361461, "uuid": "6137468d-4adc-41c0-8656-c034f92a1118", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361461, "uuid": "9d58a801-e60e-4894-b155-cd2d59112eae", "value": "6144:KNy+bnr+Sp0yN90QEhBDbF8ftda/5ONdFSA/rtWX3X0ijvDrJMFWDsC8:zMrey90dDhywwMADkH9pMF1C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361461, "uuid": "33f2ca5c-f98d-4785-9723-f93bb85b81d7", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361461, "uuid": "46bd80d7-24a5-49a7-9e14-03f1d95f82cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361461, "uuid": "75e9b992-a684-4660-af9f-e94d18d4a0e7", "value": "11154b27576c4246f2e8eb83278bc984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0b3bc6-2b93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690362372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362372, "uuid": "18d73070-6ab6-405c-979d-d6ce417b6571", "comment": "Malware payload (RedLineStealer)", "value": "ba57368bb9e7ffe389015ec814dd85aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362372, "uuid": "c0ffec50-c4b9-4344-b975-c697b377b8a9", "comment": "Malware payload (RedLineStealer)", "value": "6c3e475df84f900056d468d606b56d6e907e0230aaca4d96b50059e04958536d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362372, "uuid": "ae530e43-ca52-47d4-b9cf-fc6ff282c233", "comment": "Malware payload (RedLineStealer)", "value": "6c888fb22734ab04f75a44aa5fa8b29e17754710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362372, "uuid": "63ef8c1c-d08a-4a46-ad06-8b5b5c1b9973", "comment": "Malware payload (RedLineStealer)", "value": "df3d632b403f4b1ce7484f447b4a660e42f84c323975782c74f92e8b2540b8ff49b6bf7a647a877ad09817eecdad5237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362372, "uuid": "cb031840-84a3-4037-b1f4-4fcc7f9d2346", "value": "T1F0B4024297E49473DCB51B706CF607D30F3ABC6159B8436B2A86598F0DB3A80A57633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362372, "uuid": "f58f9811-7b62-4263-9a68-ffdd1ce6af9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362372, "uuid": "f03de557-fd09-4317-b8b6-b42e27d4160f", "value": "6144:Kzy+bnr+sp0yN90QEbumGM7YgwgGzENUfIk67UVRL7qJE15oBZ4V3eAQ1oyrt35m:RMrUy904YqBzEmrqy46HQGyLKT0qPw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362372, "uuid": "df565e92-3941-45e7-9117-176e3aa3fa90", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362372, "uuid": "376da569-7d71-4c48-ad75-e48ac54dc034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362372, "uuid": "37ed80a6-b5a7-44e0-8fdc-169791d26301", "value": "ba57368bb9e7ffe389015ec814dd85aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2e3010-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356035, "uuid": "cd03e07b-66f7-4764-9550-f63ab434e6bc", "comment": "Malware payload (Amadey)", "value": "28a9201a5f0f0fdb2dfbe2668a703459", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356035, "uuid": "2ba23cbe-3ff0-42b1-b875-72f635a61399", "comment": "Malware payload (Amadey)", "value": "6c65a8be5f96d8cdff9567a34533c7fbffad72b6c595c950ceb8d5be14a30519", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356035, "uuid": "2922f026-66ea-4b72-930a-6d7ec75e734b", "comment": "Malware payload (Amadey)", "value": "d704314bdfeec14fec50b34883d43e1e8fb977f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356035, "uuid": "71fee547-cce6-40a6-9377-0bc66537f3e3", "comment": "Malware payload (Amadey)", "value": "f3d7efaa8a706c7c15fe72ec1d70bf9fadf661a1906b6377980e770f5b798bfb43e0547be9ce3d666d85bb050b3e4e23", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356035, "uuid": "0fdb9e8f-7842-45eb-9624-71a4f1369bcd", "value": "T10DB40203A7D88132E9B56B3498F603C30B397DA26D75875B3352AC4A0D726D5E93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356035, "uuid": "0b55afc8-636d-498d-a3c8-9eecc74f6a4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356035, "uuid": "5b3e084e-8367-4abd-b454-4e17e5a296a3", "value": "12288:zMrny90fQn/gWsLmSjcUudr19jzWXiz+lG1M23N:IyFYWrpUudrjOizeGK2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356035, "uuid": "bdd79e2c-619c-48ab-b4e5-e008c258e409", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356035, "uuid": "03b722f7-7e63-44db-b35c-2643ab1deb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356035, "uuid": "84548e22-6633-40a3-ac34-2cb88e1c9c36", "value": "28a9201a5f0f0fdb2dfbe2668a703459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467a213f-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690382819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382819, "uuid": "a225ff54-67d9-464e-9b92-c2ecf23a0790", "comment": "Malware payload (Amadey)", "value": "437646baff13953225db8e8db331e602", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382819, "uuid": "413cc145-cb33-498b-b7c5-83d8c02fbbb9", "comment": "Malware payload (Amadey)", "value": "6d579a400e134af22a4034157761aeeddab16113722513a617775b1630ce0fb1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382819, "uuid": "b6a6eaaf-20c8-4b20-8eff-e9c9dc854c73", "comment": "Malware payload (Amadey)", "value": "d4b63685c0db2ac9afb1ea27995d04df6c35475c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382819, "uuid": "6216d9e5-9c56-4ed3-b814-032555e4a429", "comment": "Malware payload (Amadey)", "value": "a84138d30ef11e588718f21cdabaf0c7dbfd62c7a3898f6cbbe82c42bf0f6e6083169c17c108cd4208dca787a5dcce97", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382819, "uuid": "eb3991e4-2b31-4ca1-ae16-ad54dea40f84", "value": "T109F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382819, "uuid": "0a17f24f-af94-481d-b104-3296b85b753a", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382819, "uuid": "1e047cf3-37ec-4f5c-bb6a-4d582f21aab0", "value": 34437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382819, "uuid": "14a2ee4d-8615-4e32-bb69-afa87bda2e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382819, "uuid": "d1394b41-823f-4a40-9d69-32cfdf6c3426", "value": "437646baff13953225db8e8db331e602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52aa5d1-2bd4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690390333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390333, "uuid": "71c263f8-83a6-4fab-a60b-6cca6d2da385", "comment": "Malware payload (Amadey)", "value": "18eaeff3ae40e541cbd0cdfdc2298885", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390333, "uuid": "72524971-d6e7-4ae2-a58a-e158cc35b6db", "comment": "Malware payload (Amadey)", "value": "6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390333, "uuid": "fe135ef8-62e1-45a4-b157-449e919506af", "comment": "Malware payload (Amadey)", "value": "2fe4663c9d407d97bebcd035d901321dd1d9ef3e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390333, "uuid": "fbecc417-a631-46b2-9446-80af0da2edcf", "comment": "Malware payload (Amadey)", "value": "fb666da6a23431051dca164f150ddbc03035200bd8af1e7679198f4b15021a18275b63fa67d388ddab7ee6b082092a7b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390333, "uuid": "6e29e121-c0e3-4962-9039-dabdfb3618a0", "value": "T136740213B3E85032DCB2177059FA06C30B367CA1A83883672796995E5CF26D4A5B637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390333, "uuid": "498f80f9-7803-4048-a6b7-8266d948e410", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390333, "uuid": "68f1f0ec-ddd6-43f8-86b9-6490c9e3bb2b", "value": "6144:Kmy+bnr+Lp0yN90QEjHCyMnb6yUchr1x18mlQVMhyoVAWgWMvmy:aMrzy905Ob79hdEmJYvmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690390333, "uuid": "c308ee80-a7d6-40ba-a37d-966256d37ccf", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690390333, "uuid": "7505c505-9f43-4b28-b3a3-ed76632b9461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390333, "uuid": "7a32627b-6337-4f9a-89ff-0126780a42c3", "value": "18eaeff3ae40e541cbd0cdfdc2298885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e4001e-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407762, "uuid": "75622db1-7094-43c2-9981-d39baa30cb75", "comment": "Malware payload (RedLineStealer)", "value": "a18c99ddee638000c03a757517e535ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407762, "uuid": "184aa10a-bf02-4e5d-9a6a-5687544f6d2d", "comment": "Malware payload (RedLineStealer)", "value": "6d798e3e2e28317dc1b93dbc671623d036d06ad82c94821b64004d1ef983f1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407762, "uuid": "c359b395-e9d7-4747-abd7-79f2455f3ca6", "comment": "Malware payload (RedLineStealer)", "value": "40e711bb8e419feb52689e6464e418d7d383da4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407762, "uuid": "4ed738cb-6ef5-4943-a4bb-0394c451721f", "comment": "Malware payload (RedLineStealer)", "value": "a2ff657905cc3065a44aa0b7563ceae5f5bff95fb0c1ffdce73dd8a13af142f4cb3303d497b1ed14f5990bee9b5dfa67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407762, "uuid": "bd58dda2-5b62-4c5c-876c-cb03525e4210", "value": "T1EA840213BAD89033DDB5177058F602930B35BDA1DC38976B3646E82E4DB26E4993273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407762, "uuid": "010db904-9481-4254-ab08-5dd07b2d55d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407762, "uuid": "aca7cff5-7201-4b4b-9040-0ce475aea04e", "value": "12288:5Mrsy9075gw7vP5Qs8bn4hiGvgBYCY4246:9yqqbn4h6zl246", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407762, "uuid": "f8973ec3-4f89-4f6c-8353-86a2e3c882fc", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407762, "uuid": "00c4bbdb-b74e-4c52-8dc1-41bdd02e84ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407762, "uuid": "fcdd67c3-16e8-4982-996d-8085d15cd372", "value": "a18c99ddee638000c03a757517e535ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06790bdd-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365102, "uuid": "d4bfb4db-4b99-46bd-9d72-5e659ae0dc82", "comment": "Malware payload (Mirai)", "value": "247a57d263ef6cda39fcc7f36ed239cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365102, "uuid": "0de1b65b-d849-47f3-b060-0e90af5498bb", "comment": "Malware payload (Mirai)", "value": "6d9ba03c102b4c4056e2479cc5170ed2e1b95370b6f6ad3de6f5695cf1abe019", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365102, "uuid": "bd4e3784-ca23-4df9-94fc-d100d7a2311c", "comment": "Malware payload (Mirai)", "value": "7e31995a75d05d195fe274a08bbd52e1b4045011", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365102, "uuid": "d1e9bbde-8ecd-4a7e-8a5b-6e7571f4bd78", "comment": "Malware payload (Mirai)", "value": "cb903b3160c7fe409f6087ead11619d477ef026d5c64a90ee55adb24e9bec27f37e557d26c713868bf864504d89b11e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365102, "uuid": "f33467e0-9c8c-4ba4-ad49-b0626d1c01c2", "value": "T17EB2D03C1B110A98DA0EC1BE43AC1B513CB81B3591829D4B6217FDC7AF968747453BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365102, "uuid": "e7eabab3-cd78-40e4-b523-f33f1a48e7ed", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiyEmdtJgGlzDpH7uNj1JAm:YeD8ZSWvZHZbs1row697qohQvg9hitJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365102, "uuid": "c9b17eb5-3471-4641-9afa-54ed581d4b3c", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365102, "uuid": "80c61946-4123-493d-8d7e-4d0098a520ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365102, "uuid": "70618e08-3669-4a1c-a41c-6df97e4bc19c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ee509f-2ba0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690368079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368079, "uuid": "bdb29b51-306a-418b-81c3-cf2a31c7b9d5", "comment": "Malware payload (RedLineStealer)", "value": "26876f4a5c21fe2a876e64ae3b9045e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368079, "uuid": "af324df3-5448-4c97-8f0b-eb3cf1f7ebdf", "comment": "Malware payload (RedLineStealer)", "value": "6dd993cadea9e368a14c0ab840b0e2d0dd3ca3d699734998da4237aed7f2354e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368079, "uuid": "f470a3a8-6136-4712-b637-930447e1a760", "comment": "Malware payload (RedLineStealer)", "value": "e59a29178e77d2d1b3c2bc30361734bd30c66bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368079, "uuid": "8b9e2fbb-4cce-4aba-8894-dbb311d666aa", "comment": "Malware payload (RedLineStealer)", "value": "53110b884e7efe47d1b5a34af1d9bffb75108d5f6244fcd352ad35f8e3e52d39f77e6557e291d5c1f35c6f8d7f6c4f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368079, "uuid": "41d4d9df-428f-4728-aef0-97f0603e5844", "value": "T15984F117A7FC4072DDB917B01CFA02830E36BDA1A97947AA2349690E1DB36D0D97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368079, "uuid": "32e4e6d6-49b5-436b-908f-a6314866c4fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368079, "uuid": "35253947-7993-44f2-a40d-efb469a9d261", "value": "12288:/MrVy90Eq1lOrOvngS/o3QSoEOOBmMvv/:OyZOvDo3ovY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368079, "uuid": "c5a78b06-540a-4a7c-91d2-4c08299b00ac", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368079, "uuid": "0c06ce13-c438-420a-b575-a54b9ff7850c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368079, "uuid": "7a3576d0-9740-4a9d-b4c3-885c788bc8e7", "value": "6dd993cadea9e368a14c0ab840b0e2d0dd3ca3d699734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9221b9a-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1690379227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379227, "uuid": "23f132e7-417f-4e49-aaa8-bf2432b217c2", "comment": "Malware payload (Heodo)", "value": "247a8cc39384e93d258360a11381000f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379227, "uuid": "15154dbb-bf0f-41f0-b8d9-2ce7c3a60835", "comment": "Malware payload (Heodo)", "value": "6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379227, "uuid": "f64fa086-0a8b-4fa3-9d11-326f756baf17", "comment": "Malware payload (Heodo)", "value": "23893f035f8564dfea5030b9fdd54120d96072bb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379227, "uuid": "46bbce91-f76c-41b2-82e9-d47b3e068aac", "comment": "Malware payload (Heodo)", "value": "06e83a7d77df31f4e0bc3f8f0deca3c987aa2d4825647d851c525a036380f092fdc3c4c043dff9116f33542d47a0816d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379227, "uuid": "348d8555-e6a2-42f8-ad0d-f6eeb07f5269", "value": "T1A895AE4273B7F022FE9BD132565EEE06317C6C643262E56F239C3869D9301B2663D62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379227, "uuid": "925a3e66-fdcb-4238-aa78-4520b56d294d", "value": "24576:ftncpVGP4I9FsEsyt8l+E+s1tB7parWM0+AL5QgZQvUXtAqlU0ZyMRp:epUP59FBJZEH1X1arF0vN/nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379227, "uuid": "d975ab16-2081-4ddb-ab81-9c03935cd27b", "value": 1921024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379227, "uuid": "82fa456a-2963-4433-b927-347e931ace8d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379227, "uuid": "d96c2760-c1bd-4d64-92ad-6253b4406f19", "value": "Project_1650464.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4144dddc-2b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690358759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358759, "uuid": "b5b37a34-aafa-4aa9-98eb-6aa9c694555c", "comment": "Malware payload (Amadey)", "value": "1f1dfc733bf06bfb281880445b8e8507", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358759, "uuid": "9b3efdc3-5619-4ac6-b5a8-bf66f7efb066", "comment": "Malware payload (Amadey)", "value": "6e1ca7d8d7a0c42eccbd5723dfdd5c856c5bb683313ec6d6d042d9ba90afced7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358759, "uuid": "4e22afd3-961a-47ff-afab-0e0943bada04", "comment": "Malware payload (Amadey)", "value": "f386c9d5de54b5f5e8d5c30432813b6bd5f5167c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358759, "uuid": "51bc481d-2560-49a0-90ac-716a9318749b", "comment": "Malware payload (Amadey)", "value": "9e898171dd28f05ba45f5bfef59bba7887197c34e826bca63178abdeef2ad244b66b6188c55b8d8a5f0501ed70b52e26", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358759, "uuid": "d6d2d084-e1e1-4582-b166-030a986d562f", "value": "T1CE840262E7E94473DABA5BB028F603C31B3A7CA15D78835A2345AD5B0C73694683173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358759, "uuid": "641b6e88-eedf-41a6-8ff3-fb54b6674c0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358759, "uuid": "276d4e35-de27-462f-b647-2d9a30c832dd", "value": "6144:Kdy+bnr+Op0yN90QEuUW3eVlNDncJAfIjLX8eunbs4eFmWQN4BlZlNwHixfT4Z:vMrSy90sU+e9o6feXBudNAlZleHjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690358759, "uuid": "797ae81a-e99e-442d-a229-236deb108fa5", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690358759, "uuid": "5c7de8dd-24c9-466f-94e5-22c43fb1c14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358759, "uuid": "03d12e19-9ff0-4116-9656-3157e86755ed", "value": "6e1ca7d8d7a0c42eccbd5723dfdd5c856c5bb683313ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f659f5d0-2bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690374954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374954, "uuid": "04e927bb-d4ab-4b44-b552-6ebd09c6f97a", "comment": "Malware payload", "value": "9383c85bcf54cd0f5b0e2d0fd17ce360", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374954, "uuid": "dcddf50d-654a-4104-b344-c3466f3ffd52", "comment": "Malware payload", "value": "6e31cf41c4bc4a5f7933018e05b5cfbceb0d0acac6af32f2143c2567b5145e51", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374954, "uuid": "582fa515-4569-460d-936f-9d62fd0ee928", "comment": "Malware payload", "value": "d99e297f74836e43deb2c8ec5d6332df2f82de9d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374954, "uuid": "0a0070be-8abc-4b5e-b64c-5f47450c475c", "comment": "Malware payload", "value": "0bd2771e76e7b285fee8c7d0137fc45a1c4a6d54545bd3aa6f640f25b678f748e8ca5a053a3fcc645a01f40eb9c0b414", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374954, "uuid": "cd4b0f19-a444-4f50-af5f-0c0531efc501", "value": "T137F42329D40B4B49C9D83E333F6A31B5327526BE0DECA193A375671CCCC346AA2579E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374954, "uuid": "c1b4db60-baeb-4ece-ba86-f3188692b494", "value": "12288:ZpUekDl102WhucasyEXomYaxfKL1C1Y/UZUx0SLIbcjRaFOsUKbipv2C6bZNgXJ7:ZpU9qucaaomYwfKI1y/kFOjKekCSZ6NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374954, "uuid": "dd44bfff-ea71-48a5-949b-6b32dc0e0a33", "value": 774265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374954, "uuid": "00aef4d3-468a-4a8b-8cea-5134456b9712", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374954, "uuid": "6363b209-d679-4133-a9ea-874611bf5026", "value": "QUOTE ORDER-2672023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3fd4a7-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690377702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377702, "uuid": "90bf143a-b293-45c6-ac99-2eb4f7ad63c4", "comment": "Malware payload (RedLineStealer)", "value": "59ccc6a4f886445fd8dfa9d609a16a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377702, "uuid": "2caf5e65-d946-4b5f-b648-78f440575b4e", "comment": "Malware payload (RedLineStealer)", "value": "6e54dc48d8c1a4b395ac6f85cd404e2abef7282f987c6402fc3bae7f3dac3e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377702, "uuid": "6d14664d-3bc0-4789-8b13-9d7544b70456", "comment": "Malware payload (RedLineStealer)", "value": "02b78bc0cad0bf79f8eeaee10c1345f0fd1424bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377702, "uuid": "ff594942-a9d0-416b-b9fb-35a193a0374b", "comment": "Malware payload (RedLineStealer)", "value": "a365b803b7931761969fe791ce02611dfc948adbb77f59d2da290d48cff1281cbc1bbb6be06ad6d9abbb7801d9e9407a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377702, "uuid": "4e8ad46c-1edc-4b13-b5b6-dffd8c513053", "value": "T147840103B6E88533D8B51BB468F713C30E367CA49D78836B2285A95B1CB32D0A57576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377702, "uuid": "fba0c718-c024-41f9-a063-8e2b5a11ee61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377702, "uuid": "3e20429d-fa8c-475f-9468-e500fa0ebbb0", "value": "6144:KAy+bnr+Bp0yN90QE872vLYj9YVv/BS93bYT94XtO9HWGmxb2ya1EC7ms1HX:8Mr1y90PyYd/BS93bYT949OhW9W1RVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377702, "uuid": "041cca99-8d6d-4a10-917d-0bb96f7023c7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377702, "uuid": "b447a536-eb11-447a-b561-77a08eb99931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377702, "uuid": "50c10de0-c421-4eb7-9241-28370f4fc363", "value": "6e54dc48d8c1a4b395ac6f85cd404e2abef7282f987c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71affe7f-2b6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690345525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690345525, "uuid": "261dd9d6-a5db-44d5-a83d-34e519415649", "comment": "Malware payload (ArkeiStealer)", "value": "e92a55acaae972e262ff0093a604061a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690345525, "uuid": "7066d2b4-97af-4ff6-9d90-1a36756a9ba9", "comment": "Malware payload (ArkeiStealer)", "value": "6e6795f8621d875b3dd1721cc49ee86477d19101854669ffe823dc76b3c0ce90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690345525, "uuid": "fb9f9975-a98d-4f96-9fff-2c0f605ebef8", "comment": "Malware payload (ArkeiStealer)", "value": "94bb2f83b8b2decd3bbae745ef5c1634c2ac30fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690345525, "uuid": "def0d1b8-52cd-4d33-aea5-b62f7d25b933", "comment": "Malware payload (ArkeiStealer)", "value": "4b3619b7a5b2daa47adc35bdef3515f05d590d5da4d534001b1fd29a27eca07fd27191e62aeb183aed74863d530a8878", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690345525, "uuid": "42bb7dd5-9b7a-43d6-bca6-1fff0dbc8434", "value": "T16DC533BC39DD864FE6513A3DCDB0DB39B3339E941C9284027F82264DAB6D29C30AE555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690345525, "uuid": "4b2fc507-c0ed-4805-9e3b-5e23549b7b62", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690345525, "uuid": "a3863c4d-aec0-4598-b292-9c0e8795ebd2", "value": "49152:8/K3iQMmKXX/+ChZyRjWkzipXTk7EhbYE9WrsDm050Xh7:oKo2AZC90Xw7EevoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690345525, "uuid": "795d8e3e-dfb5-4f63-8b84-ece97e1def54", "value": 2576168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690345525, "uuid": "a4ced847-abd0-4765-94e3-02753a8bc6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690345525, "uuid": "8f18c744-7ce2-491b-8b56-f6f69228e297", "value": "e92a55acaae972e262ff0093a604061a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a765b47b-2b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690354205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354205, "uuid": "10978c10-90c7-474c-bea9-ef72290be8df", "comment": "Malware payload (Formbook)", "value": "9b3e3201e17442a58e6ff7de9a19f2a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354205, "uuid": "18281dea-a6f5-48e2-a262-a70cbfe53460", "comment": "Malware payload (Formbook)", "value": "6e745173728ce6d87d82bada51291e433dcd5f72465c8610ce2027a01841299b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354205, "uuid": "c9e1b47b-7873-400c-b631-0a46955107af", "comment": "Malware payload (Formbook)", "value": "dd8886555f629e13b8c123fb93faa35d6bf4c7de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354205, "uuid": "6aeecfd5-ad44-45c6-a325-789c2021f61c", "comment": "Malware payload (Formbook)", "value": "e82fc722f72aabdf340032001e9c00bccff7193b2d304345b7927e2b5cb627941e159a32f4fd55c3f4b0c8fdea707300", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354205, "uuid": "5a1d032f-c5df-46d7-9c77-3e831ec8a84b", "value": "T13C44E50776459AE0C3486771C3E7022093B5D6D776F3EA8A3E8A12E50D067A9BC496CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354205, "uuid": "820eea00-0bbf-4459-9122-ca63f7920a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354205, "uuid": "c9307fda-08e4-4d42-a808-1c6dfb165e13", "value": "6144:xoJYB+N/DZSwpnxiBh2CSTaR0VvVbfJx4rSvUs:WJo+N/5UBsQ0Bx4rSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690354205, "uuid": "abc5b8a6-d9ac-4a23-9444-d7c827feb9c3", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690354205, "uuid": "17bb88ee-6371-4a57-8e55-3bcef92a727c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354205, "uuid": "7d486e9a-457f-4e26-a0fa-6e57a36918ae", "value": "9b3e3201e17442a58e6ff7de9a19f2a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542ddd9c-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356643, "uuid": "e3cd97a9-e858-4cec-ad3e-4883514ec9ed", "comment": "Malware payload (Amadey)", "value": "c7aba6b49b1f8e26d27720d206ea25fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356643, "uuid": "e09f35bf-0974-4134-934b-cd8b235ef4c7", "comment": "Malware payload (Amadey)", "value": "6e82020ff55a7d6f7f163fcd134ffc3a317e7295a6b119e3897af1a14013ab00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356643, "uuid": "9bc5f11e-6844-41d0-b5ff-3b66259da874", "comment": "Malware payload (Amadey)", "value": "7bd4eb0a8c06baba30ecda07db847725a4695caf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356643, "uuid": "53486a73-f99a-4038-83be-c20ed9426d04", "comment": "Malware payload (Amadey)", "value": "5c8f53298294abbd5dfecc19584f9a18320bdbb781e37ae92eb23c77ae34b44d223d6ba495d5dc0cf64da88a9967cb76", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356643, "uuid": "6edec490-a6ce-4ce5-a2ba-773adb148602", "value": "T14084025276D89072DCB52B7048FA13930739BCA15D7483AB339AA95F1CB33D4A87172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356643, "uuid": "7f13c52a-fd22-4a28-bbb0-42cd112b7dae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356643, "uuid": "df574b37-d2b0-4719-8280-0b8c365127e1", "value": "6144:Khy+bnr+Lp0yN90QEldp6OLGUCRYjmIYLIZIl7zeh7oFgq+LQioyzy:/Mrjy90lsO3voQIl7zG7om1vP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356643, "uuid": "30f7241b-6a5c-48ef-bd8f-4d074adc56bf", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356643, "uuid": "4d9934be-7f3b-41fc-9d92-ce7ceb2fc115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356643, "uuid": "db3dd658-9a43-4f16-8cae-5ff4bd0c70f3", "value": "c7aba6b49b1f8e26d27720d206ea25fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cf2b2f-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385091, "uuid": "3f5a442a-a7b4-45ef-ac4b-c4c4dc2d5065", "comment": "Malware payload", "value": "21e08176b04b091f010d1806549c080a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385091, "uuid": "32816b9c-9ad8-42e2-9e48-4b684e0fccc8", "comment": "Malware payload", "value": "6eaf2e8598e55c3e4f6c5040411f20a2c91948023c69c08a6c65434b54bb0354", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385091, "uuid": "d8a54231-3520-410e-a807-5e86e7622313", "comment": "Malware payload", "value": "ce6d96a71214d95416a4e43f1abf260cc0a2493c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385091, "uuid": "87faba29-9ead-4b9e-866b-24bf73a5ffbb", "comment": "Malware payload", "value": "8783fbd85e0e9f3a900184bfd9bc549c6825e1169ad0f2e557af871e8d33f44f12250bb3ff6b1e61c40f501c16a3bcb9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385091, "uuid": "f74af17c-eef2-4e9f-bed7-8aba56fa999a", "value": "T11213F55AE39F0264CF5112B2631A1E88A6BDB23EB35151B1786C933433DDC7D4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385091, "uuid": "9d6f9b5d-346e-442f-88c7-18593d823ee7", "value": "768:bFx0XaIsnPRIa4fwJMHfaZ0ByYrii0CicgJ1OX3Qf:bf0Xvx3EM/hyMl0qQYQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385091, "uuid": "6500ae36-e050-4be1-992a-d5e72c984cd8", "value": 42075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385091, "uuid": "e0a8f8db-9614-44d9-a078-c691777a1c2c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385091, "uuid": "2b818ad2-7307-4fb6-ba89-e5dde04df6aa", "value": "Payment receipt -24768000321.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d093f8-2ba8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690371294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371294, "uuid": "a2e069bf-65ca-478a-9453-419d6732c291", "comment": "Malware payload (Smoke Loader)", "value": "63b8c9c89e0b10b82eb8052220107b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371294, "uuid": "08647660-f233-49be-8826-86b4c1f084c9", "comment": "Malware payload (Smoke Loader)", "value": "6ecd0653e1f6a054b1f6c69a12ea5cf149b86a65a9379ad81233211dbce3bf65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371294, "uuid": "a7968917-b849-4e9b-92c3-6bad8098d5f0", "comment": "Malware payload (Smoke Loader)", "value": "38687bb02decc4993e5703afb93eb906f8e9b7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371294, "uuid": "749337f3-7b01-40a5-8b95-3bb848939825", "comment": "Malware payload (Smoke Loader)", "value": "95fd68608a6c9a6a0ea598a22f71df3a12edba574a2fd412be423fd4aa33585c8e849a1e144cdd57ea0b4aae46e14582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371294, "uuid": "bac6d5a0-1e7a-4121-818d-82ad10d1ffc2", "value": "T12174B74383A1BD54E9258B729E2FCAF8760DF6718F4D7B66A128AF1F00B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371294, "uuid": "748be479-fa1c-4785-ab40-14c450bb9fdc", "value": "28e47df11fcc31ecc5eec0c4cd0746c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371294, "uuid": "97c2a0a6-2d18-4f75-bf9d-e9a303a7ffc8", "value": "3072:w15/fuFgLLgFbHq64/tx1/22lfNjKIz5g91R5EYwlGvPGT1lTUZ:65uFgLLgFbexB2gS975EYjv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371294, "uuid": "f451c15e-8f3e-4b7a-be1f-4fcd9319cc2e", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371294, "uuid": "447c8e61-630e-4d65-8f49-a2d76f1ac344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371294, "uuid": "922e21eb-7edf-4ce4-b418-a8be12526eef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ce6960-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690382732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382732, "uuid": "08f13e03-13c3-4e32-935a-10a6bf8c981e", "comment": "Malware payload", "value": "0fd085fd02e97b5e27d4bf052c8f9085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382732, "uuid": "07008605-6f0d-43bc-be92-63b7563c5921", "comment": "Malware payload", "value": "6f4d69c284343c68c683389aa397095a89e85abdb26968ed53a6f7e372ead78e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382732, "uuid": "32b4a936-d4b9-4e7b-89e8-59ff4f16e4f4", "comment": "Malware payload", "value": "1d76c16b3e51e463d47fceb76a7b6413b3bb05d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382732, "uuid": "87c53b9e-957b-4000-9469-c419a5a14649", "comment": "Malware payload", "value": "0ae5e9c06ed6e3be2ae3623cc18baf5284fa8906730210f9cb9ee28464780e40561d4140b033cfed7ba64ba21d60fcac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382732, "uuid": "469a861d-8b68-4b4b-9335-98cc19c2a7da", "value": "T1AF652261B6C18470D5A619322AE2DB747F7C7C311B798EEB53845E1E9F218C0AE307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382732, "uuid": "4c7b0c3b-79ba-4b8a-9ce7-2453424f8140", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382732, "uuid": "bd14d3e3-1da3-44f3-b14c-5210b864cca4", "value": "24576:8cbD/e1EB9Ygea/wp1YbSWvMCVQ91TKbX5t0ddyc/vFMDBCaHupgAuCXG+PD:8cbi6me/wAWcMCVmW58yc/ODwasSO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382732, "uuid": "a8a2ddeb-8fd7-4ba2-8a6e-4d3ef418de59", "value": 1510952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382732, "uuid": "4aba0dfb-8088-4708-9ad5-f416fd62407c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382732, "uuid": "7e7f5254-b238-46c4-a505-8266476fd629", "value": "0fd085fd02e97b5e27d4bf052c8f9085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f594a487-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690365074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365074, "uuid": "16f030fe-c8ce-4aba-8de7-6cca4fce4b44", "comment": "Malware payload (RedLineStealer)", "value": "9f4d4670d37442430676f787a7fdc935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365074, "uuid": "a26f4a99-7b15-45fb-a64b-580af858933f", "comment": "Malware payload (RedLineStealer)", "value": "6f637b6186be499e8f6a15487749b7d114a9b990ca7ad712a5a91d6cbc0cc910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365074, "uuid": "bab01e8f-2ea5-4912-bd88-5398ecde10d4", "comment": "Malware payload (RedLineStealer)", "value": "ce91162bed692dd2c07c21da0e74239ee2e3d517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365074, "uuid": "d16ec85e-10f0-4606-9a84-1e67d845eca3", "comment": "Malware payload (RedLineStealer)", "value": "1c9f4970518974aafe2bbfd9d98b49cbcefa0e9ada16a8be6f2f28bde606c3df9101a17e4da4655e00f8c7c6cf3a40a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365074, "uuid": "5e7d2537-cd5d-4b92-a8ba-77a29cae3c2d", "value": "T12F840246E6E98073D9B627B018FA03D30B3ABD72597C836B3395995A0CB36D0953173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365074, "uuid": "40fb92d5-58e3-431d-a152-c8fd5bc5a6af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365074, "uuid": "173b6d72-9438-4d2b-b9af-d7fcfdb39ea0", "value": "6144:Kfy+bnr+gp0yN90QEgQVItny+AljHRp0NICatvzH1emjWNFNS:9Mr4y900ty5IPuAdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365074, "uuid": "a62f4a7e-e473-4b1c-b605-a3b3dfa881c7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365074, "uuid": "0e0f007b-77f0-42a4-a978-1ea2758bd17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365074, "uuid": "6d6d0c6d-2c56-496a-8163-eda5b5d14d81", "value": "9f4d4670d37442430676f787a7fdc935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96229493-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690385530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385530, "uuid": "4fc52be3-a4fa-4982-a73d-c10fe3db7208", "comment": "Malware payload (ArkeiStealer)", "value": "c1643d4945e476db2c51b861ef2011db", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385530, "uuid": "dcf9330a-55f3-4dc5-b227-e0193fd6ca73", "comment": "Malware payload (ArkeiStealer)", "value": "6fab6bd5ade42ca49925d745d9d1a388d7636194b0f0fa5128f3eea913c13b6f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385530, "uuid": "73efbf57-7ac5-42b4-98c1-c3850065cb03", "comment": "Malware payload (ArkeiStealer)", "value": "46574069f583248f31d449d917ec1e5417445a37", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385530, "uuid": "46c52888-97f1-40bc-aa87-7158914551c5", "comment": "Malware payload (ArkeiStealer)", "value": "8b221da7560816589f0e338654ff76cb6550cd2dbc619ddc5a1d616b6c35630fae03513d73f4640100b2ce2da6ec5547", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385530, "uuid": "19f19912-93fc-474d-a9f6-291f2ed50b0d", "value": "T14205BF8393E1BD44E9258B729E2FC6F8360DF6508F4D3B66A6299F1F01B51B2D173A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385530, "uuid": "f9a3f3a7-53e1-4e30-9686-58c932eb0812", "value": "bc04db2ad2507103ec76e744e96f25ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385530, "uuid": "99dfb82e-788b-4ac5-b0e3-bd6af9a07920", "value": "12288:dd8QbmOk5C2DNmGyb7eqEaWb/Owo/pBSdksXQLJG0DJ0RDjmz:rJmZ5puCqX+/GpBcnXQLJG0DJijmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385530, "uuid": "b70172f6-896c-47a2-9f92-3df2191a93d5", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385530, "uuid": "1f2f34d1-b6f1-4b6a-ad84-3a45ad581937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385530, "uuid": "aabfaf8d-7107-4fbe-9827-992cbe4adb37", "value": "c1643d4945e476db2c51b861ef2011db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77459829-2b96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690363574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363574, "uuid": "9b42a219-1698-4668-83bc-332d69b71ba4", "comment": "Malware payload (Amadey)", "value": "4a75dd3c03d13ea995053559c9b1492f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363574, "uuid": "20243de7-fd6b-4bcd-bd31-66440a27eff3", "comment": "Malware payload (Amadey)", "value": "6fbb311967f938c3aa06f4ce9621e99c6a184fc7a83db585070727d4ccf65c0c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363574, "uuid": "314b6972-0f50-4e7c-9919-5a7405e5a0cf", "comment": "Malware payload (Amadey)", "value": "3d5a72b9672507ace0db398d91151ab529fda1f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363574, "uuid": "1306541e-dfcb-4ce7-9518-7e330d20bc2f", "comment": "Malware payload (Amadey)", "value": "321698a98ab7adf2274d67f34b8d2982fac096b7f034106d7964322dbb896be7341fa8163bbac016ea910ae5eb9c0409", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363574, "uuid": "7915253b-6271-487a-ade5-f1025c582a16", "value": "T164840217B3D95173D9BA2B7058F203830B31BDA29D78D35B2B45AC9A6D725C0A932337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363574, "uuid": "1493f0c7-7d76-40f1-8371-b7fe61d188e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363574, "uuid": "cf8c650e-903f-4ef0-9b88-0b28060515db", "value": "6144:K1y+bnr+Vp0yN90QENVsaozshFcebljXYecbDJcgzDs3fvZg7XC6vDpydL1:TMrhy90lLishFrtXcz0bQFeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690363574, "uuid": "b22dff79-3c56-4296-91fc-e1366aaa448a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690363574, "uuid": "c606f9ed-9a78-4cd3-a6a8-c5f04a87599a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363574, "uuid": "944dcdb6-3db9-47a1-8925-51b28c6b7abc", "value": "4a75dd3c03d13ea995053559c9b1492f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7626f14-2bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690374096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374096, "uuid": "756810cd-2ba1-4fe5-87ec-b07ea0e53f8c", "comment": "Malware payload (RedLineStealer)", "value": "ba2567afc659e18e08b8afacfa2532e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374096, "uuid": "64402a14-91e2-486e-aaa8-a9bd293b0274", "comment": "Malware payload (RedLineStealer)", "value": "6fd2c32ad277718e5a37150c886629447a73feeeccfa2543d7646602b5c96760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374096, "uuid": "46bce753-f486-4b2a-aa8f-f52f5af0470a", "comment": "Malware payload (RedLineStealer)", "value": "d0a25ff04df64e6e2be297af02eefa31c0f7f5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374096, "uuid": "b0a4f8de-302c-44e6-9a06-07b79a087677", "comment": "Malware payload (RedLineStealer)", "value": "bb7c4f743df431d8c702b5fcea737e2d50b13add1b0f7aeb2b42b0d333920112aa5359f842dc27c6acb64c0dddaed906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374096, "uuid": "b6e58d2f-a12a-48ce-9e14-e7c7a149a8bd", "value": "T190840203B7D98033D8B527B06CF6069317327C61AC74836B2785AD5B5CB26D4A87276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374096, "uuid": "c852ddff-5208-4d07-a0fe-64ffe00647a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374096, "uuid": "21c74061-ef9f-4f37-b8e4-1a464e1a9616", "value": "12288:CMrdy902bXfUn6m2AKxh16htBgBYCXYFPLAgi:HyLbXTiKxhoXKzcAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374096, "uuid": "e9aa01d3-d5fd-4bbd-908c-ab3ec9af1429", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374096, "uuid": "a5f78880-18da-4269-a0a6-78a79296b869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374096, "uuid": "fee7825e-e7de-4ba9-9b53-462e422fa3db", "value": "6fd2c32ad277718e5a37150c886629447a73feeeccfa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735bc016-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377740, "uuid": "23348a88-fbd6-4edf-bfc3-3ee258caa530", "comment": "Malware payload (Mirai)", "value": "996d6e6ffe54b03717bd3aaaf5a4bfff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377740, "uuid": "e9a64044-1d45-4dbc-8c5c-a8b844c5bbe9", "comment": "Malware payload (Mirai)", "value": "70300e3ddacb8c63bc416ac8e071bcb3dbc18fe47399ab7c2ff1002bd0faf3ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377740, "uuid": "3ea38ea4-808f-4571-8b06-80bd53fe7471", "comment": "Malware payload (Mirai)", "value": "c8be011a423f80882ef4675533408972708938e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377740, "uuid": "cd13a7b1-c836-4f1a-a5a1-7cd6d807bf1f", "comment": "Malware payload (Mirai)", "value": "8a9b937f21fa83a4de08df20a4a9d9ea31f2082afa31c73ea3df3b34b3fa7a3008b377759727391bb7b37aca78beb33d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377740, "uuid": "5377d3f6-5c69-4156-8d10-b24d29ac121a", "value": "T1F5436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377740, "uuid": "8b9dbbf9-78f9-4fca-8fea-c6c6fdda935e", "value": "1536:JeESt/basV2rcZhG6ySN7naDtad1zWOIaEjrqMts:JeESt/basVTgS7naDQdttXESa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377740, "uuid": "bc7271c6-bc80-4b36-9a7f-0a1c40f85591", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377740, "uuid": "b6f772fa-05bd-4ce1-bf46-ae40d9967e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377740, "uuid": "3dc27ae3-9ad6-44f7-8a2e-8fbf3af5ce8f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2420cbf6-2bdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690393928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393928, "uuid": "770c1562-4156-4c42-b4a5-160161c3b0b1", "comment": "Malware payload (Amadey)", "value": "0fe7266db57d324968cd2e8750a0e9cd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393928, "uuid": "1456226d-bff4-4951-8450-20c7a72845e8", "comment": "Malware payload (Amadey)", "value": "712adc9802fe06c2882298ed0302f1ef7cc1c88aa6a75a54f83ad1ae39b56a01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393928, "uuid": "5c97c683-b2e2-48d3-8ed2-364c2006a99a", "comment": "Malware payload (Amadey)", "value": "f9a15fea1c0394ec4ca8d8fe6cb6afbfec43e5a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393928, "uuid": "4026053d-48c3-4ec7-95c2-e2b4cd49e662", "comment": "Malware payload (Amadey)", "value": "cf651f95053a93c6137b1ec8d01d175575d671abeadc666f3d3d17292b051823c075bfa26def4bb9c7f515ce04780e8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393928, "uuid": "43be9172-4657-4977-a2da-a9cde102bb60", "value": "T1DB74F112E3E44032DDF627B118F606830A36BDE19E78936B6746A89F4DB36D4B471327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393928, "uuid": "70ea44fc-71ff-4736-b56f-bc18026f103c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393928, "uuid": "db2ea51a-456f-43a6-ada1-4e6a51a2cb45", "value": "6144:K5y+bnr+Kp0yN90QEKRoc6XHKZwD0IUbZ6eY5RPyBtLV4YMDxbc:XMr+y90OoHawcZ6e6RPy7VbM1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690393928, "uuid": "983c5263-feb7-4810-b7c8-2f7af31ef61b", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690393928, "uuid": "bad36a86-b3c5-47b2-aef9-5c339057e8d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393928, "uuid": "ebce684e-0c93-4e62-9916-ddb395e2326b", "value": "0fe7266db57d324968cd2e8750a0e9cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cef917-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407732, "uuid": "d5f49f53-6bbd-488c-8a3d-d396c22e8479", "comment": "Malware payload (RedLineStealer)", "value": "0f6e9123147c19f2467905401e618e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407732, "uuid": "6bc4c726-ce5e-4d91-bf39-1f0a37386386", "comment": "Malware payload (RedLineStealer)", "value": "71d1420ff1b7b7e37d536b943d3ba7e0a2fa5972fce4156cbbc73c7416d49d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407732, "uuid": "1fc7bf50-19a1-4da4-a548-237597be5e5e", "comment": "Malware payload (RedLineStealer)", "value": "917abbb6f211d4a7662c8f05947e799452691601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407732, "uuid": "65f2abd6-7785-4893-9971-04c471b18533", "comment": "Malware payload (RedLineStealer)", "value": "a665994654ad89bcc81efc51d539594ca4d41a1e7674f5e450b1ab1a806cc95464e1555b4c5ec6fe9997ce3e32f0ca85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407732, "uuid": "518f51dd-600a-4abf-b4ae-d4cb81f3db5e", "value": "T158840101ABE84473D9F52BB058FB02830A36BDD15D7893AB27946D5E0CB3688993137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407732, "uuid": "492837dc-0f97-4b10-8698-158215da2325", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407732, "uuid": "a9982e70-bafc-4452-8de0-fbf97944b643", "value": "6144:Kvy+bnr+Kp0yN90QEH1EEZn+h2FJ3GVHY+M0NoAsjLSTJHAcihT9/2U8sC2dQ:RMruy90cETW4YdJHnihTcU9BdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407732, "uuid": "e9e3f609-9c8b-4ae2-a5f9-d5f3bb64b13e", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407732, "uuid": "ac9ab84e-12d6-4dcf-9215-cfc4bd497e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407732, "uuid": "885a596a-7723-43e2-bce5-126acd710b5c", "value": "0f6e9123147c19f2467905401e618e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d841d9c-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351451, "uuid": "0b5581d8-ff67-4cfc-8ce0-eb36545b92da", "comment": "Malware payload (AgentTesla)", "value": "1fd5a4350a69f444dbb63519934aa9cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351451, "uuid": "b28031d1-f288-475d-83fd-e163cf0beba0", "comment": "Malware payload (AgentTesla)", "value": "720c14df6f2d506a3b9b43bed4a59495413b9832f9b079c81fd71992db6f659e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351451, "uuid": "89b9337e-5da7-45f1-ada1-ae757f01d72b", "comment": "Malware payload (AgentTesla)", "value": "7c9eaff7a0801c176c3ce49ca3314608863fc7f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351451, "uuid": "099413bc-9622-44b3-9755-813f5976b323", "comment": "Malware payload (AgentTesla)", "value": "719f577f052303628fcf0310f3e9e0dc549ded316663703559b389933839977dacf5b9624a673e00dddf1a43bb455d36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351451, "uuid": "65bf3c5e-96bb-4c2e-b358-c90081ac3996", "value": "T1D125E41B71DE4177FE145EB00C2A4B388FFDB11D650EA50BBC25CE8A1E7DA4C81AA746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351451, "uuid": "6b68dbbe-3728-4505-9bd4-5576ba1d0efb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351451, "uuid": "412a4530-f023-4e9e-98d4-38f079f39c7a", "value": "12288:M6PrarrtCeqhO8ZWEsn3MaJL4l4mGYRJkIaencUrQ254m1P:xrarseTlJklgYRJkIaxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351451, "uuid": "22f3113b-cb04-487d-be78-85e21543ad0b", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351451, "uuid": "39eca94c-461f-4afc-8fab-a3651bfbc0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351451, "uuid": "b84d033c-60f5-425d-9df2-85710d48436c", "value": "CI-23JC0607-TWO USA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1420a496-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385312, "uuid": "4ba9ef07-4a63-41b6-b78c-7e6196abcfbd", "comment": "Malware payload", "value": "3834e3a0c191a3cdfb7c2eb87d1ad67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385312, "uuid": "04d76fcb-fda5-4eed-9343-f19ab0a71100", "comment": "Malware payload", "value": "7220fb78b69132fdee941d24fe055af1c8c97640abadfbfa535c032f5b98f4da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385312, "uuid": "192b8393-7607-4780-8881-1d10302b2276", "comment": "Malware payload", "value": "c451e4910d5123fa2d9ac2b2c60b6da3f1c2e7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385312, "uuid": "f5079054-7118-4086-bd78-0335abc43f41", "comment": "Malware payload", "value": "2c679cb651b5cb205f6d8a27baca04c64e7e1d3dda044540f13b7173205243c6056fcdb26ed8633ec34f8cd36342e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385312, "uuid": "430c9752-703c-44c8-a655-7ae4eed9ae50", "value": "T19AB42319F286085EF40E187841EA570ABB9D9D1FB87FAF9DAF0D408B1BB437D44426B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385312, "uuid": "13f86944-3a0f-431d-a5f6-5bf376891cfd", "value": "12288:h1gl34t1svw4vxRHOtmuJb9YB3oAUVnzhl5rH6O1Vw7a1Hum7PHy:g4tCvrvT7uJb9eo3BVraO1Vw7axug/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385312, "uuid": "9b64853d-6472-42d0-97a6-d520847401a1", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385312, "uuid": "135a9876-aa4d-46cb-bd0c-3901ffc26d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385312, "uuid": "5c753603-2fd4-41b7-a59e-009a30c9c760", "value": "PO23100080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd26373-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690362078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362078, "uuid": "6fece8db-be3b-448b-a393-97eb3b24f637", "comment": "Malware payload (Mirai)", "value": "c399a33129d05aa81e09856b8c7d95e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362078, "uuid": "1231a599-64e6-4e33-8fcc-f91ee7d31f31", "comment": "Malware payload (Mirai)", "value": "72440e80d3dbaf4aabd523acd80d777a7ac7389e9c838320f11e6652915f990d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362078, "uuid": "99a19e1d-7dde-48dd-945d-e53e8db869c3", "comment": "Malware payload (Mirai)", "value": "c1f5679a87ba29f332c8adb36c2779b0fc4cebe4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362078, "uuid": "cdcdc2cf-6164-4e16-b7e6-d4ec1ef1bf28", "comment": "Malware payload (Mirai)", "value": "b5fedc880a5e2fdc8f3448bb427a3b01f3b7bd95184ff9ab04e7d03cf09dfe80c442814354ccb32ca70b7231bdde7e46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362078, "uuid": "0b313575-393e-4c34-a8c3-1cbc6cdc2ad4", "value": "T1FC533B51FC819712C5D152BBFB6E428D376A53A8D2FF32039E256F21378782B0E6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362078, "uuid": "4b952389-d749-433b-ad51-2d8c4af252ba", "value": "1536:+GpxKB6Y8w/mEmX7pfHRUD7Uruoh+XWUItKHqI:+G6g0VmX1HRUD7UrQXw8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362078, "uuid": "c2c19600-35ec-4c4b-ab39-9901e01ae4d1", "value": 65420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362078, "uuid": "11150b41-11f2-4491-a0c5-2bf19d7d4e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362078, "uuid": "98e8929d-140f-49f4-88e2-4b66fd2f39be", "value": "arm5.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c463116d-2ba3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690369286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369286, "uuid": "62a19b3d-a6fd-463c-8bf1-c4652023d841", "comment": "Malware payload (RedLineStealer)", "value": "5d5c8c273470134de6b48a6263c6ba07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369286, "uuid": "15f7fb4b-19bc-403c-8dbb-a88af4b74cf1", "comment": "Malware payload (RedLineStealer)", "value": "72cd6bd93142d02a387b6e4c6141c7e9b258c2f3a3b28fa0039d71a60f7be586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369286, "uuid": "84927e85-942d-48da-b68d-e4f503f5d714", "comment": "Malware payload (RedLineStealer)", "value": "fc35dd9ba32c68bcd609edd6c30b4e12f602c191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369286, "uuid": "71c1a4b9-9821-433e-a759-0943641a3356", "comment": "Malware payload (RedLineStealer)", "value": "639fc9831f48699b931140b798a04e876775f7aa28bc738a48f9c3047a29799c8f726d04e61c4fc9822b903b69644f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369286, "uuid": "86b25e89-23dd-4c98-bd57-b93283638706", "value": "T1FF3408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369286, "uuid": "5c5d166a-c6de-4207-b83e-0650f5a0f668", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369286, "uuid": "f0b38b3a-dd12-4064-a6bc-3f12200a24e6", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369286, "uuid": "ea72b9f9-feda-41fd-bdd8-840621088727", "value": 230447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369286, "uuid": "fee25944-7370-4183-aa50-328e03c02e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369286, "uuid": "c20eb611-e3bc-45fb-a9db-5176e365ca41", "value": "5d5c8c273470134de6b48a6263c6ba07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4804b7-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407740, "uuid": "0d192815-8bf9-49d5-bc59-6c4ac2843d9f", "comment": "Malware payload (Amadey)", "value": "34958013ed93e8c8cb4a7fa5c4d303fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407740, "uuid": "552ae22d-f2dd-4b45-9b69-0b8f7ce4a91e", "comment": "Malware payload (Amadey)", "value": "747238b5bd007fbf264cbd66b42a3fa3d6c54ccb6a1d0ce2c79715650a55d097", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407740, "uuid": "e2a9a65c-f102-4ffe-8a20-0ffdee291c34", "comment": "Malware payload (Amadey)", "value": "2c55415545f09295480119363473cc7ab41549c2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407740, "uuid": "634841d2-16b5-4242-96c0-f8e2de2b8d8a", "comment": "Malware payload (Amadey)", "value": "5b3354f05c8cc3149af41e49be51f23f29c528b8628b9c1d56dd8afd695554cf57fb9447cedd662f63b255ba0f97ab35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407740, "uuid": "95c7c31b-c76d-44cb-9396-0b6ab756df6e", "value": "T1BE840227EBC89073C9B627B058F302930B327CA19975836B3745996B1CB36C4A5B572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407740, "uuid": "4d1671f7-de56-4720-b653-ec2cf69f3391", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407740, "uuid": "e3f68778-d97f-4df1-94bc-64a2247c7eb1", "value": "6144:K9y+bnr+Bp0yN90QEv8k6y00raaOJ3XJzKw9mRy+elgBZ+t4oDYff+agCM:fMrxy90t8vn0lO/Kw6yJlgBYCokfJgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407740, "uuid": "1fa00b66-83fc-4783-b857-292a17eec968", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407740, "uuid": "63f6bdaf-500a-4c97-bb00-32e65a2701bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407740, "uuid": "88ff828c-52e1-4959-a6e9-29a9bd736082", "value": "34958013ed93e8c8cb4a7fa5c4d303fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3deaa6-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690379205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379205, "uuid": "4a838a86-7348-4444-ac10-bfe4be783610", "comment": "Malware payload (Amadey)", "value": "325cf030f204adc01a731f61f8e9b38c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379205, "uuid": "389d854b-6b7e-48a3-98cf-df8c83c6401a", "comment": "Malware payload (Amadey)", "value": "74fe770b3414b7af5432877eaaf1d2520b875a38c461d63983c77f7c1b39d918", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379205, "uuid": "a8c27dea-2c49-4d20-88a9-a4782a5ebecd", "comment": "Malware payload (Amadey)", "value": "7eab8b15f3f6476230c6cc4832f2b1b205844cdc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379205, "uuid": "0bc25af5-23bf-4930-b04d-098025eacf0d", "comment": "Malware payload (Amadey)", "value": "4758ff7ef15b1340ab9c4eadd78c91175535da92c9f8917a8e4a1fa840751756860421e270cb03f0c81a8e35e60c6def", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379205, "uuid": "81fe31ed-33cd-4740-9052-be0c1c826950", "value": "T1F284F103A7D88033D9BA27B458F702830B37BDA58D79536A275A690F0C73794E67172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379205, "uuid": "f443bf1d-1edd-4341-8ad2-eb328aff156b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379205, "uuid": "5a01aea9-2af4-4018-82d7-3797ede4059e", "value": "6144:KFy+bnr+Mp0yN90QEpkWGjZNJFp7w1giO7oSWrMguQmCdGgAW+lCQbX:3MrYy90iieiO7oSWFXGf1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379205, "uuid": "ab01ce6d-63ec-40ef-b7fb-6dd4b407fb76", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379205, "uuid": "e531474d-7dc5-42f3-a279-779c6af52af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379205, "uuid": "5e1f38de-ebd6-488f-90f2-8f92a9d1e0b2", "value": "74fe770b3414b7af5432877eaaf1d2520b875a38c461d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6b5533-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356340, "uuid": "667f6631-ad29-44a6-9cab-8e1d5e3b4bdf", "comment": "Malware payload (RedLineStealer)", "value": "713e68fe7fdc9f18e24725872ad2e179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356340, "uuid": "9fdea262-b437-4d26-a761-14c26377b3b5", "comment": "Malware payload (RedLineStealer)", "value": "7506757ba820d7ae28d178498db7124eb1c6e346d4700098f7492a46d5e851b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356340, "uuid": "a6150ed7-cc0f-4f49-9ad8-a1c65766197f", "comment": "Malware payload (RedLineStealer)", "value": "bc6f0ed8fd7f4af277e25581ee669ec9ee6b08b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356340, "uuid": "aa0ea522-9204-41ca-8210-e0233aca2bc0", "comment": "Malware payload (RedLineStealer)", "value": "0347eafea12eaed682e8d2688c7a5d505741448736e07a567b253d7ce01425bc0649ef6416b6c91fab684982403942b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356340, "uuid": "69dd16d0-a0d4-4188-9918-6ea8721c72fd", "value": "T1B1840116E7DC4032ECB66B7058FB43831B35BDB19D2492AA3345A90E1CB3A90953777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356340, "uuid": "4d174d31-4b9c-4973-bb24-f17ccd777117", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356340, "uuid": "cdf5e065-5fe1-4f16-9467-46fa8de65a4d", "value": "12288:5Mr2y904SbHVJXbS8Il4aDCAQaZOhqdGm4bZ:HyCXb0lJjwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356340, "uuid": "5fa1f663-a8f2-49f1-8121-c4d100483976", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356340, "uuid": "cc99df91-66e6-40ca-86b5-dad4daf9589a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356340, "uuid": "afa784b8-c410-4f83-88c4-c0569142310e", "value": "713e68fe7fdc9f18e24725872ad2e179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c7f06e-2bcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690388182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388182, "uuid": "e3fbff89-5355-4e6e-ad5a-55fda28580da", "comment": "Malware payload (IcedID)", "value": "50adef995a977c8907db0f5f3c7263c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388182, "uuid": "a3cadf93-a0e6-4d88-9b30-b8da95ae6f5a", "comment": "Malware payload (IcedID)", "value": "753a41ddc820066bea09e4eed3daf18d42710dda0f2f3fc06d3ec494e4056caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388182, "uuid": "4aaf8714-c90c-4b2e-a7b3-920345b56316", "comment": "Malware payload (IcedID)", "value": "b5778ad6d81193c0d088d961d096cc58326fffeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388182, "uuid": "f9deeb9a-fc2a-4698-ba33-84c955a7f0c6", "comment": "Malware payload (IcedID)", "value": "64d9a45d309c4f85963eb9c1252df855270154e73a7a35150c1eddde7bd8155c247ac7f0785893c4b11436998dc8fc09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388182, "uuid": "b8d7f753-958b-4339-8885-3dc55e19e72b", "value": "T1ABA4F11AD2710AF7CC27C53F88E14446C6703C476A60CA1F9269C26D7EB71B14FAAB79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388182, "uuid": "4ccd570f-f548-4bcd-baca-51533e26d780", "value": "122ad25046a6ae342251fe184815d102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388182, "uuid": "f2899097-a4d4-4f18-8b0c-4f90721053b5", "value": "12288:uDvQIWv+AVQG1Fa3P+iy3Gp3gPAjY2ksi9B3izi3:Qvr+7F1Fa3P+DojYsaB3J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690388182, "uuid": "c673a49f-4320-4ae6-b71e-6726465e57f5", "value": 477360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690388182, "uuid": "4a4c176c-a837-46b8-8a4a-dff4c4abf52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388182, "uuid": "0dd1f3be-7d4f-4b0c-ac77-1e1135d3c559", "value": "Scan_Doc_07-26(144).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49f7bb4-2bde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690394654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394654, "uuid": "a83b9e9d-9381-4341-9ab9-b64baf9843ff", "comment": "Malware payload (Stealc)", "value": "bd76c40935181a0e5b31fadc8dea3f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394654, "uuid": "0b6e640c-bfe3-491f-ae97-7564af1a590a", "comment": "Malware payload (Stealc)", "value": "75af3d4edfe4996e7690832f25b278021f7dae0a328aa110b86d74820377b054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394654, "uuid": "c930120b-5d53-443c-a5ca-9fd7cccf2ead", "comment": "Malware payload (Stealc)", "value": "6cec06f4dd1e76658640a63049b48d27cf97b8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394654, "uuid": "133bc381-b15f-43a0-9e75-6bd60bfc7f57", "comment": "Malware payload (Stealc)", "value": "a62c4a60cc775ca09ad11578e28563196fa77d2cdcae01c6f0cb8eac05fd8b1ce51702f3f20ccac79fcad1f48daa8fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394654, "uuid": "d03708b0-3cf7-4723-92bc-f25956b4abe9", "value": "T11174B64387A1BD44E9258B729E2FCAF8760DF651CF4D7B66A228EF1F00B51B2D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394654, "uuid": "235846a0-0593-459c-abe4-c47f0831f6d9", "value": "90bb6a3da0583450c6f11becc85dcf42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394654, "uuid": "4ad9b77c-c514-47d6-b0b4-49ca259332a3", "value": "3072:7/TTXkyLgW5kW9mcfn8ren6Bltx0vo+D5kE7wlGvPGT1lTUM:zvkyLgWWQmkT6jtx0vTacjv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690394654, "uuid": "0da9188c-7b2a-426c-ac74-d81e8d3c7c07", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690394654, "uuid": "c710d037-419d-4da3-a464-0a995dce1b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394654, "uuid": "6efe60fb-ff4c-43bf-b146-07654e79927e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720a80ed-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377738, "uuid": "1aa02658-93f6-41bf-b67f-dd20b23bbdda", "comment": "Malware payload (Mirai)", "value": "4456853a60951f96d2e63f1eb82ed364", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377738, "uuid": "d02b36a9-575f-4412-a9b6-dc85beb7b5d5", "comment": "Malware payload (Mirai)", "value": "75dc319cc0bfe122a22d786ebfbebb21b05c53d13ec4b5eb08ec56b9f91e3bf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377738, "uuid": "887f86b1-5ac5-4ae0-bb1a-837354246f61", "comment": "Malware payload (Mirai)", "value": "aaf4d6da0be2b04ad7b63a5021887c9db27e5381", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377738, "uuid": "a0fc37f7-9db4-4442-b6f4-d0346783bd61", "comment": "Malware payload (Mirai)", "value": "3682bc5f6cdea0b90e63281001546177147ed0783e76605f7a1febdfd39b54500fc3cd9e26c5841a2547b122cafab042", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377738, "uuid": "743e1774-60ce-41c4-a9a8-46f7add79feb", "value": "T1B4632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377738, "uuid": "d6b646d3-1fbc-4c52-8ab7-da1e705141f5", "value": "1536:qNSlxYmii8N1U9uO//kWEjFTikg/QA83NRuxAvjWD:qNnK7kthTikg//29jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377738, "uuid": "dcb17092-8cba-4b08-bc9d-c22d9875d0a7", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377738, "uuid": "a8922b19-a6b3-4463-81e7-2791a5e83c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377738, "uuid": "e91e8569-7e66-4825-8939-551f646149af", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6c3cee-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690350937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350937, "uuid": "6225a375-e589-44a8-aa65-04473c7eeaf6", "comment": "Malware payload (Formbook)", "value": "ed1940425f54cc73a8d09e371ef74d5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350937, "uuid": "23a299c2-69b3-4294-840c-5a7ca7fd704e", "comment": "Malware payload (Formbook)", "value": "75e8e57792bd4bf85ea7263fdcc925ea6ce55c9ace9099887d34d56fc50d93d4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350937, "uuid": "dda3cffe-b785-4678-87ba-8b77b32279b1", "comment": "Malware payload (Formbook)", "value": "38e5de3ccb5f56967ebecdd0b53e98c299beb7d3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350937, "uuid": "ee235d56-5e0d-41ce-816c-aeb7f8964248", "comment": "Malware payload (Formbook)", "value": "c6b15c869b2e338f4804aad1a9d8c51356c24b558d10c32a03cf0e1d26c5707f46bc334f100faa4287ee17f89d7cc5b8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350937, "uuid": "7b51058c-593c-4ca5-8f1a-6626de51a64a", "value": "T158C423862A08A7D76A8C51F1C7AE4135FA170C61D46EB3B7A2571227D011B4D3FF2DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350937, "uuid": "1ddb4010-78e0-4610-8954-c3ff99f8bf77", "value": "12288:lnlVX2CGzW5X21hyX1r5Nnqa6sdJ2JaVQSjn1nMpU0X:lnjozW5XkhyX1j6O2EVtjn1zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350937, "uuid": "541110b1-f81e-4e83-aa32-030f69d33bac", "value": 560093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350937, "uuid": "a1282f70-9cca-451b-b044-a60d8282dbf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350937, "uuid": "19a4bb1e-aaf3-4368-83e9-b1312f1e8381", "value": "\u0417\u0410\u041a\u0410\u0417 \u041d\u0410 \u041f\u041e\u041a\u0423\u041f\u041a\u0423.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdfc29e-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690381620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381620, "uuid": "1e710c28-209c-4c9a-9dee-54b4eed15696", "comment": "Malware payload (Amadey)", "value": "2154ece6d371bfbe7b76969405904f7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381620, "uuid": "a93003a2-1e72-4b87-8cff-d7901f7a4a61", "comment": "Malware payload (Amadey)", "value": "764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381620, "uuid": "750efed4-e2a2-4e98-8e0d-d8e25898d5d5", "comment": "Malware payload (Amadey)", "value": "39f7c2f9abe69a8dc9b42853d10e330b93c9858d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381620, "uuid": "e484dff9-4780-4b50-8466-a33b0bf3d8f3", "comment": "Malware payload (Amadey)", "value": "1404440b7907de41bf19bfd133475ec6b831c0c11cf3c0e1d02f6a462eb1eac5a0b053bfc95ccd54242a3e9bbafdef04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381620, "uuid": "9cc22221-fb02-4b54-8fdd-134281a9af13", "value": "T102B4120BE7D98473E4B567B06CF703831F36BCA39978832B2755945B58B2584B83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381620, "uuid": "d13f7d6c-d677-40fb-9d0a-5d9f8fdad688", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381620, "uuid": "9a2a2ac3-c493-4409-8137-f1d423755bf2", "value": "12288:ZMr7y90W5WJa5xOzgYAkrlzdEEcjXAyEc6hoMzR3VFKTv2h:uyfxOpRzKEOAyEphtzhrKTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381620, "uuid": "d88a098f-039a-4bb7-ad38-61bd0ddd7d62", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381620, "uuid": "533bc358-a723-46be-ba51-7560d355069b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381620, "uuid": "9ca004c9-c8d2-4475-bf85-6b3b12baad85", "value": "764d92d88ba9348555a1351396433cb6b93afd1bc3dcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135501d0-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690350521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350521, "uuid": "d07a7ec2-e79b-4856-8584-1abc5c9ce677", "comment": "Malware payload (Formbook)", "value": "63dd101b8da6fa1f39b3b9cc4351c7e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350521, "uuid": "77f81a47-6d38-4c21-8549-fb2d55a917b8", "comment": "Malware payload (Formbook)", "value": "7712e69f9101e8ea69003bd3e8febfa04dbd7736e4eb43a70393482592b1365b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350521, "uuid": "6406f666-cebe-491d-b76d-6780bbe82d61", "comment": "Malware payload (Formbook)", "value": "d52dbfef1593044637ec72be8f14099833a19c6a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350521, "uuid": "4fd83f75-97c1-43b2-8545-0b8e3be8843b", "comment": "Malware payload (Formbook)", "value": "dfc6f028068ea3d6913d89c2a1b5600c0d950a47c90924019ea46b08db20e521f7a7b8fa6535019f3bd969de6a5a5474", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350521, "uuid": "2ba1f7be-66da-4ac0-a26b-551e53d17f86", "value": "T191039F5AE78F02648F4102B3271B1E99A6BDB23DB35154B1785C837433EDC3E46A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350521, "uuid": "328cd9a2-bfe5-45bf-aa0a-6b0c359a296c", "value": "768:NFx0XaIsnPRIa4fwJMs/8uS5K0eTFh6WXbsvuJCVzHz5efWOYR:Nf0Xvx3EMufZZQWXbsWKHz5wWHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350521, "uuid": "1c4ab1b2-d3ce-4279-8458-102333dd587f", "value": 39486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350521, "uuid": "dd52dc07-529b-43a5-8bca-35bd6ee90b4e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350521, "uuid": "f47e4ae2-cf7a-4553-8f26-7fb317558131", "value": "Payment-724890098761129222009.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83c675d-2ba8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690371387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371387, "uuid": "fdc44ea4-3ad9-4821-ba6d-0876e5a71862", "comment": "Malware payload (RedLineStealer)", "value": "d1a213502a9d20d687cba396c67e8159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371387, "uuid": "b3eef8b8-3c5b-401c-a36d-14a9ee2922f9", "comment": "Malware payload (RedLineStealer)", "value": "771997fd8506b6a560937de17f7e03b352e4035b7d06ffe0470ce0d2584ca27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371387, "uuid": "6d10acec-27c9-49fe-90c1-489b48acb93b", "comment": "Malware payload (RedLineStealer)", "value": "5756caba92a2476aa8dbb57c10873809352da23d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371387, "uuid": "f2ef4372-af1a-4047-8cba-f6c5f02aacf3", "comment": "Malware payload (RedLineStealer)", "value": "5983f5c5722b67dde557e84f897d73d2312c17465f0bd7be3655e07fd6e6ef09dd1ae3d6dbddc9229c482140bc77e7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371387, "uuid": "c0efda6f-2d53-4a31-bcba-edc3930b7ba2", "value": "T116840252EBE98137ECB52BF014F603D31B36BCA19D34835A3755A95A0DB22C0A47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371387, "uuid": "189dc99f-717b-4ed7-8b0e-aa2e22ac7958", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371387, "uuid": "a9816108-03a1-4c17-9dcf-52a319a1fb65", "value": "6144:KIy+bnr+5p0yN90QEArrR2Z5X/wRtxd3d8IxKy//TgJAg/Kz56vcFhXL52hEPaB9:EMrZy90KrR6wJXxKy3Rn6kzd2hHB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371387, "uuid": "bd7f0ef0-b2f1-413c-87ab-48ad2ec5d12a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371387, "uuid": "43bec80d-c9f4-4911-a302-d476b47b09c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371387, "uuid": "970e6cac-b151-4441-9e7d-f9dd96611584", "value": "771997fd8506b6a560937de17f7e03b352e4035b7d06f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38817b1c-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690381507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381507, "uuid": "0b036369-5c91-4f9c-8a4c-af201b3838ce", "comment": "Malware payload (Amadey)", "value": "1d5b251f2e7b37c3ea2514e90944f8ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381507, "uuid": "a21fb538-a3f0-454c-8953-a96a5ab3db5f", "comment": "Malware payload (Amadey)", "value": "780bd88243b0a6eae21e8d7e59cce96e71007c5be70c1e9de17534ec28d8f34c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381507, "uuid": "f9e597b0-aa0f-4845-b729-a12cb3bdf95c", "comment": "Malware payload (Amadey)", "value": "cfec179613d667d462e5c88ac3682a8f89057f43", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381507, "uuid": "90045a3a-f9ea-4482-b1e0-246d2e774c3e", "comment": "Malware payload (Amadey)", "value": "df94149d58e34410c58d11cc56c3476661dd4c10403a2383be1c2b7131d66796c0beacc341c437f87ba093f9b9107727", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381507, "uuid": "b90f9742-75f9-40b7-8baa-666a4ac8f63e", "value": "T16D840253E7E84433DDB21BB018FE02C31A367C619C75836A3699F84A0DB3695A53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381507, "uuid": "e4741471-2b38-47b2-9042-82240206dcd6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381507, "uuid": "cc8df394-ccc2-4885-9331-28e1e6333277", "value": "12288:6MrRy90k9o/8QiZ/aDRaGYhao9r5WIKbepDU:byj9kb2/aDRaGkao9rKbei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381507, "uuid": "0b940869-ae5d-4ac2-aeeb-ea0e7a40d3a4", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381507, "uuid": "fcb841a5-9a9d-498d-9499-b937f7038aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381507, "uuid": "c9b8d6c0-87da-45db-b247-3829df5bba6d", "value": "780bd88243b0a6eae21e8d7e59cce96e71007c5be70c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020a6563-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365095, "uuid": "64b57803-2cf2-4745-85d5-4a85139e2fdf", "comment": "Malware payload (Mirai)", "value": "75da3657ac32d9e4cadda120af38db39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365095, "uuid": "d044dbdd-bf70-4876-b4a1-cdbb8d25a837", "comment": "Malware payload (Mirai)", "value": "784a84d153a35df6ec568be635981e130c67cdfd56c570c4b7665da40e6a22d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365095, "uuid": "235483b4-30e3-4433-bd34-b62c99955919", "comment": "Malware payload (Mirai)", "value": "20a176ac30f843c515222b07ea44785fbee2563a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365095, "uuid": "89ddb09d-b3c9-4486-bdda-b2ba6b52f857", "comment": "Malware payload (Mirai)", "value": "836ac878a5603f29bddbeadafb4a86a4d28238391bc74a3905ee2e265bef70a5b882e36a37fb06946b6c8f9734dd008e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365095, "uuid": "d5c81e36-fabc-4b03-af61-af43843634b7", "value": "T15EB2CFCD61543184CA8D7C7C278D4A564E6CA0D0BAEDCB26E350CDD8B3BEA4B385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365095, "uuid": "e811c631-9768-455c-bb61-efd5eda25227", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpqZq8WvG:BQlS07FUXqIYSXQKqueqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365095, "uuid": "8063c574-f31a-4703-be51-a8faeb719a39", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365095, "uuid": "927e03ee-fedc-4115-81e4-c8ac6a561b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365095, "uuid": "a55882b5-60ff-40c2-bba2-7a8a65af631b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8c9ac5-2bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690384336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384336, "uuid": "e5efb472-728d-4834-bb81-7b8c5c296c73", "comment": "Malware payload (AveMariaRAT)", "value": "d1ac2a780bc8de092c7e68b7a1e36295", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384336, "uuid": "fa285534-92f8-4146-94a7-12a16e5460f6", "comment": "Malware payload (AveMariaRAT)", "value": "78883cae0a9462ea71494e0d344aaec468364a4693bc5d908f10b61ea8874d76", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384336, "uuid": "e7e27824-54ea-43ef-a18d-de61393afeb3", "comment": "Malware payload (AveMariaRAT)", "value": "cd87b95c5c2abf3959eb3bf83f6a44e1b9f50f8d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384336, "uuid": "0e275a65-1186-43a0-93e7-24210909de56", "comment": "Malware payload (AveMariaRAT)", "value": "9798a841a9c7d1acc98b30e497dbae5b5e60a060dc781584cc61e85836c92c5ef7e2b40ecb23f3ad700efd3ff219e321", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384336, "uuid": "c4c29891-aaba-4d19-8a7a-28e22839032d", "value": "T1B6F423273098E1A6C7F15E76DEE36E78046CF213C826A4CC26D0798D9AF7D40D6DBA44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384336, "uuid": "27b80482-4db7-4ee0-bf79-a7fbf7d94eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384336, "uuid": "c7930e3d-f431-46ce-ba73-38b473b7214c", "value": "12288:qK+AlC2txNeVeu8JW6UDdX/DEJxQRM06GU/NqwqllMXw/3hsnOQVvJAAQx539+:q1V2hrJTeJ/0QR9e6iKwRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384336, "uuid": "2d333ed1-440b-49d3-b1d8-7bc9569f29d2", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384336, "uuid": "c7aa85ad-9eb0-46da-ac52-2ef277165dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384336, "uuid": "3841309e-aec0-45ef-9cf7-a83f47e9b6cd", "value": "78883cae0a9462ea71494e0d344aaec468364a4693bc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416b4e65-2ba0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690367778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367778, "uuid": "35f9ae61-825f-435e-8974-e00961677667", "comment": "Malware payload (Amadey)", "value": "073081aa478bc209c3d65d16e0a4dc87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367778, "uuid": "9ca06e8c-5fe7-40f6-8327-69396a689ced", "comment": "Malware payload (Amadey)", "value": "78d33a9023ea75ddb610309a69daa146ce86ee6b73b97a4084d16ed17351eab2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367778, "uuid": "3739234b-f642-44e0-8991-ab3f93b63787", "comment": "Malware payload (Amadey)", "value": "2f819dd5758651761ec07b606384b2c4f6224a43", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367778, "uuid": "6f038dc1-874a-4280-93ac-b8da34825d61", "comment": "Malware payload (Amadey)", "value": "2dc25ab9d45feb5669635f039f8108a9a1c4011d51c22121858f034dc7317d7a92374ad3cb20dbc7b6d261f083e8c06e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367778, "uuid": "e5e251e2-58b7-406e-abf0-35ceb1548b4e", "value": "T1AE8402126BE88532DC7A17B05CF203930B3ABDA29D75936B2785694E0CB32D4A53173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367778, "uuid": "376d3db3-74f3-489d-bfaa-24e6d08a786c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367778, "uuid": "8672d7c7-e0fe-4d6f-b07d-9493ca3bcb11", "value": "6144:K4y+bnr+Vp0yN90QE7XhlkWejgBumKH56SuDzWQ0ZhgWm2fxultqz5IFTq:kMrpy90m/jgHauWQ0Zhzx4qqFTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690367778, "uuid": "c7340f92-a753-473e-99aa-f82630411f0b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690367778, "uuid": "f28e28e5-011e-41fe-b2dc-b85680db4840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367778, "uuid": "164e9452-5f38-4ffa-835b-02714974083a", "value": "073081aa478bc209c3d65d16e0a4dc87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f831e6c6-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690380111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380111, "uuid": "39b5b634-4f61-4415-8fcc-898449440614", "comment": "Malware payload (Amadey)", "value": "423228e0a78e4816f09294aea5316fc2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380111, "uuid": "b356055b-6c3e-483f-aba0-0b8a3e5769e0", "comment": "Malware payload (Amadey)", "value": "791ce585e5ecc84f59c3fb8631fe110929757ae801162603858e70a499f000f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380111, "uuid": "148a4910-f1e4-4303-aaf5-b1cbbba247eb", "comment": "Malware payload (Amadey)", "value": "195b37292cef826f21806775da3d4381fffd652d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380111, "uuid": "c1ca2841-c6d7-47fc-8207-4e17a71b9526", "comment": "Malware payload (Amadey)", "value": "e41bb899786c2d735435a641b504668bac320effe58b37e36ec3682eba2ea98936a6f8d0aef9213bfffcc8baec3746dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380111, "uuid": "e04869e6-ae45-40ea-afc8-5ada3f96bfd5", "value": "T11374F117BAE55033ECB5277058FA17830A37BCA598A8A72F27855C0B1CB2780B975737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380111, "uuid": "d9206e27-b4f2-4953-8237-327b0b9d51ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380111, "uuid": "e735c4e9-c5dd-434f-8f6a-f9e89688dc01", "value": "6144:KSy+bnr+mp0yN90QE1nuVXpvUJGzABqMKlztM7z3Qw6lbxJ9iSD6slt:KMriy90HnuVXpsszAjv/AxVJbGslt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380111, "uuid": "e495f106-1996-4c5f-99d7-dea7ff96cb72", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380111, "uuid": "560d3d2a-3bd1-4462-9558-6764cc7629ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380111, "uuid": "401a6804-d59f-4156-914c-10bc3f46d677", "value": "423228e0a78e4816f09294aea5316fc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d879683d-2ba5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690370179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370179, "uuid": "241a35e1-2829-42c2-b4af-4dc8d8d8f13c", "comment": "Malware payload (RedLineStealer)", "value": "77871a3c4e9d08f0bc052ba62e12af12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370179, "uuid": "80ce63f7-d6c8-44e6-866d-f51fc1c9411f", "comment": "Malware payload (RedLineStealer)", "value": "798aee8abbe13acdcba7ded2507144abfb3a7bdb36dfad1f88ebd752af5e0c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370179, "uuid": "6ab19e4f-a120-4ff0-a23d-31af65230d20", "comment": "Malware payload (RedLineStealer)", "value": "3ef6e6678685530de4df5af5fd5b9d60787c3b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370179, "uuid": "dd730219-bfdd-4432-acbd-bc89c2510ccb", "comment": "Malware payload (RedLineStealer)", "value": "c18671f0bca8193f8dacfd14700486b8ddf71e42e88f008c7bf562a56809a0badf0a5383ef41cd57faab2a0f8732c57c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370179, "uuid": "e7a33cf8-796a-414e-9968-dd331e34c965", "value": "T148840202EBE99032D97497B048F717C31E397DA26D78573E2641D99E48B32D0A93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370179, "uuid": "42e03a82-735b-4ea7-b094-8f3064e2a7df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370179, "uuid": "ba1a9c86-b443-4649-b6ce-535d6e002e7a", "value": "12288:AMrXy90QaSqo3yXhVTXgBYCMwDg8vz2zI:HyeSL3uhezjs8rII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370179, "uuid": "fef06fc6-bc4a-49e4-825c-7825be4f8286", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370179, "uuid": "a840dfa2-a893-4219-af7f-69262ef2f4d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370179, "uuid": "1e8806ee-6e03-4765-a524-562ad597eb2b", "value": "798aee8abbe13acdcba7ded2507144abfb3a7bdb36dfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b071a2-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408071, "uuid": "c83454e5-bd5f-4aef-a56b-b6d7ef71ce56", "comment": "Malware payload (RedLineStealer)", "value": "9e476aaa828daba704a866ec3d0379f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408071, "uuid": "47e22c08-0dbb-41c3-bf42-15ac7a028a59", "comment": "Malware payload (RedLineStealer)", "value": "79c792ac3d5ced90274f53b3b6964f7fed23bfb51c33084bd4c7fb99d0844c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408071, "uuid": "69a4e563-c3cd-4d37-9329-e0a74f5bb19e", "comment": "Malware payload (RedLineStealer)", "value": "e652e62d5e48ca864f2bf0773c118f1f011f81d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408071, "uuid": "ad8e8189-0cc4-4fd1-8ef0-4e01e6afc987", "comment": "Malware payload (RedLineStealer)", "value": "aa9413c5293d5f0259aac28a3950be1b3e99966d486c5106a341617dee141a7d36072c28afebf6d113b69544ebd19480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408071, "uuid": "e3c61b80-00f4-46fc-9a33-e0eada2a6e73", "value": "T1E3840202A7E45132DD7A177068F607C30F377D92A934832B27899E5E0DB3680A97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408071, "uuid": "a961186e-2230-4b08-aaaf-3adabba8202a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408071, "uuid": "f0a1ce8e-8ab2-499b-ab4a-3bc59c553f2c", "value": "6144:K9y+bnr+jp0yN90QEQInVA1A0vtV65gAVT6oyvFUmAT9QSij8MbovxN:fMrDy90j2A0v7kTy9Q97igioz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408071, "uuid": "e3757f7a-49d3-450b-856f-aaf3d0674f14", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408071, "uuid": "113c4e16-c5e5-4244-871b-c3ea7733a49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408071, "uuid": "b4aa8d5e-6680-44cd-9544-bba5363d2ab7", "value": "79c792ac3d5ced90274f53b3b6964f7fed23bfb51c330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5fd9ac-2bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690379685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379685, "uuid": "8f0567c2-4758-493f-872c-d17e1eba3298", "comment": "Malware payload", "value": "71d470db0f594b626279b9d65f393aa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379685, "uuid": "ddd818a3-faba-4c48-92c4-87a79c023d77", "comment": "Malware payload", "value": "7a0cd9e7e4892088d37adb2604af987b667fc72814c843c4c4d77be4751d49d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379685, "uuid": "44a50348-bc90-482e-9169-fa7b1b25cb00", "comment": "Malware payload", "value": "9dbbcc1eb1516ed2ba33fabd759500796e75102a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379685, "uuid": "1f5bb05f-622b-4cba-a807-590a8c3bba9d", "comment": "Malware payload", "value": "ef91e55bf3f0b6ef9ce3fed2fd5b9afad50afa7522611de2170b6b1eac384bd4fa517c0eb436b964ff482d3b15b3ff7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379685, "uuid": "03603ac8-ab06-47cb-82e7-dc98e28507f7", "value": "T131652231BAC18571D86A15355AE8A7B0BB387C302F798BDB17842B2ECE344D19E35367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379685, "uuid": "319a4ed2-0c78-4272-990f-b20427db7d09", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379685, "uuid": "370bb416-1e60-4271-ad71-74d7876fad7c", "value": "24576:8cbD/e1EBEnHZsW58bfi1oK486zrpe7pORgneXpxql1HJ/+LHOWhjERCS2ZlOKB:8cbi6EnHZsW5N6xCUgmUp2DOWiRCpIKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379685, "uuid": "4f953651-cc22-4b28-b00a-b96401ca90b9", "value": 1510107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379685, "uuid": "904fc73c-86a5-46e0-bb31-04e6a638db55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379685, "uuid": "b873d2aa-ce53-459b-80d9-5a4afafcc5ff", "value": "71d470db0f594b626279b9d65f393aa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d50d04e-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690385810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385810, "uuid": "772d8921-be32-4ba6-97c5-ff8229dcc318", "comment": "Malware payload (AveMariaRAT)", "value": "d0c04331a047465c3dcd36eb6346855a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385810, "uuid": "090ed995-cfab-4acf-9605-212bd19c1e28", "comment": "Malware payload (AveMariaRAT)", "value": "7a1821ad2a4c29cdef49069233eb7cc933d9659d8fb8393f3316f3c954368744", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385810, "uuid": "c24fbe4e-a15b-4a06-b3e2-022ace4d2ab0", "comment": "Malware payload (AveMariaRAT)", "value": "f652530e335d9f8aaf947e61e8e51468200f1572", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385810, "uuid": "cc779859-f480-4ccf-aa59-f21b4ab39c08", "comment": "Malware payload (AveMariaRAT)", "value": "483611577f768c9b9bef76d581b5c26300a7a0ce7a724f4c18405f8901d5490221eac47de416411ff7543e2db063608e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385810, "uuid": "45bfa353-a4f9-4dfc-839a-e8c4bad3d3df", "value": "T1C645E0063388DF25C51F51B6C9E3C2F8132B7E01DD019BD776C9BF2979B22AA6A51483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385810, "uuid": "684236ae-4dce-4f5d-9812-492dd9366d48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385810, "uuid": "01ba5bb4-2b00-41cd-96fd-85d58c3ebfa1", "value": "12288:Hr8NXTKI+xfbDwqtGl75oygPtciqdlWxg+pH6QpUViw4aVx5R5thzO5KI67JU:HrBxgqtGllv1dlWXHbBw4axhjzO5i7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385810, "uuid": "3f74b416-0869-40a7-a50d-d8a657ce722b", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385810, "uuid": "1361f5b2-929c-4ac2-bd23-95c89ee75dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385810, "uuid": "08828b3a-0114-45d3-a3cb-e67c546bac5a", "value": "d0c04331a047465c3dcd36eb6346855a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bb0fe4-2b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690343732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343732, "uuid": "634cf251-f5f5-408a-9490-d28bf9f75288", "comment": "Malware payload (RedLineStealer)", "value": "32cabcc4796dfcc5e8e20b61fcb607be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343732, "uuid": "2cbb7f74-991d-42b7-97c6-5281911f5f07", "comment": "Malware payload (RedLineStealer)", "value": "7a1fd99e024bdc914137d50ec271803bbc3944e7e83ab864820cf944fb537b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343732, "uuid": "1ab22f64-6a84-414a-8066-e0a4c1661f1f", "comment": "Malware payload (RedLineStealer)", "value": "a9e5a04904ac1045959c8795fce7241ed236b54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343732, "uuid": "6e356a7f-448e-471b-a261-c216417c1027", "comment": "Malware payload (RedLineStealer)", "value": "1f8fe7745471490821dc7723a6759750db688a1cf96b53fde1aa6b6fe0d75a0994ba5e4325af2b3b36c591e398c6208c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343732, "uuid": "130c03d4-5230-420b-9cc1-3e361533e781", "value": "T1A4B40212E3E45432E8B40BB098F707931F36BDB19EB4535B2285A95F0CB25D8A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343732, "uuid": "502428b4-fdb5-40b2-9521-dbb64cd97e77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343732, "uuid": "e85488c3-f7ad-4514-ab81-d35330324b97", "value": "12288:QMrBy90S8goFCHrTdqy2L0Wc0PoUJybcpqA:ByMsHd92L7c0P5yYp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690343732, "uuid": "2278a5d5-6c1c-4ded-b6fe-66318a457d6a", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690343732, "uuid": "02badbfd-b934-44a6-aba7-25cbc02531ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343732, "uuid": "e56a51e8-fa1b-4004-86b6-b99c26a08a0c", "value": "7a1fd99e024bdc914137d50ec271803bbc3944e7e83ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd0eb5d-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385677, "uuid": "9290c587-ee67-451a-abd4-1fd1e62fbdf4", "comment": "Malware payload", "value": "744d8474085e9ecb249514d78d8b02e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385677, "uuid": "f786033a-4b47-4a8a-886a-053c5feac7f5", "comment": "Malware payload", "value": "7a83694af8b1b94ae3efaf64f930c29de0f5a2af34a75bee30fae7d28e2c241a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385677, "uuid": "8036490e-e4c7-4713-a46b-b25c50baba3f", "comment": "Malware payload", "value": "4ae083eb09eb74c1b3ea8b8995d93ba2a37261f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385677, "uuid": "57027888-364c-42fe-a8b7-7e82277c9409", "comment": "Malware payload", "value": "22f1f4403526a7f16752e0fcf3251a67d4e91f7e0e6db1891fb4964a033324f46f30d9c38ffe7873e00a703f678083e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385677, "uuid": "2a8326c7-7ed5-49f4-b0e7-a1857b7db267", "value": "T1E366F12A3EF31DA6C01151B8843A2C358A7D54377C02C5B62D52789ECA75B3BD21B7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385677, "uuid": "0cde5599-4d29-4de8-a7d2-03b32f21eb2b", "value": "98304:sOyqLkY0txXcmtJkNLf8o9ZazlfFAvYzHHL9Yij6cSs5CIfEntDb9DRT+AFd:sOyqLNsxsmbWZNvYzhsch7stnbfFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385677, "uuid": "6b4db21f-2a63-4ee9-a724-8ca36e9ee5a2", "value": 7059746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385677, "uuid": "34709a98-e29e-43bd-b567-ce4af5bc6a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385677, "uuid": "188758b0-8ef7-4530-967f-18d7552b1adb", "value": "744d8474085e9ecb249514d78d8b02e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5c52e1-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408067, "uuid": "c6a8ace9-71a5-4bb9-9bf7-d335a0f0744b", "comment": "Malware payload (RedLineStealer)", "value": "7d2ce35a27a37baf28988e65cab27fcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408067, "uuid": "ec9cd056-4791-4637-abc0-e286e74eed65", "comment": "Malware payload (RedLineStealer)", "value": "7b57226b37b29e8c8fc26bb0a8f5f069da16548a19709cb24661efa4e037303e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408067, "uuid": "f0b28081-5657-451c-98de-98c78f655b2d", "comment": "Malware payload (RedLineStealer)", "value": "55a23ab7eb441e4a904916bad1ebefe8aa212d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408067, "uuid": "f7f452d8-3447-49c7-8a68-ca37b6df6fa3", "comment": "Malware payload (RedLineStealer)", "value": "da05d39e23edbe1e017221fd4b8988b76674cb34ad6a8d8b3628da2367187519c67756cf1df56f20d4e56350babae1d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408067, "uuid": "58d95b40-694e-4ddc-9f42-d2f83bc17ff7", "value": "T147B40217BAD48063E5A83BB05CF603930E35BDA34D78436B3785681A0DB3694A571BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408067, "uuid": "039899f0-5502-48ef-b559-fd74d80a66d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408067, "uuid": "edc9217e-4d81-4e24-88c9-df2dada48653", "value": "12288:UMrxy900zkSW5R1HN6zM61qV0h6B9UDGElqD:9yjyHNr61uVjUDGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408067, "uuid": "1ca1c196-3f5b-474e-8871-fceed6ade3e4", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408067, "uuid": "9148780b-5ace-4564-a0dc-105384e323d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408067, "uuid": "21855d1e-ce30-4f99-8de7-50982b8798be", "value": "7d2ce35a27a37baf28988e65cab27fcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c948d031-2bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690384327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384327, "uuid": "7873bc18-320f-428e-8a80-ca81c6b5d5e1", "comment": "Malware payload (RedLineStealer)", "value": "89c17915df9ce682ef8e12bbde7e8fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384327, "uuid": "f721c324-2cba-4004-af8e-37a15815adfe", "comment": "Malware payload (RedLineStealer)", "value": "7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384327, "uuid": "bcb900b2-6d47-4601-b679-544d4a14599b", "comment": "Malware payload (RedLineStealer)", "value": "2405ab9354eb3a8806d44f481802b56b45e7aaf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384327, "uuid": "1c8f9fdb-807c-4a0c-81cd-a09091d889d8", "comment": "Malware payload (RedLineStealer)", "value": "e92cd217170f4ffe77f3077cdb45d3e2e872793cf053f4775d4749a8d2444a1348e80a8e5ba950be954cb8a27df1de0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384327, "uuid": "0bed18de-e802-4ded-a752-56211d00ecb6", "value": "T12C840113A7D98073D8B52BB024F603C31A36BC566D74926F2744AD5A2CF36C4A93673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384327, "uuid": "35699fc2-1c50-487c-9b73-c38ebe53e9b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384327, "uuid": "d05e0175-4fdf-42db-9753-bc6ddeb8ed52", "value": "12288:vMrpy90k2MM9xEhIWgBYCi0xcKxdApCs:myd29Eu1zaKxdAp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384327, "uuid": "4b906d3b-eedc-4eda-b408-a31f79642ee3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384327, "uuid": "e4754293-11d5-4fe7-aa0a-c0062fd12b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384327, "uuid": "2c52f361-7642-4b38-b44c-620ffee3b32c", "value": "89c17915df9ce682ef8e12bbde7e8fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7c0289-2ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690368572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368572, "uuid": "a0b99e54-9794-4d5d-b6f7-e4077c4de85d", "comment": "Malware payload (Mirai)", "value": "741f6a03f087c29f17846ed4ec35d03c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368572, "uuid": "309a038e-f462-4536-a95a-6903adfe0ae2", "comment": "Malware payload (Mirai)", "value": "7ced645eb3ffc4d457f761bed575fd45f72ef2e940279ee8227437e7d05f9e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368572, "uuid": "aabd6589-4d31-42df-b8c7-cd4500676b8c", "comment": "Malware payload (Mirai)", "value": "5cbe7aad8c11f03609fbdd3f3975aedb6d954162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368572, "uuid": "a209f096-e120-4b5f-8af4-d64412fb4d0e", "comment": "Malware payload (Mirai)", "value": "27ae6f4e7d5ef51b4781806608b699e3778b9c3d8a86107d06e2978ef2d6cd52791e6971dd5234164226d11b1ad84700", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368572, "uuid": "3a8db3ee-19b1-40ab-b2b5-6b23f276c75a", "value": "T192330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368572, "uuid": "fb032ac1-342a-4a80-98fe-6a09e09f3f95", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJMcjeqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368572, "uuid": "8691b282-83c8-4d0d-9f5e-0bdf8d3d6074", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368572, "uuid": "7562b771-1e35-423e-91a7-ff0198ac21bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368572, "uuid": "875fe606-761b-4b73-98f7-b5ddb79beb2a", "value": "741f6a03f087c29f17846ed4ec35d03c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1977f359-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690385750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385750, "uuid": "60741d9c-d0cf-4b77-a0c8-b1dac290da22", "comment": "Malware payload (Fabookie)", "value": "6a9a20637489b54f1f46f7172687a7a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385750, "uuid": "cce0dd26-73c6-47d1-bb72-91ede5f1c899", "comment": "Malware payload (Fabookie)", "value": "7d1de48ce31d168dbbb123d9f1eb8337d71fbc8920b4089611ea532b167609c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385750, "uuid": "a553f3f7-638c-46fa-9278-395c1369b5a5", "comment": "Malware payload (Fabookie)", "value": "e7fe725009644ce5178bc499418a6fefe7a54f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385750, "uuid": "ad1a04d7-97a3-487f-b697-2b3758f3041b", "comment": "Malware payload (Fabookie)", "value": "c934e96d0397b253623549f6bf0d0448cb5c621963aad50436b0632d184e91a00ef0e4c1e9bc4738bfbb99a494f12269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385750, "uuid": "09b5cdbd-ce6b-4391-beab-401e6f44adf1", "value": "T1DED47C51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385750, "uuid": "82563fad-6dc4-4ad0-a7a1-c86e2b2590ce", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385750, "uuid": "f7db3a1a-0440-40ae-b7b8-9bc25bfb2569", "value": "12288:Te79CNmn1yjvZvHTJBxPTXzGPDJciMuGEPnW:q79imn16FJBxPTjGPSiMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385750, "uuid": "9b9f6737-0b33-40a8-88d0-13f0af1689f1", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385750, "uuid": "41080d7a-5a62-41df-9964-45bc3af1d346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385750, "uuid": "2e469e7f-2198-42af-a990-e59c376fc6db", "value": "6a9a20637489b54f1f46f7172687a7a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579b3a13-2be1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690395733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395733, "uuid": "7930496a-724a-48d2-87c5-0cd577a9ddb8", "comment": "Malware payload (RedLineStealer)", "value": "066b08402cc51c6bc936b0e106e2bc8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395733, "uuid": "1c9e2d78-7fc6-41f7-943f-9999e7061fcb", "comment": "Malware payload (RedLineStealer)", "value": "7d5c4ef9d216a1f969ff5ade1adf13de564c369ed023682f14a82f4ee6f3afa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395733, "uuid": "178f56b6-bdb9-4e52-a3f1-4cf34e9eceb2", "comment": "Malware payload (RedLineStealer)", "value": "f02298331282f85b49ab50a46c5ecb3c930c9b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690395733, "uuid": "107edc9a-c41c-4191-84a9-6cd61513b89e", "comment": "Malware payload (RedLineStealer)", "value": "2bb65c51787e0f56f5c8f6dd08c21a99e9ac9a69bb74df853d8f12dcc9b648352863909caec65cbe9bedb455fe957d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690395733, "uuid": "cd41a548-7287-445a-bb5c-326cae94d84b", "value": "T152F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690395733, "uuid": "2c7758f7-9226-4cf5-800a-b869219ecffa", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690395733, "uuid": "059f2474-5b78-47e0-b931-712654d7d2bc", "value": 35479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690395733, "uuid": "ebe890df-eab4-460e-8488-e74acf6c517f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690395733, "uuid": "82eb21fe-f485-413d-8c7e-13f30aec45f4", "value": "066b08402cc51c6bc936b0e106e2bc8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35846007-2b51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690333828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690333828, "uuid": "ac9f0db9-38e6-48b6-b0c2-ba89bd08686c", "comment": "Malware payload (njrat)", "value": "2d03bed6b16563ec180d486fefd34d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690333828, "uuid": "2e1c3df3-7294-4830-8a25-de57f736a29c", "comment": "Malware payload (njrat)", "value": "7db1638194f98d1f0546d41cdf2bfae5f7b23319305f9b2b26b2e220f88e88a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690333828, "uuid": "3a403d40-dc42-4d93-ad9c-beebe23b5f11", "comment": "Malware payload (njrat)", "value": "784a3e24aa6c8a432fc4c9dbfd93e21b6102a83d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690333828, "uuid": "d12fb7a2-36fd-4c8f-be48-fa2dd9217f93", "comment": "Malware payload (njrat)", "value": "29a92d5bbde28d0038b85453946339734d208604d45843f7b8f289ceada4eec5b8fbd30d8bb2153b3e544a7829c938c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690333828, "uuid": "bcffe989-14f4-49f6-8f67-1e26237613db", "value": "T18783026694DD068BF0A30A3815DB904183ACF35AD35BAF9F8FC01A591C6DF97690AA70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690333828, "uuid": "78a81d34-1941-42eb-b087-ce4de34e979e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690333828, "uuid": "592c78c2-8512-4d62-94bc-25a43793f332", "value": "768:uzc8GE2VJ0Ds9A0LbQ6CPGSYeap5LrLRQspRF4oez5CKgng06aAKTcccxyJLiIuY:o7mJ0A9R5CPe7AZyJutit6zNmr5imTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690333828, "uuid": "43ad3c9e-0a8c-4325-867f-c32a126bfe60", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690333828, "uuid": "e4136ada-d0b1-456e-863d-ddc832898752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690333828, "uuid": "b92c3917-ed54-460b-9528-7ec0bf63e38b", "value": "2d03bed6b16563ec180d486fefd34d7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6673e4-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407742, "uuid": "1960de69-00e9-48dc-8b3f-9a43bb45abff", "comment": "Malware payload (RedLineStealer)", "value": "489a1d044650759090f02abed6c22a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407742, "uuid": "10b43959-bb97-4111-aa3c-60638aac66ae", "comment": "Malware payload (RedLineStealer)", "value": "7f6f87a268be18b4ff2bd048f6919ebc1adb4cdfd81cdb94728e0e0141bd195e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407742, "uuid": "4c02806a-3272-406b-855a-26c163322bc4", "comment": "Malware payload (RedLineStealer)", "value": "9bd761ac3408e477c4c292568df8f980075944fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407742, "uuid": "193d5738-7a06-44c3-a353-b9d8599a07d8", "comment": "Malware payload (RedLineStealer)", "value": "e796d9b0a7ac2c35dc7d58c190787b4e81f72e6e678ddfb9e22ee9517d459161cd9b9158c29c2fa5e0f0bad2d546d064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407742, "uuid": "0907c1e1-d5ec-4e45-aba7-d826fee5d0df", "value": "T188840117A7E89533D9751B7048F703C30B3ABD925925932F2B85AD4E1CB2694A83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407742, "uuid": "94d16bee-e07f-400d-9c0e-b4050770d95c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407742, "uuid": "a1a5af79-5e40-4108-b6b8-089b73a60132", "value": "12288:FMr7y90j0GagEW9wfbiG44uSIcsVdVxb/i:Sy60GKY46V3l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407742, "uuid": "a6394113-c73e-4e02-b31a-fd09c6affc66", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407742, "uuid": "479609e5-28c1-421a-a0a0-e876e6857512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407742, "uuid": "1a21c934-0635-4c42-b631-e8a5bd0960ab", "value": "489a1d044650759090f02abed6c22a14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ecfc06-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396297, "uuid": "492d9951-4bc5-4487-ac5b-c161a89caa9b", "comment": "Malware payload", "value": "eb67273c54e78db4faffab9001148753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396297, "uuid": "1a6d4119-bad6-439e-8960-92bc8f10ab1d", "comment": "Malware payload", "value": "7fa7499c7a72041d7d0fb1e4659466ad8d428080a176fa16276fd60adc9da0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396297, "uuid": "3ca78ebc-3d6a-4e8b-9de9-ca8290bae6ad", "comment": "Malware payload", "value": "0e6cab2fdf666e53c994718477068e51b656e078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396297, "uuid": "47aeeec4-b6ef-46a4-be96-f16b41cf4708", "comment": "Malware payload", "value": "7ae356214278d38002f0ba8860f92f19de7aea95a66b78babd414e669283d60d4b024fa050d73fc606d078e23f3a3f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396297, "uuid": "a5a9a093-1d55-4275-8b33-acca0502c701", "value": "T176549D02BB81C031D67342734A2AE71595BDF9714E718A5BB3D85A0DEF705C2EA36723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396297, "uuid": "ab17bd6b-3291-4b7f-81b6-70a9579664e9", "value": "5f0bcbc932e3d7cbfbd5bd9df9fce893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396297, "uuid": "39c3011a-8286-49e1-982e-415eef51cc08", "value": "6144:slR5gD9yOvDIxyVQN8cnqDt+T1MLFUM8O:sRgD9iGQyFET1MLD8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396297, "uuid": "ec90f219-efee-425d-a468-e3539e706b42", "value": 295944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396297, "uuid": "33033915-818d-42ea-afdf-a14b192df5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396297, "uuid": "b4bd9e76-cd47-4fd6-b93b-b72be08a7d5f", "value": "SecuriteInfo.com.Application.Agent.GXN.12071.1394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ddfab5-2bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690393654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393654, "uuid": "0a80d135-7a28-488c-8871-a90d2d789a52", "comment": "Malware payload (IcedID)", "value": "b409c4b88601b513125db1f02d99adba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393654, "uuid": "02192848-d1fd-4df6-a962-d7d9e64b2023", "comment": "Malware payload (IcedID)", "value": "7faaa2a1fd3f6f1a552830d720fc967beb2b7c05f2fe139640ee23aaa5194230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393654, "uuid": "1f9a7bf3-fe18-435a-9f51-2354b1f6d302", "comment": "Malware payload (IcedID)", "value": "36db43c2537fc91e5705efcec9ce4b743d3ab632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393654, "uuid": "13567f0b-17a4-472c-991c-4ee560444334", "comment": "Malware payload (IcedID)", "value": "1102c0e2d2d70d4df6301a81ed1d2444f9dc6d8efe19f00938a491dab49e76a682ba415afa8a8b3380461e683f8efa1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393654, "uuid": "bac8fdd1-e39d-4d92-9cab-b3d8f67bed78", "value": "T10AA4F14EE2610BF3CD12CA7E88E2400AD9653947A611CB4F1358812D7FB71F54FAAB79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393654, "uuid": "63ba7e55-2a12-4538-b7a5-32cb5ed242d2", "value": "122ad25046a6ae342251fe184815d102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393654, "uuid": "c52475c4-933c-445f-a648-ed4e8ee8a0df", "value": "12288:uGuXvAN5y8GH6MKEXf7RtGmpc0DriIXivJk:JGYN5EH6oznRDrSvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690393654, "uuid": "8c6f1b0f-b6d8-4fb3-9000-b51e4590ae10", "value": 477360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690393654, "uuid": "f45751a6-9215-4755-b01e-3a4cec445c2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393654, "uuid": "d9f1eb0d-f7f5-4aba-94bb-d392c30e34d2", "value": "Scan_Doc_07-26(38).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff88c48d-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408040, "uuid": "8fe93b42-4f25-4b83-a7f3-1b7d2e888e44", "comment": "Malware payload (Amadey)", "value": "798ec07025f058b2e7791a88ea7ebba1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408040, "uuid": "879643a6-ce12-4503-9890-41b6cb3aa38c", "comment": "Malware payload (Amadey)", "value": "7fe3c5296017a9495bcbb4b7a050afbb8dc455250cb5390bf962b0738814d69b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408040, "uuid": "57454707-7b12-4565-8df8-c47da5993a69", "comment": "Malware payload (Amadey)", "value": "0dff838f77c7f19abac6b32af4cfbc6bdafff37b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408040, "uuid": "1f8ad471-4760-4a87-a358-779786412be6", "comment": "Malware payload (Amadey)", "value": "e9dc697a22fc11c7b37b9867d2b420eaca192f9787c252248a53626a0549cca5f08521b59429c6db1b43518e62c1c270", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408040, "uuid": "713e03d1-a9ae-4080-be3a-827997e59ab3", "value": "T15E840103AAEC8072E8BA27B058F607C30B377DA6583453BF2746590E0973AD4A57577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408040, "uuid": "90afd1c3-3dfd-4eef-b66a-43353e60aacb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408040, "uuid": "a27caba8-d250-47f1-99c9-77bd084c5149", "value": "6144:Key+bnr+4p0yN90QEDHkWGjZNJYh7TNog5hSFkM/qVmBsSlmoNds:2MrYy90BfseSFHFlBzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408040, "uuid": "9a08f826-d012-43b1-bf9e-ee592419cb35", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408040, "uuid": "cc319763-6a88-45ef-bcd1-ff670b747791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408040, "uuid": "3818dbd0-2e6d-4200-bc13-eaddb8ace800", "value": "798ec07025f058b2e7791a88ea7ebba1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b38aad5-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356655, "uuid": "afb26d7f-92ff-46e8-87df-1d42527ae4b5", "comment": "Malware payload (Amadey)", "value": "a2c46a623bbac66f5b67f33df8c683b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356655, "uuid": "5d1d6854-4d5d-4feb-9dbe-7b40141d8f57", "comment": "Malware payload (Amadey)", "value": "7febe0fba245dbc20d115e06a3b5f36f7c1b1434353bc7c36882b497bc598635", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356655, "uuid": "943b3dcf-52bb-43b1-94fe-c7ecbf01939a", "comment": "Malware payload (Amadey)", "value": "6a1d9dabd8bf01f85fea867fd22408948f5ee1f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356655, "uuid": "ee15d119-abef-4f70-9e55-3d3844dd7a46", "comment": "Malware payload (Amadey)", "value": "608b0b4417e1e360c2fdeeeadcceb7a5ac94e578d6e677119e910fc6cff4ea51fcd8a62912bb306c41d61971e071f01b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356655, "uuid": "ccd153ed-24a9-4f58-90ba-996257314999", "value": "T15A84F117AADC5073DDB5137055F702930A3ABCA05DB8826F2A86AC1F0CB36D4A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356655, "uuid": "7e882f33-cbf6-4439-8344-17439e435c09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356655, "uuid": "8c5d25ec-58ca-41ab-944f-f1d6852727a7", "value": "6144:KYy+bnr+Gp0yN90QEGJY14yJ8TWG7ThmngQmIiz5FxuBrEtS5osA/n7LnQePsQUN:4Mray90cU8TWGz5rudGShan7TQeyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356655, "uuid": "ce2389be-27da-4b73-8494-60f514c8327d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356655, "uuid": "dd8a3937-148f-4bc1-b666-427d7d763b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356655, "uuid": "7d56c8ea-3cfb-43ed-ac25-1dda0d57333c", "value": "a2c46a623bbac66f5b67f33df8c683b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16421ca0-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408079, "uuid": "91bfe21a-77b6-476e-a3f9-7c92b06513ad", "comment": "Malware payload (RedLineStealer)", "value": "3aa70c7c6b08018e41f0456f18761bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408079, "uuid": "6f59f009-ab63-40fa-b83f-b109892a1f95", "comment": "Malware payload (RedLineStealer)", "value": "8029594627aa568794514c9918dabd742d1e08273d7b9bb4b7e43a1230d4b18f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408079, "uuid": "cd2b2159-b10a-4aed-b775-c23a004f307b", "comment": "Malware payload (RedLineStealer)", "value": "3eedcb0711a6c6f367e473780b977f2b5b33eb73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408079, "uuid": "9ba5c49c-290a-4bf0-a86e-b26144e064d7", "comment": "Malware payload (RedLineStealer)", "value": "a6b7e35cb3037a83bc420dc34ac5f1eb4dc429ab9162e342539f328b0c8e0d17a21faffe8e1a4504d76d0397a443fd54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408079, "uuid": "b2a71abc-3867-4a99-b2b3-4ed80655977f", "value": "T10A840212F7E88172DDB617706CF613D30F3ABDA19C3403AB274A998A1DB35849971727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408079, "uuid": "0ae133f8-9877-49b3-bc77-a8014ef29f85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408079, "uuid": "f9a96238-6d78-4fe0-84e2-662e66a084b2", "value": "6144:Kgy+bnr+Hp0yN90QEzoQMWYla5b/+sy2mSfEfsKHFfmthusyyrUue:wMrXy90FoQBYlG2sydSfSBwlyyrUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408079, "uuid": "da07904e-9bf3-4487-9507-0c8b1d04eea4", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408079, "uuid": "a4eb363d-f0fe-464a-8de0-c425a8edd9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408079, "uuid": "7b03121f-3dfd-4476-9627-e04e2566e835", "value": "8029594627aa568794514c9918dabd742d1e08273d7b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e6d87e-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407734, "uuid": "3a274c00-d4ea-4dd5-8f34-e18ee6280a51", "comment": "Malware payload (Amadey)", "value": "2ade2eca7ef3588a241faa5eb9c4edc5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407734, "uuid": "55062760-b4c4-4c99-a121-c78fabf133de", "comment": "Malware payload (Amadey)", "value": "80f298c436aec6fc79755a500c4350e1d63215b9088f36710903936de3cedc94", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407734, "uuid": "cfdda942-ce21-457f-8600-d649b3724ec8", "comment": "Malware payload (Amadey)", "value": "0cb3f7a34bbd6fc353cf75997ca96974255f6243", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407734, "uuid": "2a456780-cebe-48a2-adbd-b36d7e023417", "comment": "Malware payload (Amadey)", "value": "5338a10487c667fe0b948847c441e8520b9d9bb816f156971f939722a4ab9929613ed6914ffddbcb35fdbd0edf0efb02", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407734, "uuid": "947f33b7-8a08-4bef-a8de-6d2272ac4ee9", "value": "T1AB840243B7D88033CDB527B158FA13830A37BCA65D75932A2786995F1CB32C5A53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407734, "uuid": "0dcbfb2e-6f4b-443f-8104-7332997f241a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407734, "uuid": "b2213549-bfb6-4956-8479-b0564dcb85c3", "value": "12288:0Mrpy90UHPXysVcfTOgBYCNLVbx2oXQSvd:tybv1G7NzHVESvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407734, "uuid": "d99f0d24-7b02-45ab-ab47-766e9449484b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407734, "uuid": "bd8823df-d9ef-4c16-b14d-009ba8837963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407734, "uuid": "83eeee19-2e95-4d43-a2c9-99da02366057", "value": "2ade2eca7ef3588a241faa5eb9c4edc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637ec8df-2bc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690383727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383727, "uuid": "d3c8f880-1f5a-4a30-a346-4ece5bf98c8a", "comment": "Malware payload (Amadey)", "value": "af1838b2fae73bf7cf671932f85f6565", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383727, "uuid": "e298d155-b89d-48f1-b9e6-dd364396ba40", "comment": "Malware payload (Amadey)", "value": "80fdbd208d459dcc5f39313b6328b97a691f1ca550a2563475f17df2b442e918", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383727, "uuid": "bd5e60ca-09d7-4e1c-921f-ffd37c78b755", "comment": "Malware payload (Amadey)", "value": "7e807f0a4333eb69bc53367f4ac923ee8df6fe85", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383727, "uuid": "a7ab7baf-d5e2-46c8-99ec-4ca28e9da834", "comment": "Malware payload (Amadey)", "value": "3ac751b5a0a289bb60998dcb05d5abfb990b72a8f776e5894917fdda38a5600bebe67fc243c7689c2f7a1d60c8d587e3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383727, "uuid": "d682f249-094f-4ba7-8a8d-c7454baf617e", "value": "T11F840143B6E88172DCB51BB068F717930A3B7CA0997C476B27856D5B0C729C4AA3533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383727, "uuid": "915400c1-8316-4f5a-bdb3-42b12012161d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383727, "uuid": "39a197f6-714b-4d83-a929-b7eec938bf73", "value": "6144:Kwy+bnr+Xp0yN90QECYZExxsY8KpyOjvq2Sxbe+V3AO8CBXNPm0b:8Mrvy90AYZE4YppyOjvq2m3AO8+XdLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383727, "uuid": "cae48cb1-d0a6-43b0-9e80-dd980067ae40", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383727, "uuid": "7ee0d1fc-5561-4f09-a822-26db6d993c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383727, "uuid": "51a8d993-c2ee-4305-8b07-685f6a8ee61a", "value": "af1838b2fae73bf7cf671932f85f6565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686ed81e-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690364837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364837, "uuid": "ea132274-a0ce-44b5-92ba-24441eb7464f", "comment": "Malware payload (StrelaStealer)", "value": "ec95e26d47716c70f6538aed9eb70b47", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364837, "uuid": "9f6b329b-b10f-4810-9258-b8d3f31d64d4", "comment": "Malware payload (StrelaStealer)", "value": "8108f6284b8fbf832d8d720de558caf76ec2fbfbc3b83b00f165cb4835c067cd", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364837, "uuid": "dce04a19-f7e7-4183-8f4b-ebef08f83981", "comment": "Malware payload (StrelaStealer)", "value": "eb3add7df07c5434bcb2f0507622a8415c5d23df", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364837, "uuid": "61e00f80-5e81-478f-9b95-1a1289643d4c", "comment": "Malware payload (StrelaStealer)", "value": "a3395f96e1e4b5eba0b4e78b96cc844dbf8736ce9ca9a3a8bfcdbeec008daadb8e2929543191b6848742f56724a313e8", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364837, "uuid": "ced83aaa-804f-4147-ad57-c79b9e34254c", "value": "T181055DF472E47BD74FB6290DB7CE80B23D64B553F0AEAD4526881D1E52803988DF6DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364837, "uuid": "8650c468-99fd-4874-bd94-83aea8f8a783", "value": "24576:zjy1uKuhPT4Osz4rWnqYyTxUktwa7UnHUfNda8:/TMktr4HYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690364837, "uuid": "59c519c4-d7a3-431a-b3c0-c875cee36099", "value": 805812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690364837, "uuid": "98486991-f3bd-460e-ae8f-c29029f3c863", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364837, "uuid": "9f7c723f-c890-470c-85d0-fde86b520c72", "value": "PDF326253053422380.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e122f4a-2bc1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690381919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381919, "uuid": "fce173d9-a0c1-4e4e-b698-72fa1688e242", "comment": "Malware payload (RedLineStealer)", "value": "420ec7f2715f77c8a4ad4cecc375ce04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381919, "uuid": "857a7629-8322-4751-a627-e52597025ab9", "comment": "Malware payload (RedLineStealer)", "value": "8133adf8f3f70754005641de6769fada08fd1679a9177ad701e8ff375d8f0e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381919, "uuid": "e82517a3-af32-4447-a4aa-59a6ab35f62b", "comment": "Malware payload (RedLineStealer)", "value": "ca09159dc031e00e963d68c1a69369ad37603734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381919, "uuid": "c958a5ec-a499-4f0b-aad5-51bb8433be13", "comment": "Malware payload (RedLineStealer)", "value": "1254a3e60b0fa1fb81998e797c694cf059e6ac4a61fa44e8eb23d54aaa7b97f25ddae67da3f55cecb90ff8946dd81c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381919, "uuid": "19e2f8b4-34bd-48bd-a5f7-7b7262411e3d", "value": "T1F2B41213A7E99172DD7923306CF603D31A36BCA24D78939B23849D5A4CF22D4A53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381919, "uuid": "4152c57a-7a7a-4e7b-8bbb-42ac25bf7830", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381919, "uuid": "b03e13b3-12cb-4c0c-a965-52edf58b99dc", "value": "12288:lxMr3y90swP0b/nsuAvyTPGAF2aIO3oeeyn6tL:lWyEPU/sbB+/31ec6tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381919, "uuid": "9da6b891-64be-4a81-9471-2d7fff252a68", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381919, "uuid": "296f5802-c6b9-42cc-bd98-4cf3e5319ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381919, "uuid": "78f3ea88-e661-46be-9f00-39db26ff5753", "value": "8133adf8f3f70754005641de6769fada08fd1679a9177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c8dc77-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690376003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376003, "uuid": "0e442e36-5262-4215-a521-f44e4ec430c2", "comment": "Malware payload (RemcosRAT)", "value": "0ca4b0698fccb64711c031d68721cc1a", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376003, "uuid": "8568bc83-eeac-47af-a831-7669776d9153", "comment": "Malware payload (RemcosRAT)", "value": "81b5949dee4c1eba1a2acaf1193b69c6cc5b914b31a5b26617176d474d2b775e", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376003, "uuid": "60cdea05-cf8e-4ace-8cad-bbc10cff5c7a", "comment": "Malware payload (RemcosRAT)", "value": "b00b5b9c43e3f6a922c48a50458a7ed8edbcd32e", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376003, "uuid": "9e54daa9-40d4-4b68-9851-d2e9a80f5474", "comment": "Malware payload (RemcosRAT)", "value": "068a5fc3742c2549f74dbabc471cd1230a587a6b08cd0519063ab4a0dec3d8dbfb77af9d8d1d90ab520b453e7f5a6a96", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376003, "uuid": "a4c1f69b-a8cf-42f1-a728-4eda7bdb6f36", "value": "T1AF02AEFB190E073E736B76D98607B0434EA95539CFA84CEA89A3070790970465D17BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376003, "uuid": "1a2a4ddc-37fc-46ec-9e1f-b7d334243caf", "value": "192:RXrzqX0mzCK/FzzJAnwYjdD+nL2pWBGufYHkZjocFYh/fft6dnO+w1sNf:AkAhF+njUL28rHjbFYxNSnS14f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376003, "uuid": "752ec438-6b2e-459f-ac66-56982fbe023b", "value": 8848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376003, "uuid": "a3849c5e-10f4-49ca-b578-a72e29e7e9cc", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376003, "uuid": "2eb73178-88d7-40c3-a3c5-2d3b097b0c1c", "value": "nDraft_BL.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f97f8f-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356347, "uuid": "8ccaa6b3-a827-4437-96da-033a09c6fba0", "comment": "Malware payload (Amadey)", "value": "97f7b62e8cedb79b44312ac456f83b31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356347, "uuid": "96d0f3eb-653d-48cf-adea-eaecf677a2fd", "comment": "Malware payload (Amadey)", "value": "82a1a58d41442e343e6873b283fe11e8a1c7f8a60cee5ead3b8a7d91a7664e31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356347, "uuid": "68247ae1-cc27-4102-b33a-32df5405cf8c", "comment": "Malware payload (Amadey)", "value": "b0d13bce559aaf1d224145a3d5ddd5debe355e88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356347, "uuid": "d67d4e83-420d-4cd3-8cd0-c6f42c0c576b", "comment": "Malware payload (Amadey)", "value": "98f11faada8d84e1c255874d6b1e3adbd1529dde27ae93c2ee160348f32fc37dea216327334352c639e7ffb9cf8ff619", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356347, "uuid": "1b941d73-b368-499c-8a99-8f4dacccd7ec", "value": "T15EB40213A7E85476E8F56B3018FB03930B39BC611AB8436A27465C5E2CB3291F97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356347, "uuid": "92100dad-c415-4245-b804-79466a8601e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356347, "uuid": "d0c46834-3deb-4a1b-8afc-4f527344c2c0", "value": "12288:aMrXy90dO3t87oY9Dd46WKPoQJMiSOtyQNuq:dyZWsa46doySOAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356347, "uuid": "0f9106c7-2c41-466e-a020-32cc5e360d35", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356347, "uuid": "00ab600b-43b8-4a5c-b2a9-31163717b5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356347, "uuid": "1d8e2f08-7dbe-424b-b14b-47d909357910", "value": "97f7b62e8cedb79b44312ac456f83b31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ad0a13-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356058, "uuid": "6aec1f28-c545-408f-94fe-f68faf0c4a2f", "comment": "Malware payload (Amadey)", "value": "54bfa583718258fdca06a7ec48cc2851", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356058, "uuid": "825960a1-7d2b-444a-89d1-8ae9b7717501", "comment": "Malware payload (Amadey)", "value": "82dac93c6ee7a59c0a735b40bff542139bf2953caa4daacf664a73aedd2fd978", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356058, "uuid": "53534a82-abad-427e-b575-7852157063c1", "comment": "Malware payload (Amadey)", "value": "82e32812c741aa72d0a37e707f6da24f61d6cc8a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356058, "uuid": "e3989c4f-583f-4a9a-9623-fd86814309b8", "comment": "Malware payload (Amadey)", "value": "deb8a619255612960073a9895e28d86f5212a12a65d81d30703e71ebc602c6959c4319fda4ac371cbe56d9332a3a6fea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356058, "uuid": "aa27c150-50c2-4b44-93d6-bfc7efa11919", "value": "T197B41216A7F54073D8B5277058F617D31B32BC724EB4936B3696988E4CB3590A832B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356058, "uuid": "e4b4c0c4-2d5a-4579-8502-4eae8af4ba40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356058, "uuid": "7e193608-8882-401f-9744-218995d22890", "value": "12288:oMrLy900PgaGLEGgOR1pxxCZMH06cmS2R59SiY:zyDgaGLEGHRXxUZq06cmTSiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356058, "uuid": "e181925b-d665-4969-bd25-28c3d51ed30e", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356058, "uuid": "a4dab3fe-bcec-4f82-83c9-bbe304ea04b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356058, "uuid": "6f729588-a27a-4acc-96aa-d33d36d45e87", "value": "54bfa583718258fdca06a7ec48cc2851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e380736a-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385660, "uuid": "368136de-c02d-45a2-b78f-32756d8c2795", "comment": "Malware payload (Formbook)", "value": "7ac4aae284d0983afc47f3b7f23f9754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385660, "uuid": "6a30b57a-ee48-4cc1-9a85-cabf56d0c9b4", "comment": "Malware payload (Formbook)", "value": "83705fb44730441949f46455f2076211d6f9d3739a622bb277d3e9c03ddd592e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385660, "uuid": "d0b283f9-a673-4d83-95b3-111749cddf04", "comment": "Malware payload (Formbook)", "value": "56fe399599a5164caf136e0344718eddb656b999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385660, "uuid": "05c617ed-2f97-45bc-80aa-ca1edd34a3da", "comment": "Malware payload (Formbook)", "value": "24625ff99f85add097abbfbfb465816e7ece646f0c4dc64a3de901d1dfeb544a1a3e6f17cf97ab04984999c3886a31a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385660, "uuid": "179facf4-8fd2-4a73-9614-fd6d44b97460", "value": "T164D41222B2AC571ACB3B03F958955A004BF1FD6E9130F2192EDC64CB4E63F2517A2B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385660, "uuid": "68235578-c6ab-499d-aa34-f230ee746f9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385660, "uuid": "b6b8b414-f0bd-4fae-b9cc-fd33930a0d2d", "value": "12288:Sf2iN2GULI6YjDcehl55iDnqCJZeP+JBLTsbHPaBJ1xqGf94/:Sf1xULI6YthlL6nqAZhB3sLaBrguO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385660, "uuid": "39a7e4f3-e706-4875-8580-89283e0d98a7", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385660, "uuid": "5066f0a0-2fdf-4566-8652-c8ab020055ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385660, "uuid": "1083ab5b-3edd-4ecd-bf17-87a65f78ef68", "value": "7ac4aae284d0983afc47f3b7f23f9754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296f7a86-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690365591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365591, "uuid": "bec5f7ed-745c-404d-b05d-a9fc47b3ddd6", "comment": "Malware payload (Gafgyt)", "value": "ab58ce411b1ab4eb9b8509894f4e5564", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365591, "uuid": "2f296fef-60c4-46b7-9c40-ea50b2c4508d", "comment": "Malware payload (Gafgyt)", "value": "83a5a6366f68b8889629249dfafda2a93324121dcceb59cd71aeafe47ce65246", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365591, "uuid": "3516d527-fbff-441d-9653-ed801bfc3b8a", "comment": "Malware payload (Gafgyt)", "value": "b94b199300e78f5f994a9b89b09397fdc591ec05", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365591, "uuid": "2c0f8e9c-b02c-4880-9b29-33e4ed10fa3d", "comment": "Malware payload (Gafgyt)", "value": "cedc0d8bf9fd52fb25df235a2d1df1a4334bda6a3ac6abe5fac80c0897d12ce669c05dc27eb113e59dd60350ae609c33", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365591, "uuid": "989c59a5-fd4f-4e8c-add8-1919d6394306", "value": "T19F63295AFD816F00E5D125BAFE4E124D33530B6CE3EE72119E24AB2527CA96B0F77402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365591, "uuid": "d0ab96b3-4c77-4b0b-92c6-2996d3f8c3c6", "value": "1536:4Chgn4npRehGlDiMUK1aZrP4GIteENldciMmmFPISnCY7XFNt:PnpRm5K1aZrPb8WmmFPISCoFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365591, "uuid": "f663fa0e-cb25-4cb0-81b5-307e4c69ead7", "value": 67696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365591, "uuid": "028604aa-3b72-4562-ab2a-a1fd77fd8ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365591, "uuid": "4a553bf4-de7a-4cf2-9818-4985dbe629bf", "value": "condi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ed854d-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690379805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379805, "uuid": "16f023b4-5067-4bfe-818b-bb3aaea59e81", "comment": "Malware payload (RedLineStealer)", "value": "cf4ae40a41ef9ec04371398331ae140d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379805, "uuid": "35168c33-03f9-45ab-b21e-93c5bff3ad92", "comment": "Malware payload (RedLineStealer)", "value": "83cfdac7b96fe657cf302bea27f91ab98721c9d658ddef2cc36d81228cdade51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379805, "uuid": "a1ed0f41-ac01-4641-8c9a-6ecdd650fdcb", "comment": "Malware payload (RedLineStealer)", "value": "1adc227c86fa9a120e044fb4c50e9b3e3d724e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379805, "uuid": "6d608bbc-c5d1-45b3-86d1-05462f322845", "comment": "Malware payload (RedLineStealer)", "value": "db12c360ccb2559c8cf39f9525e5efc159a1c16a3886c8bfcb2063c86af53e139d9ef3912bf549f38b1d003a27627bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379805, "uuid": "15f0345b-e0a6-46c9-aefe-b30fa9c27929", "value": "T1E0840253BBD88532C9B527B088F617830A367DA0D578836B3781A94F5DB36D0A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379805, "uuid": "3aa4012a-131e-4a47-b57d-bb88bdccbccc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379805, "uuid": "5adfc509-9d44-43a3-a9f6-4ab95b3f4867", "value": "6144:KYy+bnr+np0yN90QE8ABXEWcEovNlJVCn1kzbzjymJMsv6nho9zmAis:YMrfy902IXEWwPJVCn1EzjCo9zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379805, "uuid": "1cc08107-d93e-4871-8c6b-a2a1e6aa0802", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379805, "uuid": "a4dd546b-f53b-42c4-a6d6-8a1a62d88a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379805, "uuid": "f7d4f767-416a-452e-8159-d4faf07dcc55", "value": "cf4ae40a41ef9ec04371398331ae140d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b240297d-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690379993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379993, "uuid": "919c6b81-432c-45ab-b44d-c83db9d38c6d", "comment": "Malware payload (Mirai)", "value": "58a9933659bd117af57386d4fb13ba9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379993, "uuid": "cb8c9f82-fd1a-4dd8-a79c-0fed24fdbca7", "comment": "Malware payload (Mirai)", "value": "845b8d2eb5a90ee6606611622e745e620ca97e101a27cbf3b421de2609adac93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379993, "uuid": "b07772dd-d39c-4562-9023-f96d9e1de87c", "comment": "Malware payload (Mirai)", "value": "203befe4aeca9b26bfbb98dd0c85f1e00fe93c7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379993, "uuid": "cf5acd06-77e4-48b2-ad7d-727817ea8397", "comment": "Malware payload (Mirai)", "value": "09673a29cb4165d54a3daec1be5094a67e47aa84dcab7bfff86d2c1ef653247d7719b775f10722bb9345eac03aae140a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379993, "uuid": "cb026b13-d7fd-4b40-ac5b-93c33515702e", "value": "T19B438D37E96E1E74C04641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379993, "uuid": "2bd55e9a-f499-4e91-b59f-93c32bd0475a", "value": "1536:Naa0brW/Od9hlCRbK6f0KwXQCcpvDCM12+WL:Nv0brWGd9X96f7wapvDM+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379993, "uuid": "e563c6c0-c08d-424c-9d0d-11973e53cc18", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379993, "uuid": "10e389fb-714b-43ed-8967-b3136b43d57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379993, "uuid": "2ed48818-d5fd-473f-9955-ecb0a6aef3ed", "value": "58a9933659bd117af57386d4fb13ba9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799802c5-2bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690381616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381616, "uuid": "7e2839f4-2889-47f9-92c3-d5839ed398ac", "comment": "Malware payload (Amadey)", "value": "1e403ea018e300ab5fa01dc6722fd8a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381616, "uuid": "85d9c36d-98f9-4c0c-aed0-1112ac83d3b1", "comment": "Malware payload (Amadey)", "value": "853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381616, "uuid": "38312688-b2cf-49fa-aeba-a7341f7c0e47", "comment": "Malware payload (Amadey)", "value": "b84fea8ce4026eb79d8048b8c2af1d21ecf1364c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381616, "uuid": "011057b1-67d1-4517-98b5-0b7607de48a3", "comment": "Malware payload (Amadey)", "value": "c683fac10f1e2b340381b06304c5eb209ef750f27f40c05995e48c057587c774ff2c9acff23e04fccb1951e41278e44f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381616, "uuid": "1e4e8e87-fc5c-44f6-94ea-eee68339d53a", "value": "T18CB40202BAE88073E8B63B705CF712C70A717C924D38935B6B41A85F1D73988A97577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381616, "uuid": "a6292b3b-6865-4663-83f9-f8ef6c721f68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381616, "uuid": "46d71e88-4021-4fa7-b9f1-e5f6fd660f30", "value": "12288:fMrdy90UdEtCZ8v/PXBqYmXzGNmIubtV4xM6ijMEV:yy7ut3nx0XKNmIucBEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381616, "uuid": "dd3e9cdd-cc0f-4748-8e79-ed604ce55f02", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381616, "uuid": "57dd1626-49b4-448b-92a2-dda60e77819c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381616, "uuid": "0a4ac81c-c5bd-4116-89d5-352d12e3890f", "value": "853890cb435781965f3dc9618397058d03c8d3e59706e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad43a5d9-2bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690383421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383421, "uuid": "0605ea7f-73aa-4208-9ac0-2df5a0cded0e", "comment": "Malware payload (RedLineStealer)", "value": "29f49a573cb9d9eefa26b783575a7833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383421, "uuid": "097d4682-eb10-42d3-a47c-cc8597a23773", "comment": "Malware payload (RedLineStealer)", "value": "85555569bb7d45d357512a0eafac484c22aee485efcb08f16f10d5cba19ad94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383421, "uuid": "b23e56c5-8834-4df4-85bd-98101c8d94af", "comment": "Malware payload (RedLineStealer)", "value": "39eca76bc506027b137c37b95465789b1f63889c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383421, "uuid": "11467447-90c4-4d89-8d5b-6e32c038af82", "comment": "Malware payload (RedLineStealer)", "value": "259f32f7cec63214e6106ac942cc81e53a0c6d616ed868c764f9f3d488c72375fd9f1157e9792be4a14038d3c32f6aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383421, "uuid": "46ddf472-dc53-4671-aa2b-ecc5c7dbf91b", "value": "T125840242EBE84033EDBA1BB059F602C30B377D929C65436B278A9D4B0DB2794A571737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383421, "uuid": "31f917ea-3c41-45dd-b665-31f10691cc62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383421, "uuid": "7004a9bc-81a3-45b1-a691-ef4dd02da5fc", "value": "6144:KZy+bnr+Vp0yN90QEIbPyhWbmhXtqYnlkff2MDV2m7qbOvvRxsh68j:PMrJy90ZFhkYnlk2MDVvUh6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383421, "uuid": "987849c5-897c-4f65-9ce3-fab08a229dbf", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383421, "uuid": "261b3151-ad1b-417e-8c85-25b98c73e66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383421, "uuid": "e1af3229-5314-4223-be05-76b0fad87c8d", "value": "85555569bb7d45d357512a0eafac484c22aee485efcb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6fb2df-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1690385035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385035, "uuid": "c90c1b2c-8ede-49ff-9718-2d0e39d2e5dd", "comment": "Malware payload (RustyStealer)", "value": "d367dbc08b40198ffa3ccb0653345007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385035, "uuid": "7b20747f-5e54-49c4-9612-2d0657651f0a", "comment": "Malware payload (RustyStealer)", "value": "85c01f298abee33fdb0f73b855765aef190aca021e89ddcb0ba3887989ecefd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385035, "uuid": "d5975042-9dab-462b-978c-8986c0bdcf6f", "comment": "Malware payload (RustyStealer)", "value": "3c3cb763162523658118148c4c83723f1c43eefe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385035, "uuid": "9696ebbe-6605-4f24-9512-b49d36ce703c", "comment": "Malware payload (RustyStealer)", "value": "9b0cf69e55bd9796a1581a55d7b6260dbf6d76d4a588ee1c67abb9b67aff1df8afe033a7d5a492c3b94464980a719276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385035, "uuid": "49993e03-78ee-4513-a5ea-7fb39e4b9a26", "value": "T1FBA55B43FA858AFAC09DC17883479332B635FC8C4B11B76B2B945A713D26BA05F5D398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385035, "uuid": "1797ff8c-4968-47af-8f63-fe7f058a97b0", "value": "ffb8ac336fad56417c421e8d5adcf9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385035, "uuid": "b4fead15-1cf1-482e-8770-31e2e9eaa6a6", "value": "49152:iSK1y8MYZR/WXnbKRBKiaKKkkVWEjBKMpSo8nfN0:UM1ODyWEjBKWCfN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385035, "uuid": "9c350aea-0ba9-41a1-b728-3fe24157d72c", "value": 2189824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385035, "uuid": "30d967c9-dc12-4195-94d7-b01200e3d088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385035, "uuid": "267cd68c-d4ab-40ff-9985-53b348d93964", "value": "d367dbc08b40198ffa3ccb0653345007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196f664b-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356974, "uuid": "d280054c-d5d6-4516-8de7-a9f2704a5d4b", "comment": "Malware payload (RedLineStealer)", "value": "0b9330ac6e488f8aab3e6efc07b66f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356974, "uuid": "0b4d50e0-8467-425a-99b0-0bf172716363", "comment": "Malware payload (RedLineStealer)", "value": "85e1cbacd3312ac032e7a3a07c5bf6b48658d5e92a6c301d64841132b24cf0e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356974, "uuid": "54133cf7-4c5c-49fa-89e2-4cfeae1229f1", "comment": "Malware payload (RedLineStealer)", "value": "99a7dfd1d1afe5c890c561bfb663b465237c3d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356974, "uuid": "10eda851-d468-4060-96ad-304beedecd5e", "comment": "Malware payload (RedLineStealer)", "value": "642654737f81b6db7439fc895cdb48a295da5de4d7036d6315092fa0c78bb5cce0f32ac0b0c6232c627bfd9505433e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356974, "uuid": "c9f81e70-dfe9-4ada-b9c8-24a6c68f0bd5", "value": "T1CB840202E7D99072E9F517B094F612830A327D629D78C36B374AE96A1DB35E0683173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356974, "uuid": "06eb0373-74e3-4d3e-a543-c5ddc4c1b7e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356974, "uuid": "485fbe7e-a43d-4253-9f66-a3ab21d5cd98", "value": "6144:KEy+bnr+Sp0yN90QEeAwoDuFvRJjYzGi9WR7F0K3ZHgBZ+t4qDSmyvXH+0XSSc:IMrSy90DQFvHj0WaKJHgBYCq7yvcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356974, "uuid": "f858d971-e69d-4589-940e-fe16cf4a784f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356974, "uuid": "dc95f7ea-3786-4e20-ba87-89eb90fb5c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356974, "uuid": "4b3c8338-717e-4f0a-90ff-31cabb754334", "value": "85e1cbacd3312ac032e7a3a07c5bf6b48658d5e92a6c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030408b1-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408046, "uuid": "ef9f5e06-7391-4f4d-a16a-920b44b4858b", "comment": "Malware payload (RedLineStealer)", "value": "1e53bac92881f6e30ffce45296b9ea22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408046, "uuid": "1a6af619-cfb4-4109-b7de-1929ab54fad1", "comment": "Malware payload (RedLineStealer)", "value": "85f2f1ff9ebbc00b11310cb6b89768dcf0eb2032b0a64810fc24c9ec9b4a6804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408046, "uuid": "a555380a-668e-4d1d-86f4-b7b4ec742859", "comment": "Malware payload (RedLineStealer)", "value": "5d52caa9d36a551471b4a3de70cf6fda53dfc62b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408046, "uuid": "a794b5ea-4e4a-42d9-8e0c-17642503ccf7", "comment": "Malware payload (RedLineStealer)", "value": "2161f0b6950a2d21571d55f02ece367217c17e1fed5582d1f0a99534af5f0a40587f9aa0ad054c41764ae64689006e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408046, "uuid": "aadc7ebb-cd86-45dc-b709-724a1b362a76", "value": "T1AB840243E7E89473E8B117709CF602C31A3A7CA66D78436B2245B95A1C726D0E97233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408046, "uuid": "3e2418a8-88cb-45a8-b300-aeacb8822197", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408046, "uuid": "7e95c4e3-18ee-4a50-9a64-433401f78be7", "value": "12288:6MrZy90LWdxWlYoK4/FZDp0gBYCux13lmaj:DyUWd8lYZA7pbzMYaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408046, "uuid": "9d8e3d8a-1f9b-4b9b-bb06-f9fd4028645b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408046, "uuid": "55a0df92-5ed2-40ee-8a2b-a7b9f60df941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408046, "uuid": "12665f78-8e7e-4374-880c-4ac6acc68e3b", "value": "85f2f1ff9ebbc00b11310cb6b89768dcf0eb2032b0a64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97d3f55-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396300, "uuid": "6eef0811-101e-4cd3-aafe-144a104d8e95", "comment": "Malware payload", "value": "e4dfb7e8f38049fab4a2279d32f067b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396300, "uuid": "5ac9a694-acec-475d-b785-2bca8f3617af", "comment": "Malware payload", "value": "8600ae52f599675ca1e062da68f43ffa6f89b8a1b980cf248afccac6b21730ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396300, "uuid": "a4a42dbf-a14a-4134-a925-b4bf1ff60096", "comment": "Malware payload", "value": "d641e868cd21c528ec7629c7e8e8a7b92afc13e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396300, "uuid": "7c60de45-618a-458f-ad38-73a0db940957", "comment": "Malware payload", "value": "573030eea71ce91fc77a55dfa817492729d69c5cc3089c31cf37a53b9725ae319018a181377fd2965eaf5e52da859676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396300, "uuid": "11d24164-35ac-4376-b7c0-91a02dba70cc", "value": "T1FDE5E092360EA6DFDD57C037F017BE37804E12A64B4B92CBE59B04547B231C2517AAAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396300, "uuid": "34f8fdb1-c6af-479b-b754-2f82c6743803", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396300, "uuid": "d987ee45-783d-499d-8bad-37f28d6cbca4", "value": "49152:ibQeO+mRt0F1QKYO9istx/VlgootKGz/jc/TMes5h+VR:OQimR+QdsbtfEqMsVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396300, "uuid": "2f51303d-fdc1-4406-9513-cf7d2e876b47", "value": 3080408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396300, "uuid": "cf03eda8-0f9b-4a6d-98f4-f99a1707d2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396300, "uuid": "e676fef1-0ee3-4602-bd65-827315766e36", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.30906.7335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f6afab-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356032, "uuid": "ab91d81e-f6d9-4760-8d1e-afdf2937f855", "comment": "Malware payload (Amadey)", "value": "028ada40055700c75856b346aacd2442", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356032, "uuid": "c3e7065b-d3d9-450c-9c19-73c44f9a3380", "comment": "Malware payload (Amadey)", "value": "8667b56e9d5de683eaed43ffe8a9d8b6dfdc75b9d440ded34c4a9097f1a56b40", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356032, "uuid": "d92039e8-52fb-41c2-b1f4-8b9de0e75202", "comment": "Malware payload (Amadey)", "value": "e76a9c9f5398987e4523be6efa85892eb78c35ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356032, "uuid": "68478e6d-022d-469f-8e2c-2db39aff3537", "comment": "Malware payload (Amadey)", "value": "dc19337ea8cc087cd7eb4b3ecee8e66bf2c0f9a650d270b9c2f64aba493aac942fbe58d12a5b248d887c47e8cfeeb67c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356032, "uuid": "4cde98a7-0ed9-4b60-b02a-0155e9b8d8cb", "value": "T141840213EAE94073D9B41BB01CF703931B367CA16D78535B269A685E19F26C4A83233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356032, "uuid": "5134da87-9514-4d5d-b4dc-6ed3fa1c10cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356032, "uuid": "2dae6af4-6c22-4048-a5b3-0274282a05cf", "value": "12288:xMr3y90usVii4XODQK2S+kWC2zzUJXMyTq:GyTiIODQKf+M2zzUZMyTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356032, "uuid": "89e40c1e-160d-4bef-b987-38b1d4dc99ae", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356032, "uuid": "d9f4d381-9caf-4165-8467-857b4bc568be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356032, "uuid": "c124d84f-26be-49c9-b3b8-86f809ef8e08", "value": "028ada40055700c75856b346aacd2442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5110d77c-2bb4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690376394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376394, "uuid": "88508b35-48ff-476f-b3fe-184d5050ca3b", "comment": "Malware payload (Smoke Loader)", "value": "8efd86c2256efdc3506313be186a86c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376394, "uuid": "68b5d2fd-f913-477c-849d-a69fd0148cbd", "comment": "Malware payload (Smoke Loader)", "value": "86b001e3eb278c3caf88e10955df68b9dc4c6290ded07d884efda572b6f1fc3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376394, "uuid": "c70a95f7-e45d-4822-b4c2-a998ecffcf98", "comment": "Malware payload (Smoke Loader)", "value": "4d871e5bb3bcfdacb285528b5dc709f9b1d606a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376394, "uuid": "53f52386-c541-49d0-999c-99206e9dd51a", "comment": "Malware payload (Smoke Loader)", "value": "240e919906642ee77aff446365766c9b360160f51f9c92c1a14fdea8c2ba08773567fd3c576ab54f33561703e40627c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376394, "uuid": "05930604-6f1c-44fd-802e-ecdee64e1c10", "value": "T19974C84383A1BD44EA254B729E2FCAF8768DF6518F4D7B66A138AF1F00B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376394, "uuid": "4ec9ae6a-9947-4c23-8220-030b0dfd44f5", "value": "23b1f12acfdc16a0095d4f2599c53eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376394, "uuid": "e923c27f-38c5-49b1-a94d-64017255847b", "value": "3072:WV7/rEFoLFg4r9GtTavisceN8p7leVjfoZa5g91RTyCwlGvPGT1lTU0:s7oFoLFgY9m5HeSp7leJol97djv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376394, "uuid": "dca8eab7-fb13-4f2a-b1c2-c22e6e4acba3", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376394, "uuid": "15cc019d-9360-4e75-9f5b-e92dea732336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376394, "uuid": "5eb272e6-a889-4f2d-8745-d47632a98b36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f02f26-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690351039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351039, "uuid": "3087c2bd-b4e8-45ed-a54c-bd2bfa2777d1", "comment": "Malware payload", "value": "a0cb857b724f2cd0047926ea91013253", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351039, "uuid": "b8ab3129-fdd5-4286-bbed-7e8859391f6d", "comment": "Malware payload", "value": "86bbccd1e990a5ff3472fb21988d93c7325773410e3072c0ba720c80deee94d9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351039, "uuid": "7d6e7c86-354c-4ab9-ae6e-8ca133defe66", "comment": "Malware payload", "value": "e6e2285c7edafc2317b6a63d99dfeca58ac6d585", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351039, "uuid": "10ebe015-bea0-4d5b-9132-0651e0bfd236", "comment": "Malware payload", "value": "ecb665ad199f29435759d3b4fb1cd6e0270fe9a8f35d10d61eb95120aac09ed44a5d4a243f09294af9c50d206bf808e3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351039, "uuid": "b70066b8-0e79-48ed-aa80-24c1485871cc", "value": "T1C3D423BC2AD6031B49E50AE8D0C6AD8F1578FC036DF32409E94BCA877E3649F6285DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351039, "uuid": "d91d22c2-c22f-432a-b1db-ee8a0ba9929a", "value": "12288:yv4lQ700iN30gsvHEuPbqcLEebydmUqYIAMs0jme+xtmmRD97Vje2/ZxvEweW:ygc0mfvkuPbq/F0UxD0Ke+hNJJ//FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351039, "uuid": "cd3a03c1-5791-41cb-becb-47394be1595c", "value": 601183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351039, "uuid": "5d8c1b6d-9a35-4a61-bdfc-cb9c6762f4a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351039, "uuid": "6c945984-7b06-4fd5-adbf-85f21edc2900", "value": "Order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8addf042-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690356305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356305, "uuid": "a09c49c2-7659-4490-acfb-f68cd116df65", "comment": "Malware payload", "value": "51dfac37926ca4687d0a84dd43f491ce", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356305, "uuid": "12184871-067f-4806-8b91-835918a4e2da", "comment": "Malware payload", "value": "87224f5e2ed579a0b01bcb5468f6bd141061cfbec7ec519ab43871c49756ec21", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356305, "uuid": "b74fc6ba-fa1d-407c-a842-1eea006dc328", "comment": "Malware payload", "value": "f247fba3f30d5a6af74d2ce7aab25af65e1c9a20", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356305, "uuid": "eca360b9-4c1f-4205-9721-bc5d26137551", "comment": "Malware payload", "value": "93eb3d13820759d725292b2dfd4be6f2de8ab2df63e3435f2b5ecf343ec0ec7773ccc1b424e07ae23cde2a0faa2379cd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356305, "uuid": "efb07e9a-4d10-4529-9a1b-b1395ffccc7c", "value": "T13313B05AE79F0264CF411273272B0A89AABDB23EB35151B1346C937433DDC3E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356305, "uuid": "83c7c7aa-516a-488e-ac1f-f2a35108ed39", "value": "768:QFx0XaIsnPRIa4fwJM4FLgbQZbQSKVR0GOu562L2:Qf0Xvx3EM4Vgslj3E55L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356305, "uuid": "ac4c9a78-d820-403f-bbb8-d7f1adc2adae", "value": 42894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356305, "uuid": "41330bae-3c3c-4f07-9125-47c7e1335e23", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356305, "uuid": "9209d539-6680-43cb-952e-81b87a5b7424", "value": "51dfac37926ca4687d0a84dd43f491ce.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ea21a3-2b8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690359870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359870, "uuid": "d5fdfccf-e37e-4976-8f20-1cbcb4e63c0b", "comment": "Malware payload (RedLineStealer)", "value": "7c0957ccde290cad7bfa348a9258512c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359870, "uuid": "e091d43e-3b96-4779-ac19-74d685d441ce", "comment": "Malware payload (RedLineStealer)", "value": "88323489bf0a8a306b3964293fc6f80ac5bb322b7111381c5b5074a42484fafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359870, "uuid": "b16ae469-0747-4a6a-b235-4f28ca92eb0c", "comment": "Malware payload (RedLineStealer)", "value": "fee2f29724e44364a6eb7e797f5522ddc8125da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359870, "uuid": "2cbfd4cc-25cc-46c4-a6ca-bf9a7822233f", "comment": "Malware payload (RedLineStealer)", "value": "324ba51eb5f35400f5d1ea976f19ce589af74e70d74327dfe0fa8fd6a79bb9103d961c4b8e0c06f7ba6ed03848adb212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359870, "uuid": "f4253cb3-608a-4767-9fa6-74d22c5dee67", "value": "T1A774958383A1BD44E9258F729E2FCAEC761DF6908F4D7B66A138DE1B00B51F6D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359870, "uuid": "0a64731a-eb7e-4879-b7c0-79bf3bff9528", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359870, "uuid": "d56ed383-7499-4601-b349-415cc95efc7c", "value": "3072:wxxelV5LGcUOJ24S+c5gSFCR8VRWsTpQSw4R/5fbwlGvPGT1lT5Z9O:akV5LGcUfrQSFCR8PBTpxNbjv+HTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690359870, "uuid": "db9ff21c-f142-495f-8bfc-c475beeb1b47", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690359870, "uuid": "198417a2-5d32-4159-868d-fd1016ebdce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359870, "uuid": "f6235ea4-1402-4a15-acb7-576c0e3b0568", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d56c4f-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356030, "uuid": "395866e5-5cfd-43a1-bf29-5e4debdba22c", "comment": "Malware payload (RedLineStealer)", "value": "13067c717760ca09dd4164f8c6be3985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356030, "uuid": "c3caf161-85de-419c-b57a-3efdc994d89c", "comment": "Malware payload (RedLineStealer)", "value": "88614b72e92e4a16ce41dcd93530efc922112a69aad6300322647b3f8f61ba2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356030, "uuid": "d002ade0-132e-40eb-bd77-0cd81a6c5d7d", "comment": "Malware payload (RedLineStealer)", "value": "f42cdc385e393cb2e545e37fa514c36f0c33862b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356030, "uuid": "3e47d6bd-fbb4-47dc-b238-151ff5fb6af4", "comment": "Malware payload (RedLineStealer)", "value": "3242a7c8a00cb8c8ddcd5041101a03e2dc25d038df57e85e5befd24bd07f87aa9afe2ac3df2b3b07b7480263941c6128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356030, "uuid": "ec228072-bc56-4eed-916c-0ee2f54a9098", "value": "T1ACB40252D7F84473E9B127B048F603E30F36BD705E74429B1A99A85E2CB3590E93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356030, "uuid": "b537e4a9-a8d1-42ae-b5b8-c6c2b43b01a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356030, "uuid": "acc56eee-5cc9-464d-bc2d-116eb564b1a2", "value": "12288:BMr2y90/ObZ+ytEzlny/k1eDSbZgm3YkIbFJkZCqr32:byhkMERM2gzkwF4zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356030, "uuid": "4000107d-fca9-4fe0-93c6-43f8cbef1a80", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356030, "uuid": "6eaa2d17-c687-407f-9ab0-8888b7d72fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356030, "uuid": "30a57ad9-fea0-4d3d-bac6-9b360bfd4db9", "value": "13067c717760ca09dd4164f8c6be3985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f206c7a3-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356049, "uuid": "7848e294-42ec-45f3-ba4b-4703a754a82a", "comment": "Malware payload (RedLineStealer)", "value": "0ddf488a1d734bc16ed5104212c14118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356049, "uuid": "07af3a62-34bd-4a90-ba22-b80812e11f9d", "comment": "Malware payload (RedLineStealer)", "value": "88837c1d0d2d41c52fea9f9de92e9d65dd25cebeb369a7bcf07c1dc22a3d29b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356049, "uuid": "546b9089-94da-4c0c-a650-db4429a79bc2", "comment": "Malware payload (RedLineStealer)", "value": "e8b0a123d09075a39647a86ec95b949c16177707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356049, "uuid": "5e1ceb79-3676-44cb-95c4-a29b5c4af941", "comment": "Malware payload (RedLineStealer)", "value": "170dafaf04ee447929e217b3efa2f5b8323ab634d4416a9e719d8c8936be6b738c0bf290d42d3a8693f33f933883a155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356049, "uuid": "0e2f698d-47e2-4937-a249-253bc74a5e3e", "value": "T1F4840102BAD94073D9B517B068FA07D30B367DA55C38932F2781AC1B1CB26D4A87676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356049, "uuid": "29f2337f-2697-4342-b036-ce283cdd7cbe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356049, "uuid": "df87569f-bf67-41f6-9109-b5a72ea0e517", "value": "6144:KPy+bnr+Tp0yN90QEaojy7ylHc6QeJkKYGH9DhD+kgBZ+t4nDcC/HXCUM7M+:9Mr7y90AoTnlhDLgBYCnwC/3Ct7M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356049, "uuid": "e85ddcb3-d608-4b99-bb3a-29a0126f0970", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356049, "uuid": "157603c0-0402-46b6-9f02-88818d43451d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356049, "uuid": "e568d959-aeb3-470d-8397-6f31c756eac0", "value": "0ddf488a1d734bc16ed5104212c14118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ec4362-2be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396807, "uuid": "568a65e8-4768-4214-86b0-8a77f11ccc7d", "comment": "Malware payload", "value": "e9957181ffe5cf7bebf817c774eae4ae", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396807, "uuid": "5526db48-bf33-4502-a933-babee9058777", "comment": "Malware payload", "value": "88c0091c633ee392536a265b40bf6f5c8a7ca856f74963638682ee24ca720204", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396807, "uuid": "7c7551b3-fc9a-46fa-8f33-3bf295fb04be", "comment": "Malware payload", "value": "d0c4dab09188aafcbfd6ce74e4567aca69033eb2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396807, "uuid": "6f06db6c-db13-43c0-b068-223a1fb11dc4", "comment": "Malware payload", "value": "4adfe5891155007e7c7faace91aa57544688f3ffca39a9d18e68865a57187e9a7c8d03d653639d60a1517f2573645829", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396807, "uuid": "da5fdb0c-50c7-4816-a48f-09a3d2d3165c", "value": "T12AC4230B46B9A44AC1753DF46F148898FA7FBE3E99F08774539CA963A77E03009513C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396807, "uuid": "707a5087-636c-40ef-a658-b29824eb3367", "value": "12288:P4Tgjom7NrnEMNcWjNzXDCH5zrCH9DSH4+XgDIwSm7PHK:PAgVxbdDSpg/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396807, "uuid": "2e9bb4d4-e5aa-4104-928c-3fb494473cf3", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396807, "uuid": "b4517fa0-2185-48f1-8a11-2b0f25748413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396807, "uuid": "23f00506-a8dc-4133-8420-11658b1a5723", "value": "e9957181ffe5cf7bebf817c774eae4ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7d17bc-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690357167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357167, "uuid": "76887080-5d34-4f98-9edb-64870a70c992", "comment": "Malware payload (DarkCloud)", "value": "e9a32c39471da0a007579b86dfd4ce38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357167, "uuid": "4c356a99-99de-4031-afc1-616f98184565", "comment": "Malware payload (DarkCloud)", "value": "88e5b0195785890d324ec49f11d0fcfd1f33c0b61d364825e6bb04831abc7fbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357167, "uuid": "9abd5352-073a-4baa-adad-f4cf92203b38", "comment": "Malware payload (DarkCloud)", "value": "6a5bafaf92e61712334b568d56896eb2613666c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357167, "uuid": "97f5996d-94f5-4f79-9779-41ef25f36340", "comment": "Malware payload (DarkCloud)", "value": "b044b64b57db4617d8587effb097e066d35591341140b95d0ef3fdc36b0d129c89d38bf200c7ab523f2b179d01d0255e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357167, "uuid": "b44b9e3a-007b-4152-b3d1-29e3dca012a1", "value": "T1D6151215AC695E08C83B53B0925587140FA3ED9AA931DE9569F321DFDD37FE032C0AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357167, "uuid": "12cb2d03-2c31-4a9c-bddf-3829ab8fc762", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357167, "uuid": "8b8e4734-ced6-407a-9a1a-2c8db397be11", "value": "24576:7f1xUL3sZxy6bpyVnJatGLtBxqg6IOBc8/M/:TT2f6NyVnJatGLHogXO28k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357167, "uuid": "0e005e11-030e-4ef8-a762-7fde547fe9eb", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357167, "uuid": "35e60770-5f43-47c8-9e8a-008d0ad6da7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357167, "uuid": "96971fcc-e98b-426a-b08c-46195b1a03af", "value": "e9a32c39471da0a007579b86dfd4ce38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d419b228-2b8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690359434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359434, "uuid": "8f722ac7-626c-46f9-b882-a8e60c56595d", "comment": "Malware payload", "value": "e5b99cbc2f89e9aad88eb16a8aedc49b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359434, "uuid": "067abd6c-ab97-44fe-865f-0aca883f668f", "comment": "Malware payload", "value": "894232652fcb90d251152450a5dc6b6d804056776eaf0f35624b72bf9c0c0560", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359434, "uuid": "c20a3bad-8e14-4aeb-925d-67d79a1bc160", "comment": "Malware payload", "value": "fa695cf73d447f762bd395179c467a583e8e7711", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359434, "uuid": "dd69e3d1-eee4-45ee-8695-1dc27a87650b", "comment": "Malware payload", "value": "c8eaa5ca20ca589e941fcd63ee045a469b7c119b19a4215a7a543cd9c667303d2aa07b55a8545b9835e8892822d6ed36", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359434, "uuid": "82bd8e9c-adc9-413c-8837-2594631694a2", "value": "T107B4237BB64D990BE31FB572A3CAAC4AA4F5C5E425784A0978D3CB5D000EC11FF8D661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359434, "uuid": "30d80cfe-b5a4-4da9-9a05-0ddd856a15ea", "value": "12288:vHix6kQWpwGx/wtmi6EUea7pmuigDeySFF1+O11:G6kQWDxUNURY1weZFN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690359434, "uuid": "58d38be5-2cf5-4325-9613-e88c453d0cb3", "value": 519260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690359434, "uuid": "7cfbce96-5467-4b68-9275-9f9faa43dabe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359434, "uuid": "12c7ac3f-219c-410f-83d3-1e2e8384a964", "value": "NEW ORDER 0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ae1579-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690385764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385764, "uuid": "df8828ff-dd9f-4fd8-92c9-3c273c82074d", "comment": "Malware payload (Stealc)", "value": "c1a3964433a7ded12e86f91213026bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385764, "uuid": "5c46d084-0ab0-4531-860a-04eae4971ad8", "comment": "Malware payload (Stealc)", "value": "8afd72197f13d7016291b5799cb9e680146d09b9b06661bb0de3f7972ef56fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385764, "uuid": "e14b1617-8a71-4713-8392-37dccc4486a3", "comment": "Malware payload (Stealc)", "value": "ef4fd1efb19573be5b161cb4a2e9cdef255bfe67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385764, "uuid": "dec16a34-74a3-42b7-8fef-30615e7f590b", "comment": "Malware payload (Stealc)", "value": "74c6bef2d3966acf6fc8784e515de2f722017365876e9c79c0341ef09e1ca5543e31786544def97bb4e003d43e8041c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385764, "uuid": "b5aa18a6-f730-4b4d-a5c2-f3acc59dcf67", "value": "T1BF74C64383E1BD44E9258B729E2FEAF8760DF6518F4D7B66A129AF1F00B50B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385764, "uuid": "53121a07-051c-432e-8685-6d56268cb0fa", "value": "bc04db2ad2507103ec76e744e96f25ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385764, "uuid": "e0855110-2d2b-4fda-861c-0cf98fa96228", "value": "3072:SHSJVkL/+Vyb6byvn6oVp62TX35dQNHK7NRE75wvO9wlGvPGT1lTU0C:e+VkL/+Y+O/1f6CdEHcvvO9jv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385764, "uuid": "ad64bd1a-9ff8-40e2-ab9d-acfc6fe14e48", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385764, "uuid": "70feb1ee-c88e-47c0-aa0b-04fed57ac273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385764, "uuid": "21453ab3-8198-435b-8940-62ca141ece3d", "value": "c1a3964433a7ded12e86f91213026bb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d78a49f-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356658, "uuid": "b1e2b7f1-5102-4abc-b2c7-d9d6d41f65b6", "comment": "Malware payload (Amadey)", "value": "d524d431bfb41259efb3914410ec7f73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356658, "uuid": "0b7e710c-0e17-45c5-b369-3c8dbbd2df39", "comment": "Malware payload (Amadey)", "value": "8b8def5ed3e3a8b1d9e118e5df127253586bdc87e2a2010bb2eb8f4b898ca261", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356658, "uuid": "2a94dc2f-53f8-4392-bec7-c85ff566675b", "comment": "Malware payload (Amadey)", "value": "4b5ffeefa5f1535f6c8d79bb22e78c245e2f69a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356658, "uuid": "2f8ee9c6-7d33-479a-985d-1fb73615d192", "comment": "Malware payload (Amadey)", "value": "3f5892fbd121fd9fdeadbbd547135dbfc1a652095831da8f39bbef1f076fde1c482574714c54aefbba4b50318e9f4e80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356658, "uuid": "d7c91902-8e30-43c0-a377-c57e879994de", "value": "T1AF840213AAEC9533D8B417B418FB02C30B36FDA25D35536B2786A95F0CB26D4A47136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356658, "uuid": "0da2b650-d3ee-4032-a31c-719a4aeb8dbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356658, "uuid": "6981a3f8-37ad-4084-aa99-262739a02bed", "value": "12288:2Mrky90n2OeRJ2+xgdllv6JBj2z64PyQ:uyCeDxgflCrj224F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356658, "uuid": "28b64f00-23cb-423b-a82a-6f8689d5feb9", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356658, "uuid": "ad12bd3a-35c5-42a4-948c-4bddbd21bfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356658, "uuid": "cb850aea-00a9-4870-bada-8934a3f1bfca", "value": "d524d431bfb41259efb3914410ec7f73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58be4c7c-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407761, "uuid": "d57a3f9d-ab4f-4f78-9da6-2f63762b1211", "comment": "Malware payload (RedLineStealer)", "value": "9b5e66c4c9fd3042fabde5eb2c71e439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407761, "uuid": "3a2a13ee-9072-4076-97f6-1f3583ce129d", "comment": "Malware payload (RedLineStealer)", "value": "8c018460f88cab072268e2fa55bf7514cccc5ec1a8187107e824df1954f54a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407761, "uuid": "e4cbb89f-51bd-413e-be84-8c1795b574cc", "comment": "Malware payload (RedLineStealer)", "value": "487f16a680109ae69d78e35afe7781e90550acc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407761, "uuid": "fe257633-903d-498c-b15c-ea33044a4662", "comment": "Malware payload (RedLineStealer)", "value": "dace9e3506a6ca28a86eb8cacefbf51c46a7c2c88f6d778a17a2d192de5b32f3d6febc7e3c9f6301804809a29c68d5ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407761, "uuid": "f7b90858-0817-4097-b0a7-7bfc296702be", "value": "T16C840213FBE98032D8B557B128F607931A36BCA19974836B274B985F1C732D0E97136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407761, "uuid": "c456a48b-086a-44e3-9d73-34e288f45a4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407761, "uuid": "0b0dec98-a943-459b-88c4-ded9abd2a9df", "value": "6144:KXy+bnr+Kp0yN90QEpqflzXaO5gVfyVu/W3xaMbXbh1RCkm7ywEx4IlDmy:FMriy90URc/waMDd1RCIpxvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407761, "uuid": "a8e3ef1d-0ec8-4daa-8fa9-03b75948631e", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407761, "uuid": "f030c34e-381d-4ff5-8ad6-575ab98e666c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407761, "uuid": "357200ca-a2c2-4089-8674-998b556fc23d", "value": "9b5e66c4c9fd3042fabde5eb2c71e439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951e042d-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361476, "uuid": "dcb641fe-22ad-48d9-980d-bc2d398c2beb", "comment": "Malware payload (RedLineStealer)", "value": "b6c0844b0483ed0a1a0533b91435513b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361476, "uuid": "396919fc-b6f0-4758-9414-9438c4b7fe71", "comment": "Malware payload (RedLineStealer)", "value": "8d4de8e376d9c02794f5c8575efc4bcd392fbd27b74744a41266f2d972a74162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361476, "uuid": "c704a271-b69d-4e32-82c7-60cd7dfdab06", "comment": "Malware payload (RedLineStealer)", "value": "b50e6821715406104e5a57569d57601dcdc0de17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361476, "uuid": "b887272b-9654-4e43-8dc1-8d308fdbab22", "comment": "Malware payload (RedLineStealer)", "value": "088ce3d6d639cdeab3995a42f66b017898446a7eb3ac9018ffad087a2dcd6f07678c2aee7033d1dd8039b944f77b0d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361476, "uuid": "c8a6122e-e554-4844-9c69-35dd27fd23d6", "value": "T184840117F7D98072E9B16B704CF603930635BCA59D38836F2786985A1CB27E0A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361476, "uuid": "bca41f84-ed02-437c-b54f-c670a59a3549", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361476, "uuid": "84dabf8d-4bcc-4f60-80ed-141dad9b0a99", "value": "12288:DMrgy90Ol/L2Kk5Tm0gBYCiwpmp5FqryGJk:TyAZTmbzFpm/UOGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361476, "uuid": "5c404c2d-5612-49ac-ae39-7fe2fad59528", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361476, "uuid": "66dccdd0-c325-49d4-9e05-a343b28a4d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361476, "uuid": "3aa51d8b-a376-4c46-b9bd-1ffde669674e", "value": "b6c0844b0483ed0a1a0533b91435513b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faf345e-2bad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690373359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373359, "uuid": "ae3cdc58-e941-4ae0-8692-e3bebd125d52", "comment": "Malware payload (RedLineStealer)", "value": "a5614da146b46ebca0589e7790082341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373359, "uuid": "3347c9ee-abb7-44a8-8c4e-4de2be819e6d", "comment": "Malware payload (RedLineStealer)", "value": "8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373359, "uuid": "46b10032-c4e0-49aa-aa6f-315ba972b384", "comment": "Malware payload (RedLineStealer)", "value": "cd10b16c9b713e9096867cdc418c2ed69fc1fc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373359, "uuid": "1efd390e-cdd5-4450-aeb4-08faf3c13932", "comment": "Malware payload (RedLineStealer)", "value": "167e41e0cd6f775afdd2a409c0597ffb3ba7eb30b05573f2fdf322809a4d2b8102d3c051e422b4b0b8a15d2516b4b3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373359, "uuid": "cdec4d65-79c8-43bf-a122-02aa096a169c", "value": "T1D4257B7039C18171FDE210BA02FCB6E1566DE0B0072656C79ED457EED660EF16AF2E82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373359, "uuid": "41c41137-6475-42e3-9359-9ace4086e08f", "value": "804a3a181935154bc979712eeaeaaa91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373359, "uuid": "3de68c7f-65a9-4bae-81d0-31e0e83f9e3e", "value": "24576:/UVglkQczvB2EhwWLFXW4SH77tYDuu2oEFgU:mQczvB2EeKB877mDuu2+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690373359, "uuid": "f8b94b17-6b5a-4931-a4d6-ae54255e0b7d", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690373359, "uuid": "0133c666-f08c-4751-9307-34ffb0fa0143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373359, "uuid": "e11c0e80-9bc4-4c72-8455-37405a0735a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6e8bc4-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (jRAT)", "timestamp": 1690365601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365601, "uuid": "867c3e2b-debe-4983-9db5-5835d6ffd5d0", "comment": "Malware payload (jRAT)", "value": "fcf09ec5a1f5629f31b7f74bddb5777a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365601, "uuid": "b519dba4-b7fc-4e5a-a51b-a379ca3a0522", "comment": "Malware payload (jRAT)", "value": "8dbc813f84ca22d956507ca16e6b193b5401a04d4f4cc93ac27ce085f7544f87", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365601, "uuid": "5af17e0a-e8cd-439e-9f80-d475ade02f4a", "comment": "Malware payload (jRAT)", "value": "808363946c93b3b3eda3c1ba353845374c203293", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365601, "uuid": "18d5e492-a64d-432c-9066-703b2e5e3cc5", "comment": "Malware payload (jRAT)", "value": "93cd77e0e02beee25ffef03a95b46bc0dec8c6695de9f3205feb8c0fa3d248a357574c7a7f4c4a5bb4ca9788a8f0a9aa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365601, "uuid": "097aface-49c9-4f12-921f-5b0cf97918e1", "value": "T108631202FD9BD507DEC6E233D8C703A99B0008D7499C818D96B47BDBD94A215790B6EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365601, "uuid": "276d3185-28ea-4b29-85d4-d5b33b7cc177", "value": "1536:d2/gOh6r6UtiD1LCZ43l5ucF8upA++wcgIF8TBZNIuzTazZ:YgOhGwLCW155pyfFCBnIuzWzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365601, "uuid": "7b0ad4ec-a048-4dc3-a98c-df72487ea842", "value": 68991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365601, "uuid": "5edac359-ec03-41e0-8749-fd3f13cc1600", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365601, "uuid": "4dfe6edb-3b17-4767-8121-4bf8163d8dd5", "value": "july order 23040.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2dd3ad-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408063, "uuid": "324fefee-f878-4f2e-9e06-1bc4c040a9ac", "comment": "Malware payload (RedLineStealer)", "value": "a61dcf6976fc12202d14bb7796794250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408063, "uuid": "f2094cf4-0da7-4854-a39e-77e6c242fc13", "comment": "Malware payload (RedLineStealer)", "value": "8dc49837cf6f4a31bdb30807b7589f43c7770ca4cbcdbfec4b43cfb821263390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408063, "uuid": "a8e5d782-ff78-4acb-87a0-e061e52710f3", "comment": "Malware payload (RedLineStealer)", "value": "42d951424b0234b569fea1a2628f74978e76e6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408063, "uuid": "41242462-8b17-4ea3-b1c7-181354b339df", "comment": "Malware payload (RedLineStealer)", "value": "fd5c1d42642f5f0be5d88a392ffbf3c4562ead62dabb9e60fc267c873170b5f473d5427ec4ddf82abfc35c6843c8d9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408063, "uuid": "616cd401-28a3-40aa-9817-672a6f5f4d75", "value": "T184840213ABEC8072DDB927B158F612C30B36BCA19C75426A274AA94F0D726C0E57573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408063, "uuid": "7ead2b2b-687a-4b53-8d77-0da8d2890de8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408063, "uuid": "285f629f-cdd2-4c3a-ba1b-28d4f3728f6e", "value": "6144:Kwy+bnr+/p0yN90QEqI7eOkw0hkWGjZNhvIDwJCD4SUE/VH9gWmJ4gv30Z91pKO:AMrXy90MIAwf7JM4SUyVH9gj3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408063, "uuid": "2fd50529-c5e0-4465-a742-205fecda7504", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408063, "uuid": "ad84e9fe-5bfd-4788-b1a4-0e4bfab62a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408063, "uuid": "401d34be-84a6-4df4-b7ae-a641bd022e8c", "value": "8dc49837cf6f4a31bdb30807b7589f43c7770ca4cbcdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f70de5-2ba7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690370784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370784, "uuid": "19cc9628-71cb-4dd9-93e9-eb61a459c7e1", "comment": "Malware payload (RedLineStealer)", "value": "3c8ab3c6bc516ea8ae05cf9f7737c1fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370784, "uuid": "69d04a34-f124-473b-b542-47e3549f0ceb", "comment": "Malware payload (RedLineStealer)", "value": "8dc94b3785f97aca2e98d9fe22c0c94a896ddd07c1869f9f451ae31af0b90c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370784, "uuid": "b7102f51-695e-4488-8da1-3d48ed9d68b2", "comment": "Malware payload (RedLineStealer)", "value": "f88d465230ff7496b1a9177668adf6815f6d3005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370784, "uuid": "af1b6b3f-716f-4b38-ab30-773526f04fdb", "comment": "Malware payload (RedLineStealer)", "value": "7e65e8b52b50fe31c317f8446781c8a90b5478b1d532b022fad88f41ffea47a71db2047794a243f9b3ba1d5e8153aa62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370784, "uuid": "e7637f92-37e7-4bb8-bd4a-63b6b9fdc345", "value": "T1C9E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370784, "uuid": "74e6b821-31d8-4a6c-a8a6-ce2a2a71712c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370784, "uuid": "9ce023d0-3f34-4525-be81-5a29a2cee736", "value": 33052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370784, "uuid": "3dd7cb8d-f00c-4d3f-b2d6-f3162c2a3385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370784, "uuid": "c53fe21b-822a-4a80-bba9-7e1633bf53c3", "value": "3c8ab3c6bc516ea8ae05cf9f7737c1fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1449c1b8-2b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690360401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360401, "uuid": "a2e64c43-49a5-4be6-a1e8-b87e9c10300f", "comment": "Malware payload", "value": "e31c2e2577ac837e2f7c919f4c293983", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360401, "uuid": "34915e6b-c9a3-43d7-9a27-7e92819880bd", "comment": "Malware payload", "value": "8ecb29b9c542676833814c3ba03ae34ab9114db502a7a32e36a73b8cec9ee1f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360401, "uuid": "5c17d6f8-f16e-469f-a557-e6e75e40d385", "comment": "Malware payload", "value": "7aa5076831009450b21b607b0e866ddf7673271e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360401, "uuid": "246047d8-6820-4e5b-bb91-dfd524e27a2f", "comment": "Malware payload", "value": "a20c7ffbffe1a8207a0ca14142f26ca0ac3c92c6a307cd14c588710cad4048e811fbcccaa5f30bc8a65edc411be013b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360401, "uuid": "fe2a5104-6cee-4ca8-8983-35d820881bfb", "value": "T169328D728F0B4CB9DF8F69B449CBAC5D1A20B91959480470CB360D8A7C95773F52B6CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360401, "uuid": "d444e3c9-6c26-47dc-9f65-61c1c98fb5fb", "value": "6b2143eb6bf3b6b18e23ff7de66e6891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360401, "uuid": "1635929d-e092-4277-803f-b11a4ca094af", "value": "192:2gGcVONtmUVX1IpxmHxU6GgqstM6vPdznxnXdIws0:2fXyqlaOxUAbvdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360401, "uuid": "41e7c708-5b17-44be-9863-85a7a41d9d47", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360401, "uuid": "de5c70e5-f07e-4d73-b999-32550e2ff7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360401, "uuid": "e18eb9b8-8f2d-4031-9c89-12172eb1f193", "value": "SecuriteInfo.com.Trojan.Loader.1657.18411.669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc27e44-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690365678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365678, "uuid": "633ce87c-b42b-4770-842a-3c04ceba9725", "comment": "Malware payload (Loki)", "value": "e6510295574baa685ef12b3a4518ac1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365678, "uuid": "30aa066e-243c-48bb-9e45-6956eee4d1c3", "comment": "Malware payload (Loki)", "value": "8f5c7a4e758e998bc26a1881b730d8bc300574778660ea10d905433123efccb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365678, "uuid": "aeaea6fe-53ac-41a9-81ad-092af9485481", "comment": "Malware payload (Loki)", "value": "41460bdd17320ef02806929ee5490de1bd91113b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365678, "uuid": "76a6e0fb-b41d-4fbf-aac3-186beb3ae8f5", "comment": "Malware payload (Loki)", "value": "67e0470ab59de9e83548bf38336c43a55bff2654c184d61d9d55eaf5c34368eebcbe0e687f4e5ec6006a6a9e4970160a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365678, "uuid": "0249526b-83bd-4605-b702-56c5980729b0", "value": "T1A3B41255B6BCAF2AC979C3F15A909E440BF1986EA131D3156EC914DFAA33F0213E0763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365678, "uuid": "853f888b-0292-4fe2-a21c-6c922e3c11a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365678, "uuid": "c9b1ca78-00ff-4372-bd92-e06a3b68b19e", "value": "12288:yf2iN2GULb6TVL/KLYDRo262VmGsdaQjBy2D:yf1xULNLCa2lVCdrty2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365678, "uuid": "89b95890-fb88-4bad-9446-928142fd3a01", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365678, "uuid": "975c7464-db8d-4eb0-b86a-848f534617f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365678, "uuid": "e3df7913-1f3e-4df4-a1e5-cde98922e620", "value": "UPS_1Z032Y8860728399991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23055fb4-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690385766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385766, "uuid": "e025a7d8-a35d-4e5d-8d64-a86d025a6c16", "comment": "Malware payload (Stealc)", "value": "f7c0226ae34bbbd9d0120a378db9d689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385766, "uuid": "35b4ebfa-8900-40b7-b730-472fbe8d3efa", "comment": "Malware payload (Stealc)", "value": "90281bc45013c23a0ac60de26a46ab84dd9ccb6930a29a6f5c81004093908734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385766, "uuid": "28e41174-4e6d-4a4d-90f2-496396752099", "comment": "Malware payload (Stealc)", "value": "e0af995ada687d65b25a9681303ddd7e99e1664a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385766, "uuid": "aea04044-ae42-4b78-8ffe-61f40c4f4de2", "comment": "Malware payload (Stealc)", "value": "d7bc13c40500ae5c21163dca7fa8c4496022663bd9fe7fd57e27c5d673b6d1fe5b3d0f68618f56d7d01903df56cc061d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385766, "uuid": "5430037c-06a0-4bc8-a06c-023596171cff", "value": "T17D644B43A2907C51E7264B328E6EC6E8371DF9998F5D77B622186E2F04B01F2C277712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385766, "uuid": "863b5deb-d309-45fb-bf58-c45b9ccd7c58", "value": "5ea3be81e8b97dd70aa776c5063da42c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385766, "uuid": "d960ca3b-bd00-4f90-b93b-dff08a4109ba", "value": "6144:yGM8gxAlMWd12TeagYQmBTKHf07qcX+ej:7MzmlJ+TewQmBTKH87pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385766, "uuid": "6e3f2ff2-8a67-4706-882f-d1058f0c6417", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385766, "uuid": "2b3ab7f6-1aac-4c4c-960c-16df09373c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385766, "uuid": "a77a2416-bc9b-4421-a511-2622c5cf1c26", "value": "f7c0226ae34bbbd9d0120a378db9d689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb4bd8b-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690379961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379961, "uuid": "c8f55fad-0dbe-4f8b-8c74-e0040d6def71", "comment": "Malware payload", "value": "fc392afe9b684860ae4e5c3f17f26a6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379961, "uuid": "7a5ad50b-d736-4c92-8023-76a4e4821f58", "comment": "Malware payload", "value": "904d8e46d41435f21df48b52e4e3ffb7607ad493fa043351a14d786296aaf367", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379961, "uuid": "09b013e6-ca4f-46fc-ac12-39f1106194a5", "comment": "Malware payload", "value": "eb98b21968bf5e59a2dfbb24191e12861c8c1010", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379961, "uuid": "dbb9a536-5700-4e86-8d56-4a018ada318b", "comment": "Malware payload", "value": "ba76575adc2e90e4ce42188cdd013289635dad43d80264ff38dea7bb12af42da5772092f7f1e3c11f104038076a2c7eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379961, "uuid": "76e0abf5-1f92-4d63-ad29-e2b644616d12", "value": "T19C652261B6C18470D5A619322AE2DB747F7C7C311B798EEB53845E1E9F218C0AE307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379961, "uuid": "cdced65b-b914-44e9-a144-f098b79894cf", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379961, "uuid": "81d14108-0f5a-43da-bb48-44661b1241bd", "value": "24576:8cbD/e1EBbYgea/wp1YbSWvMCVQ91TKbX5t0ddyc/vFMDBCaHupgAuCXG+XD:8cbi6Ee/wAWcMCVmW58yc/ODwasSOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379961, "uuid": "fa948fe3-cb5e-4f68-89d6-087d1e43d324", "value": 1510952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379961, "uuid": "fe59bd57-17e8-4b3b-927b-e2e5094afa1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379961, "uuid": "e622ddb3-2041-452f-83d5-2943b110e3cf", "value": "fc392afe9b684860ae4e5c3f17f26a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa503fe-2c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690411960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411960, "uuid": "9f6045e5-5f11-4bea-9db2-3116da852d87", "comment": "Malware payload (RedLineStealer)", "value": "1bc1507bf17a004b80d5a7e3d84100ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411960, "uuid": "47d13166-63af-43e7-a56c-7c4bc0c7462f", "comment": "Malware payload (RedLineStealer)", "value": "909d0276b97beae2a69b8ad497e67a23e15813fb0c572e0268a007e67d44d812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411960, "uuid": "52b1dd3f-0ac1-403f-8286-5946c14d5f45", "comment": "Malware payload (RedLineStealer)", "value": "30a90cc45f63f5cd761cdb6f6477627b292238ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411960, "uuid": "9745bab7-36d8-4eb0-a49d-8403b36e71b1", "comment": "Malware payload (RedLineStealer)", "value": "6a2f74b05ef7a71aed72a0b2c534e459cae06cc8b0c6902ee22f56c8f4ff8474b4cf0973bc1c6316484d1eb204431c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411960, "uuid": "b1776c29-623c-491d-9fdb-9246d8838fe0", "value": "T13FF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411960, "uuid": "4fa5383a-76ff-47c5-9049-01ef48089277", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690411960, "uuid": "3279c94b-7311-45f2-8def-b6e4569ac599", "value": 34958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690411960, "uuid": "7d640f53-2a1b-4462-bbb1-7edb4bf728bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411960, "uuid": "e7048b23-b2bb-4e7d-bfbd-af110dbec36e", "value": "1bc1507bf17a004b80d5a7e3d84100ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a8d431-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690365588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365588, "uuid": "84cea8b6-fd2b-4dab-853a-0a5c84ee076f", "comment": "Malware payload (AsyncRAT)", "value": "c9bf3e3394e17329f66a602c9e6035d2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365588, "uuid": "b75c477b-e8e4-41c5-b3b1-613fc03ee674", "comment": "Malware payload (AsyncRAT)", "value": "909f4d32633d14714d8cf06fd47a9744e9b9d29889ba8a1c22dfc20227061e35", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365588, "uuid": "a1fbf4b4-d30d-44b1-9417-f11438f69658", "comment": "Malware payload (AsyncRAT)", "value": "6b61be8ceb99b3b0c97da1a77b0b7e3030e50ae5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365588, "uuid": "05d1ad5e-0dd9-46ab-be48-4135bf60554a", "comment": "Malware payload (AsyncRAT)", "value": "11a17f1e89b4b01c325f4c5edd487040df4d82bbabb4406d4a7ff8aa689f69ad3b42472ad30da3d527421416610fde9b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365588, "uuid": "d98d931c-1347-4870-a0a6-2e975a913783", "value": "T1EF450202BE8187B2D5B3C6315969E984F17EBC383F365A0D739CF11C9736081967EA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365588, "uuid": "7494b82f-7482-47a1-ab1d-58d2b45bd3a2", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365588, "uuid": "0dd2c1c3-b722-4af4-8035-593bde459195", "value": "24576:wNA3R5drX1DudI00vbLaQCUHtfYoFZojsZgUyE0tL:p5p46bLa5UHtLfojsqUxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365588, "uuid": "fb55539e-507c-47c5-b77e-1492683f6286", "value": 1172882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365588, "uuid": "94712ab3-525b-4071-89eb-8422716b660a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365588, "uuid": "08db0713-2d78-4eb7-a39c-b064a7b151a9", "value": "Fatura_\u00f6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c6ec2c-2b90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361160, "uuid": "994b9914-ecab-4121-8512-9208217a5757", "comment": "Malware payload (Amadey)", "value": "0f8d55c77b38f16a1cf21294160f808e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361160, "uuid": "d8892c87-96ce-4d82-b00b-6676852e85d4", "comment": "Malware payload (Amadey)", "value": "913569304b4546031031b73ff702329434ff354c129954aed1a637e72edc3492", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361160, "uuid": "9bd8b0cd-0b4f-406c-bd45-08b21c1748fb", "comment": "Malware payload (Amadey)", "value": "c744fc7d4f2e0cf2d8ee151ba0e2ef0bf741aa4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361160, "uuid": "f886e158-9cbe-4673-be50-f9081793365d", "comment": "Malware payload (Amadey)", "value": "a935f9b912bfe10938d76bdffbc2b0d2343288a974c4b4403d955a6eee07fc54e50212c100108e62cab4e909b645a8db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361160, "uuid": "eac9998c-8590-4841-96da-38b6fe84661b", "value": "T116840102ABE48577ECB927B058F713D30B3ABD618D74826B2386191F1DB26D4A57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361160, "uuid": "07e5fa53-55a4-4691-b1c8-60c9abbea9a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361160, "uuid": "9fe4dcd4-3bf8-464c-9351-e5e4e214abaa", "value": "6144:Ksy+bnr+Qp0yN90QEF+jYAUk/AeXFnAFkf2k8Hm+eeWmqX6b7Ig5a8imVBz:cMrYy90CYAU8Fndf2k8H9bE8iqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361160, "uuid": "8fd4dfb9-fae2-4850-a98a-abb4661e10f1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361160, "uuid": "2dfce11b-bfe8-4f31-b2d9-e361a5389bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361160, "uuid": "42595f5e-612c-42be-bdc4-37de746374c4", "value": "0f8d55c77b38f16a1cf21294160f808e.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad6974e-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408086, "uuid": "dc8a1b6e-6d8a-41df-a832-767d0fbf88d5", "comment": "Malware payload (Amadey)", "value": "e12c1e24b7ef26ab55cee05b44f02f68", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408086, "uuid": "a85b701c-9004-465f-ac8f-6becf106dcea", "comment": "Malware payload (Amadey)", "value": "914ff654df63bcb1659e40c34bfad26a3b1f83979a4b93b55b2acf1305deeadf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408086, "uuid": "9a2f7383-cb80-4f02-b706-b48efc65d702", "comment": "Malware payload (Amadey)", "value": "b3bb25b5a8be7591eb39ed80e4abed5675413817", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408086, "uuid": "057632c5-d382-44ed-af5b-96c6604afffe", "comment": "Malware payload (Amadey)", "value": "f2720cfd12ba228dba8f759d77f3bcc7e8f4d5cab37167b33381a138b70fabb1f4118ea347aa643e963186b7f3534f8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408086, "uuid": "502209ed-84ec-444b-8a6c-3e3e5361220f", "value": "T188840203D7D89032D9B527B068F616C30A377DA2AD78D35A2785E86E08737D4E83572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408086, "uuid": "9fcf6f54-19dc-440a-a4c3-70b5f48c3b74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408086, "uuid": "f005ca20-eb6d-4dbf-a691-565f1932104e", "value": "12288:DMrXy90hzbYQVr+sjLXWp5zgBYCQ7VNjlIBXL:syAgQVrVjLWPMzaVPId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408086, "uuid": "f4d86f89-603c-465e-834b-0d03419a3f77", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408086, "uuid": "b5ccb9ce-50de-418c-9118-2fd522bad7de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408086, "uuid": "0f82232f-29fe-4256-ae17-b9c76fd32513", "value": "914ff654df63bcb1659e40c34bfad26a3b1f83979a4b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42b0b73-2bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690392130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392130, "uuid": "f098a47d-8484-4967-9407-dbf36385afec", "comment": "Malware payload (RedLineStealer)", "value": "0deb769fd0074adcbd5a49ec72fabfb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392130, "uuid": "dcb6dcf3-8615-414c-894d-89949955d343", "comment": "Malware payload (RedLineStealer)", "value": "9176ff0f1ca08377671891eab2e7fd1bad29e129985b386e1486b543767b2721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392130, "uuid": "a55c7a70-a051-4b3e-90dc-f7bb1c3abbe2", "comment": "Malware payload (RedLineStealer)", "value": "a4653cdcb6a68d1f247079b6357d03d5c7950bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392130, "uuid": "d09a6a6a-608e-43be-b28d-a11df3229d5e", "comment": "Malware payload (RedLineStealer)", "value": "bb55898824c8b218cbb628b1fffb6636acbcf36e833d2485f2b09712069c8a020f0bdbf01d64f57842994f6bfffa022e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392130, "uuid": "6bcb2f31-ac7a-4479-935b-d381a987c949", "value": "T18074F143BBE84032D9B6277048F707C70B36BCA25C7842AB2756695E0CB26D4A97177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392130, "uuid": "0fd53e5b-6d70-47be-9de9-a39b192cc58b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392130, "uuid": "a421af11-8f75-4731-9d2a-d5ce78d7d807", "value": "6144:Kny+bnr+sp0yN90QETqTMCUajkkQ4sdeBCwcVPCJHNmPm3b23q:9Mr8y905qo8AgsqcV6Jmmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690392130, "uuid": "9bc34976-7c84-4ac2-95c7-b30857ae5f94", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690392130, "uuid": "6c365eca-4f80-49e4-9e76-06b720bea4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392130, "uuid": "f0beb7be-e354-4564-a40a-b860d582ab3b", "value": "0deb769fd0074adcbd5a49ec72fabfb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0938e4d6-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356947, "uuid": "5978f11f-1ff5-4a22-994a-e47bdc0c9c62", "comment": "Malware payload (RedLineStealer)", "value": "e0b481b07a217609601d7be7b1a21236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356947, "uuid": "dba7c21a-a3b3-453e-b03a-4e2ce24825ff", "comment": "Malware payload (RedLineStealer)", "value": "91830c6e5154c70c0f0ba8085071cdcbd37aab970b03293324ef97567a993c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356947, "uuid": "9bfb3718-55b6-407a-a2b9-e689b50dbf45", "comment": "Malware payload (RedLineStealer)", "value": "440c6265e9ca8003fc775183564f7026febaa981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356947, "uuid": "3ad6d7d4-7f8b-4f32-924d-a1b9724de06c", "comment": "Malware payload (RedLineStealer)", "value": "cc1cb58ce48c90001c25fce24eecc0a98be38227ad7a8d3fda3fd5022c205fe0b3ceb264158796beb563a61f5474a3f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356947, "uuid": "225fa17b-b816-408e-a390-dde01dd475a8", "value": "T1D3B4126BFBE88073D9B2677084F607C31F367DB49D68526B2758990E09736C0A53236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356947, "uuid": "c3f37ec1-1b4f-4111-ac65-585e9e0983d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356947, "uuid": "03070f78-a803-4dab-9814-72a64b71160c", "value": "12288:rMr6y90gRLVlRkH/X0mMm/KVQOR0SsAkZN7BQxU284zXGri:FybLlKfkRm/KmORaDYGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356947, "uuid": "366f2c82-065f-4134-820c-0a5d56e2b395", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356947, "uuid": "960812b1-4f86-40bd-99ee-e85629466c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356947, "uuid": "2f6d8c29-c61d-4928-b619-9cec846da64d", "value": "e0b481b07a217609601d7be7b1a21236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa90723e-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690362076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362076, "uuid": "df655b13-402a-4dcd-b0bc-9ba7cd68c89a", "comment": "Malware payload (Amadey)", "value": "0a5565a4984dc97734057cff88b87626", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362076, "uuid": "06c06b20-136a-4276-a3aa-cd43a411ceb9", "comment": "Malware payload (Amadey)", "value": "921ce90fc73119dd720d455b93d29d89ff57ed479a092730d5ab5accea0868e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362076, "uuid": "31eaa62a-6429-43f9-875e-5ad250f13ee3", "comment": "Malware payload (Amadey)", "value": "9b384b685c5c30d8d74815bb592fb1e59159b1d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362076, "uuid": "7e938b81-d1ab-45c8-819f-37cf43d2fe2a", "comment": "Malware payload (Amadey)", "value": "8c6a58a4035a46f88cbf692410e42db0b6c56faed7168554613e62a7ac7b3fefe0c7b49f0242bc18b147e54cb8c8e363", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362076, "uuid": "b78fef13-6bdf-41de-8fb3-99744ca28017", "value": "T1CC840207A7DD8072D8B517B058F612930A367CA1A97D536F3786E81B0CB32D5A87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362076, "uuid": "7e98baba-b0dd-476e-b568-f3628725c262", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362076, "uuid": "787095d2-f91a-4deb-ac36-661b77afe939", "value": "6144:Kry+bnr+kp0yN90QEbQ/X2tHY6r0ZVTG0UPPYRYAn3pSbugBZ+t4cDIPamxwr3I9:RMr4y90QmcVTG0kYHSugBYCcAdw2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362076, "uuid": "0a4569fd-13b0-491c-a2d5-5ea5b2d78d2c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362076, "uuid": "4642b62d-d0f9-42ce-8907-dd48b711c083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362076, "uuid": "b0517627-bc89-4700-aa4a-98834d5fd14a", "value": "921ce90fc73119dd720d455b93d29d89ff57ed479a092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fe522d-2bb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690377498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377498, "uuid": "8474ced8-403a-465c-80bc-219bf25ab86a", "comment": "Malware payload (Formbook)", "value": "a5950b5128669c9349a93cbcd7d0c737", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377498, "uuid": "20988edb-26cb-4182-b1e7-1fbc6d38678f", "comment": "Malware payload (Formbook)", "value": "926abc64d12475346a3ab12abc5bbe66ff4b679dc270ab7f9160e3dc3f03f2e5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377498, "uuid": "640050f0-77f2-41b8-b571-5836fce07274", "comment": "Malware payload (Formbook)", "value": "a57afb24cc49a483f3aab2718cf9aacedc629f89", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377498, "uuid": "f8426cac-7d48-4ec7-a088-bb03d18a4809", "comment": "Malware payload (Formbook)", "value": "f7a3593097b844539c46a4aeafa4fc526a1c540ccc84968a66fcf073dd89d387e2f18c11f1ec86f5fcf26f8ecb5b317d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377498, "uuid": "f5e226b9-0995-4142-a5ff-a8675d64e4ae", "value": "T1F945BFF875047DE6266F536BDA96ADED03B626239ACBA4CC806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377498, "uuid": "90cd9e6b-e899-4633-91db-4a64484ff58a", "value": "24576:PCCQMQ2Z00lphvGKXk/JNE8bkrRMGpnnyKDtJtbG4hclvZ4WtnHqnmogox60DFBJ:Pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377498, "uuid": "16d49e87-e03a-4da9-be67-de036620b23a", "value": 1273468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377498, "uuid": "44fbf19e-be5a-4085-92d5-8090093e2176", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377498, "uuid": "d3eee5ce-e94b-4022-98be-64f1529bbf93", "value": "TT Swift Copy_0000573548.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc59fd5-2b8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690359531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359531, "uuid": "cc07a0ac-f6d2-491b-b717-419c903ccf17", "comment": "Malware payload (RedLineStealer)", "value": "87c3369da3065040de22ba81fe5d78d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359531, "uuid": "dd6e5ad6-5012-4ed8-b902-35cb0c6c008a", "comment": "Malware payload (RedLineStealer)", "value": "92cdd03295523d1f0b5fdf13489745137a8000a34657dd1316b716a8b52b5b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359531, "uuid": "25622fd4-5f50-44f1-8d9b-e1aeef4802af", "comment": "Malware payload (RedLineStealer)", "value": "c634015078ba1e7764b6f08805b853723cc4aaea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359531, "uuid": "89c0fdfe-617a-47ff-b662-c5be6f2e2bc6", "comment": "Malware payload (RedLineStealer)", "value": "faae7d7598ac13ec7368bedbc1edba13aadd608c86a8d5ce706a49e45a178aaf22babc75fe5e2e5f86f974be8da42664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359531, "uuid": "edb78af9-1c8e-4237-9dbe-ea523cf04fae", "value": "T12294F84383A1BD44E9258F729E2FE6E8761DF6508E4D7B66A238EE1B00B51F2D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359531, "uuid": "052764ea-343f-4f91-9e67-54daa0d2445a", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359531, "uuid": "e2ac04b2-9d82-4b2e-94d2-89edbc846ba2", "value": "6144:ietI0WL7S0qbq74CFE4Qy9IGFpmUBLCVStwfjv+HTs:HI0WXSnbxCxD92UB+Vhjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690359531, "uuid": "cb908eaa-6417-4bd3-b508-c51a0bfecc88", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690359531, "uuid": "29d9e9be-f445-47ce-874e-275a8451db6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359531, "uuid": "79288f44-64fe-44fb-b916-e72dc6b118ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4834926c-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690385828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385828, "uuid": "0e6a1260-aa29-42c8-997a-e463135bd1d0", "comment": "Malware payload (RedLineStealer)", "value": "02956eaaa0d4c54329dc45ea8095e37b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385828, "uuid": "01356d96-a33f-4dfc-b185-cbbed565111a", "comment": "Malware payload (RedLineStealer)", "value": "93ea2a1cd2a46482c740dbdd7fb24662528d2fdb16dc333407aef93627ac6e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385828, "uuid": "4631e3bf-7fe0-49f5-abc3-fe3aa40551bd", "comment": "Malware payload (RedLineStealer)", "value": "cace3c5a0ff6ec3ef231bb31b04386697f68ec26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385828, "uuid": "0fabb56d-c4ba-4917-94da-decbb75213ea", "comment": "Malware payload (RedLineStealer)", "value": "7962c1936b3f59f536304e3459dcd4c7228f6945347ab7f383aadcef09599ef7eaa14707a81f52aa222a897f5406f450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385828, "uuid": "88dcdcd0-1e90-4e8a-bb5c-6e0dea88f535", "value": "T189F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385828, "uuid": "00624eb6-a319-44f3-abf8-216c792bf75a", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385828, "uuid": "1fbd281e-30fa-4545-a16f-bf972cc17e94", "value": 35319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385828, "uuid": "acd9550d-5f1c-442d-a734-6912dcca319c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385828, "uuid": "a21ef20c-afc5-4482-a576-1c1ac6842bea", "value": "02956eaaa0d4c54329dc45ea8095e37b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccd1c84-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690362080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362080, "uuid": "eb89c9ab-3e37-4f91-a050-bf7db807fd08", "comment": "Malware payload (Mirai)", "value": "4cd029c1312bb529737d89f8a859fde9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362080, "uuid": "fe760582-2c1d-4537-96b9-cdc78ac371bf", "comment": "Malware payload (Mirai)", "value": "942fa67bfbcfcccb27ebe1665810bbcb5c95d774f001705ba82d8ea4dd13c5e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362080, "uuid": "15cad444-e70c-4cbd-85a0-b3aebfffea69", "comment": "Malware payload (Mirai)", "value": "58be951a3ef9fc5d1597361cb9c517b40c880ae5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362080, "uuid": "becc3e87-244d-4226-aa45-e12320acff40", "comment": "Malware payload (Mirai)", "value": "2643443a81cffc4c756d8661c81121b016a086122759ee8842c2268f36a474794ca9b77f21a8d323908798f4098d49e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362080, "uuid": "7ff51252-a2d7-4ddc-9389-6e0b695f63d2", "value": "T15C634B51B8819712C6C112BBFB2E428D7B2653A8D3EF3207DE256F21378792B0D7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362080, "uuid": "f64b88ab-5dcf-40ab-9e6f-aebb2a3e2544", "value": "1536:vghLz6sZ2CP7hd9vmjkbwZn7mvbtwipqfBeVMbbJp7/qI:YhLzwMd1CimnQbtwipVc/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362080, "uuid": "ed7241cd-3aef-441c-a680-5746f6710489", "value": 68944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362080, "uuid": "bfb40e5a-f18c-4e05-a3d7-254b2c318310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362080, "uuid": "c919ee78-b47c-4fa2-879c-7317c37280af", "value": "arm.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6d33ce-2b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690348122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348122, "uuid": "3759c3fb-1443-43fd-a12b-4842ebbdd850", "comment": "Malware payload (AgentTesla)", "value": "487631cb17113e7328f19300e83c46fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348122, "uuid": "cf5e3138-a785-49fe-a4a7-1087017c0c84", "comment": "Malware payload (AgentTesla)", "value": "94539dea616f7cfb286d2e1f277b205c568a6d8295db3540407718d756d60bd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348122, "uuid": "d1f28285-f700-4120-ba35-d3f6fc830635", "comment": "Malware payload (AgentTesla)", "value": "9bc1a6f19ef5ca6ac195ff8cf8ff6f3df755fffc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348122, "uuid": "c36282ae-f88f-42ee-bb69-765c04da6bb2", "comment": "Malware payload (AgentTesla)", "value": "b5ccee5b9a3143cf38dfda30512f8a800958413b17a280abb669abcb8e61ca967c435780860ade2d6004a6ed581ae779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348122, "uuid": "728ee50a-f18a-45d3-a810-8a5ae8158771", "value": "T17FD42388CE44CB322477FB3D3782075AB980BBB615AC2D5F51C71A8B1A8DA3DDD43449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348122, "uuid": "cce910db-285a-4131-bf1a-bb903dbb66a6", "value": "12288:GJZ1zNwMqWuap27Sr+6768ZN8pa8cuu7WQePXehs+lY6Rnr1cFPz:6duhm7nZT7Eus+lY611YPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690348122, "uuid": "5fca3d49-8ac7-4d85-ae53-fdce518b9efa", "value": 610393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690348122, "uuid": "1fa6ac40-5a25-4e28-9bd8-dd3652869c08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348122, "uuid": "04c038a0-0623-4320-b3b3-efef05a0171f", "value": "proforma invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad64bc03-2bd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690392441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392441, "uuid": "d615a714-c7ce-4cb1-b817-862c080780ce", "comment": "Malware payload (njrat)", "value": "13c2b47d6b184b929364c164315036ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392441, "uuid": "7ee40a74-c1c8-484b-b452-6cce76bbf4b8", "comment": "Malware payload (njrat)", "value": "95b3c5301a0f05be08ad9a30c4523eb46a2a3f2b7ada644fa5a0134925fdce92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392441, "uuid": "56c5340e-b6e1-4b7d-b985-1d56a0bb1987", "comment": "Malware payload (njrat)", "value": "2eabed7900ff0fc5c63e563da6ca8228f3479c0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690392441, "uuid": "6891a042-5f2a-4fb1-9d8d-fc85fb8aa6a1", "comment": "Malware payload (njrat)", "value": "8ff14990f5d258f5933222a51f40e52c452469ddc6c774d8940a10c46e7bc491ee149ef0df50c4c441da055255e95fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392441, "uuid": "b49e9bcc-fd74-4e27-910b-c7958ebf3a70", "value": "T16DF3C76BB584CB15DA583871C1DFA43003E6AD871B33E24A3F5827AD2D423E76D49BC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392441, "uuid": "4609cda4-ecda-4975-ae3c-d64d2ed58454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392441, "uuid": "0fcc9556-2322-461c-ad64-133f2683258b", "value": "3072:E+hucSXYM5Us4xzoejxyraVxuhf1cHAyUTjiTIu:U2hxz+CxEcHYjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690392441, "uuid": "0da7dd96-9604-4155-9e8c-515475aca294", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690392441, "uuid": "8f3a7305-ad58-4a3b-b619-6acefec5be21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690392441, "uuid": "14cfefc0-df00-436e-98cd-ba0365add531", "value": "13c2b47d6b184b929364c164315036ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a66e050-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356949, "uuid": "185f962f-1b13-4fa6-860a-b0d6c7644c3a", "comment": "Malware payload (RedLineStealer)", "value": "e7575b0c780f1d66ba0918dcb739d0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356949, "uuid": "fc0fe628-d6a7-436b-9627-3e95ffd727a8", "comment": "Malware payload (RedLineStealer)", "value": "95bf629fd99253e5ea2a9849332d265e2f3c59c5f49d0ed8d7d0550399bba347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356949, "uuid": "e896431e-c7e2-4818-95cc-987368d20dbd", "comment": "Malware payload (RedLineStealer)", "value": "4f7d85a936038c4b25bb8432d3b252ae9a8d42d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356949, "uuid": "306553d8-ec81-40fe-872b-c405e54e5a55", "comment": "Malware payload (RedLineStealer)", "value": "7cddae4cd807d27090e74a8c210c9e815869b8d6941c2457bc5f31bfb756d5170dddb86311ce2b42b05eb54b52b969fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356949, "uuid": "b4f392f7-0309-4462-a307-cd211076377f", "value": "T123840112F7E88073D8B127B04CF603C32F3A7DA25C6482AA3351695E1DB2594A97677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356949, "uuid": "5f1425e2-d5ce-41df-84cc-0f30c7f4877d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356949, "uuid": "19e6e7d4-611a-4dbd-aba4-7acc070dc90e", "value": "6144:KAy+bnr+wp0yN90QEimXSNgQ9zEnG4BjkoqEq9EOUTKQP9cp7KmXOOhhSh1dL2n:wMrYy90pPjRq9EXTX9cp7KODo76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356949, "uuid": "82964197-30be-4fb9-8f28-46fb5b39042f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356949, "uuid": "f3ee1c48-857f-4293-adb7-45da177ab9be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356949, "uuid": "c2dc3552-2ce9-4460-b91b-2817ef59c807", "value": "e7575b0c780f1d66ba0918dcb739d0cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8b6063-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385594, "uuid": "525e84ef-05f2-4d3b-984f-1bf2fb4c9723", "comment": "Malware payload (Formbook)", "value": "19ac3131381671dc934bbd1597fd723f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385594, "uuid": "3c9628d8-90ee-4adc-9ad8-e07a51ca1cca", "comment": "Malware payload (Formbook)", "value": "95c739685ac483d14260c45fef84686d505802b2a546531652de4b35b54ea8eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385594, "uuid": "277ef63d-abd8-4477-8517-24beef8b5449", "comment": "Malware payload (Formbook)", "value": "8e4e9fdc983d4e3f46583be128dfca33f1fa8fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385594, "uuid": "d8a95074-4a1f-4bc4-a719-65425fcf1e19", "comment": "Malware payload (Formbook)", "value": "e3341de7749904ef57a92b221a43a7ea5e255e7388d8b2915a383035ba8ef9483c8c5c75bc406bf3f19a7dc2be9217d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385594, "uuid": "83a5bca4-d91a-4dec-a27b-47b1fa1030df", "value": "T1C0D41221A1AC6F21DAB413F55A9098110BF5F90FA635E70A5DD532EB8B23B2017D2F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385594, "uuid": "581fac67-43f1-4044-98d8-50a096681544", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385594, "uuid": "8a7ac77c-0fc1-4ae8-ac7c-243be99ead4c", "value": "12288:3f2iN2GULOE+JoazlTxeMpjhOkXtExXwWHbA02/x6NLvmnXmg5k8W:3f1xULqJVBIkjhN9EqAbVWx4i2g5k8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385594, "uuid": "f0b6b388-4b82-4d52-b968-8bfa0183d428", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385594, "uuid": "a2dbc75d-6d4b-4c90-9087-91645b9fd92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385594, "uuid": "c0e83412-1551-4d66-9276-fc7be2d3d0f1", "value": "19ac3131381671dc934bbd1597fd723f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c1b5e5-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356649, "uuid": "32bc7f93-5134-4abc-b002-a0658721c661", "comment": "Malware payload (Amadey)", "value": "d684a9ea7cded7ffbc54552e793a642d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356649, "uuid": "d2982892-172c-4246-ba30-177e597cf51b", "comment": "Malware payload (Amadey)", "value": "95e905c87062c2e8800ac08759a17cb836303e51fabb02f5800219784fdc2b5e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356649, "uuid": "d7fb5d50-bf52-441e-92bc-8f7e97573964", "comment": "Malware payload (Amadey)", "value": "fe1876d0966bac4990c8b7c59d2ea065e3fa3589", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356649, "uuid": "ab9c76cb-234b-401e-aa0d-da12d5891338", "comment": "Malware payload (Amadey)", "value": "e47605044d1dcb5a2d4d370dedd84adf930198018649e77bbe68c0439d95198d31f653a14722bda5e661dcc99b7edb40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356649, "uuid": "6cd3059b-ed03-4a4d-a616-7bab6fc9b16d", "value": "T13F840252B7E99033DDB517B059FA03D30B3B7DA2A874939B23849D5D1C726C0A97232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356649, "uuid": "155888c6-9882-421f-90f7-d9ab28ecb9a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356649, "uuid": "346b1287-8c5e-4bbb-9367-41f993de497b", "value": "6144:KSy+bnr+sp0yN90QEkEATB2G+HFV/d7AZevzut99OqiXj00n10ybsE:+MrMy90nLLyZGu/9Oq60yb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356649, "uuid": "993d6b7e-9c08-457d-89ed-29f576acbcfc", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356649, "uuid": "7ab2518a-2e35-480c-9c55-ddfe14f335aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356649, "uuid": "3536e760-3cb5-4c90-894d-899809269f2d", "value": "d684a9ea7cded7ffbc54552e793a642d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79abe02-2baf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690374392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374392, "uuid": "3c9a844e-06d0-4190-b3dd-bd36d9e340e7", "comment": "Malware payload (RedLineStealer)", "value": "d4ed75f662e87d5bd4f702305923a9b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374392, "uuid": "8d44e3b7-965c-4ca0-9788-dae31474627e", "comment": "Malware payload (RedLineStealer)", "value": "96971fa22b713edf3f206e9a1160b6a3809b1b2ae82bc73235bd00b4d8f3573f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374392, "uuid": "73f06761-7e8e-4eda-96ea-cda685291861", "comment": "Malware payload (RedLineStealer)", "value": "6ed6c9ec40fb59f864e18856328e02d6fc26bc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374392, "uuid": "2ecc9c4e-10af-46ff-9058-73f32e381601", "comment": "Malware payload (RedLineStealer)", "value": "21d47f0066a4ad991416310667a7ccac59ea42c09c0b1db59798f4ce4f30eed27522f95b21a5ea8983e975866eaa3723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374392, "uuid": "032a3ab2-39c6-4762-a546-e2564106f5bf", "value": "T1E2840217BBD99073E8B14BB018F702D30B3A3DA25C74836B2745985A5CB36D4A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374392, "uuid": "2a2602d6-c209-41de-8fd9-ea1c409cae01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374392, "uuid": "2852113d-a54c-4b36-8a58-c21527b1a74d", "value": "6144:KTy+bnr+Bp0yN90QEjPu2/Qfq4kW8UKfDeUaoqYkrTD9gBZ+t4cDL70wUWVv3J+X:hMr1y90tPDIvef6UGgBYCcxv3J4IFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374392, "uuid": "d4817add-94ba-4f83-9898-0715fd6e5db2", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374392, "uuid": "1f230144-95a8-40fa-acd2-23fbb7a0651c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374392, "uuid": "b3439193-b28e-49a4-b8b3-6d8f381bae39", "value": "d4ed75f662e87d5bd4f702305923a9b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94aa1c4-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690380113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380113, "uuid": "a0226fe7-8356-4ed6-901c-905bbd95d995", "comment": "Malware payload (Amadey)", "value": "f1149890bf31e87c0531781f40844a8a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380113, "uuid": "e898f23f-431d-46c7-8301-38dd1b411495", "comment": "Malware payload (Amadey)", "value": "9697b9112b43f57dc1abf31facfebd2b083bacd5264cf0dcb85999b168c64210", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380113, "uuid": "23ff8220-6777-40b5-811c-5552cb5939a9", "comment": "Malware payload (Amadey)", "value": "a241d296000ab355d584660af690a4be92945e7d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380113, "uuid": "4f78b75e-5bfd-4a22-a18d-42223d1cac06", "comment": "Malware payload (Amadey)", "value": "76f58fd2ce6550cdf91def82fcdc3a8c8f24287f0dccbe1108406bbfb929de69d4436c475c43d0b05891ca96f024e742", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380113, "uuid": "132f0ea4-5238-496f-8ab1-020da756d93a", "value": "T1B0840203A7E98033D9B1177059FA06C31E367D926D78965B3389A96B0CB36D0E93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380113, "uuid": "8b54dbf9-a0fa-46a4-94a8-5eafc224b636", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380113, "uuid": "8214b623-2fc2-4b02-bc93-fab68dfc4926", "value": "12288:3MrRy90Dw7lYI/Tec20XgBYC+DuUSNsL88xq:+yN7lYwT8zq4Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380113, "uuid": "c8476900-491a-4925-94ce-e05624bc9ef1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380113, "uuid": "57a31f7b-8730-4dfa-972e-5ec84f6a9fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380113, "uuid": "fd694801-b6cd-440e-b2ea-4a7b7ead7353", "value": "f1149890bf31e87c0531781f40844a8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e7d4c8-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356966, "uuid": "8b94668a-b0e6-46b1-b8ab-68262dfd167b", "comment": "Malware payload (RedLineStealer)", "value": "cab688e4b7a89aa0bc99d3a666693f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356966, "uuid": "87938e8f-127c-460b-9868-cce58ef8ad51", "comment": "Malware payload (RedLineStealer)", "value": "96e923d34fa5f99a49a526d3eb1ecb566e73e32f4729d5e26627a2b682115ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356966, "uuid": "4e4fc430-eed3-4632-bcc4-96a81d28195e", "comment": "Malware payload (RedLineStealer)", "value": "3e8b26d7f4b8546282cf34bdfb2aece55086a9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356966, "uuid": "6063c360-fb5b-4faf-80cd-89c6e136b6a8", "comment": "Malware payload (RedLineStealer)", "value": "218044289c16aa8b3c1eb409f0b7087fffb6abf4b4f4a8fec416a4a06475e5e5ac1c2be64a59d38c5e060bdbdf1752d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356966, "uuid": "14e5414e-f4e0-4bb0-80c4-c50dd9d1bb76", "value": "T12BB41247EAE88433C9B827B059F613931A32BDE55DB8872B3B45AC5F0C725D0953272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356966, "uuid": "02ab4e3d-88d6-4f00-b8d5-eaa561b6702d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356966, "uuid": "b108bf62-77ee-4e86-a661-556be4a3b3cf", "value": "6144:K1y+bnr+Vp0yN90QEBYUbFC+H14gqscvCxSLWSkiNV9rx5seCqL9D/wBIhUpihWc:zMrNy90/Cw1YLWSFj1BCq5wBIhaiI4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356966, "uuid": "5c84c609-026e-483d-9849-10b2ab9c4c1d", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356966, "uuid": "8935f179-b417-4495-8964-37b4597657dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356966, "uuid": "9408133a-44f7-4eb9-b9d6-d91d2ee752e3", "value": "cab688e4b7a89aa0bc99d3a666693f8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1af0ba1-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385656, "uuid": "696d8d78-3db0-44c8-aa5e-706879558b17", "comment": "Malware payload (Formbook)", "value": "e5976f394f497690e18a9828bdccb2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385656, "uuid": "17c779f0-44af-4439-b628-2872841d9221", "comment": "Malware payload (Formbook)", "value": "9704a19146f3fb0b491a65fa62d39c72d4c0ebacd5d7128dcfcda43400bb05b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385656, "uuid": "ad6301f0-92a4-42ee-b408-50c7f9b4ea81", "comment": "Malware payload (Formbook)", "value": "24caf971bdc9c057c98682b620ae88fca46ea3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385656, "uuid": "dd6bf223-e37c-4c3b-b2ba-eb447745f2af", "comment": "Malware payload (Formbook)", "value": "57581d6fb1329763b648621a7c7ed6219070d084a96013a24f99e358b1ad56448349a0a60f61b6fb1e3fc34aaebe6a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385656, "uuid": "d679a6db-efa3-4158-8bd8-205ac35f89e3", "value": "T193D4121476EC6F2ACCB593F55AD5984203F3A85E1071F3262CDE21DB9B37B1022A0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385656, "uuid": "d07c06be-0caf-4368-b555-f0c700deb396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385656, "uuid": "0c736a41-6336-4774-b56d-0b55f2a5969e", "value": "12288:kf2iN2GUL4aXDRKr6HAZV3RcdzDrO247o96rJcbNt2/8:kf1xULdK6HOV3RcdfrOr896rJc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385656, "uuid": "ef2259d3-eb41-4981-9412-2f4a1a0858eb", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385656, "uuid": "08beb45b-630e-41ee-b60b-6bfbf888722a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385656, "uuid": "83da5387-8a13-4c03-8152-0c0aab95a59e", "value": "e5976f394f497690e18a9828bdccb2b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104ac5c3-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1690361253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361253, "uuid": "82cdac9e-6977-45f2-bc02-fe5fc7cef655", "comment": "Malware payload (MarsStealer)", "value": "ccc18f73fabbe5c91e42ad299672a5b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361253, "uuid": "5cea5886-2030-4072-ba79-acdd77a3c3c8", "comment": "Malware payload (MarsStealer)", "value": "970a7ff3bab4b5fffe226cf5e66d997c9a8692623c2fa17fb5e2d35b16686564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361253, "uuid": "b6682f5c-79db-46e4-aa5a-2d223bf0d063", "comment": "Malware payload (MarsStealer)", "value": "966a5767d5a9772d9f41834b3b98b12ad7d5de77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361253, "uuid": "9a8ce620-6117-4ad5-8917-c57edec3056b", "comment": "Malware payload (MarsStealer)", "value": "6ea1ddd83338cf23e05000207da526d08d16add3625e1040a52c972c601b708a54aedcf72f5d38f2b3efd11f26705919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361253, "uuid": "8a0468ce-0d28-4385-84cd-dfda97403f87", "value": "T1BA74B64383A1BD44E9258B729E2FCAF8B60DF6518F4D7B66A138AF1F04B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361253, "uuid": "50173661-1bef-49d3-9b8c-e80d3abc8fe0", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361253, "uuid": "ff593116-e03e-441c-b101-39a3bfbcf40a", "value": "3072:mVKDWeVgL7GKTqRPhY9UGEL/J/51ioe3v25fQtwlGvPGT1lT5Z:RBVgL7GUqthYOGELx/mo2gQtjv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361253, "uuid": "662ce5aa-5fc2-4af6-b33c-4dcf2b385199", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361253, "uuid": "3b2908be-7036-4d2f-b166-8fc4c3c6fe76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361253, "uuid": "c7ad049c-0ade-42b9-8480-05bc5cc4ef3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa1deb8-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690385081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385081, "uuid": "f12eae20-9dfc-4a66-b314-a83303217418", "comment": "Malware payload (AgentTesla)", "value": "fcef7ff704a548496bdcb9aa344c1ef7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385081, "uuid": "674a39cc-05c7-4ed5-bc1c-9b2ab57c5bbf", "comment": "Malware payload (AgentTesla)", "value": "980366b07b053cde767887e94f399806120d74354ef34fd6f8b4f31010b10c40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385081, "uuid": "bc9b4407-a5c0-4bf7-bd90-2d6ef0549279", "comment": "Malware payload (AgentTesla)", "value": "814f6eb96a6382428db126060dbdf17ab123f2b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385081, "uuid": "e08dfa8b-3cda-406c-8f89-47385b2e5288", "comment": "Malware payload (AgentTesla)", "value": "5fe7c6a2282e3c6c7f5629f896af3c8fb5eafa39cb473d82db34af872809b46376206386a74beeccf4121301fd528cb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385081, "uuid": "01c70b80-43ed-422c-8557-f155cdfa3c2d", "value": "T16675F103E8119E87C40D83F47E2329D94F0A6F06E5996CDF15123FAB3A32B62895B75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385081, "uuid": "65f46b92-a930-4497-b241-921315b0bafa", "value": "49152:UGuPR6VPEFR6VoiNhv3ttQXXnAgWj+RC:UG4mP6moMhyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385081, "uuid": "e34d5685-cff6-4bcf-9945-58ad6b23e207", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385081, "uuid": "d71f3719-0c62-46ba-9cdc-55d186045d4a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385081, "uuid": "091650b8-6fe8-4e25-8297-191f49a1e7a2", "value": "DOC JULY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bcd808-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690376080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376080, "uuid": "2283f9fa-6bac-4c66-8cfa-f8f57937d96e", "comment": "Malware payload (AgentTesla)", "value": "d5630654da95fbedc1ce7141b7728f66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376080, "uuid": "7b2797cb-7523-4648-9001-202c23413b16", "comment": "Malware payload (AgentTesla)", "value": "9806a1e62bcc7a3d20c1660807073451ec05d616240d4040c192d1c8722324d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376080, "uuid": "029300bf-7822-4915-b1b7-c4b26a093d91", "comment": "Malware payload (AgentTesla)", "value": "0a1bfa1b2055ca67aceb98711f596fadc2314814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376080, "uuid": "2b2e237d-75fe-4260-b3db-cb90ca10f32d", "comment": "Malware payload (AgentTesla)", "value": "654e2182885a62429249bcfa0f626fe1c413a0c12e28ba30b47df83d442002751daeb81ae9152d33851c11941e5d80b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376080, "uuid": "7a45984f-b281-4bc6-ad31-ea989ca6fd91", "value": "T1BF92D0865ADE250F88F9641B52054AF031A300FB63C7EAA1B0E339677E53E8176ED791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376080, "uuid": "395493fe-3c90-42c0-bdfc-740b1f58065f", "value": "384:fModXzt+lno48vDcyhX6phkP1JHieeP80rKRj/vcCSPc:xdXp+lno48vDcyhqW1JHizPrKW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376080, "uuid": "fede3575-d5a1-4a81-a33b-f8ec44337b0d", "value": 20049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376080, "uuid": "cbe68f10-7b4d-4624-af69-5ba31bab4969", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376080, "uuid": "125b6d47-86a7-4a22-b1d8-929ef2ded70d", "value": "ndhl 6833295033.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc612ac4-2b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690342698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342698, "uuid": "923c7c24-0aa1-45d5-8254-adbdca80a3b0", "comment": "Malware payload (RemcosRAT)", "value": "5285620527d612838b6c4c4acc4a999a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342698, "uuid": "1a227bc2-6fff-45f4-a31d-25aed920e221", "comment": "Malware payload (RemcosRAT)", "value": "982c58dde08f5027995aead8d0f31af56eb16ada77d9e5d2d1e2307dd30b72ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342698, "uuid": "7fa4e764-ab22-48d3-86e9-7499cadea075", "comment": "Malware payload (RemcosRAT)", "value": "66e261009a745aeb0ed753cc920fca12880d5153", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342698, "uuid": "f816e744-315c-4555-ba0c-a65cfbb46f60", "comment": "Malware payload (RemcosRAT)", "value": "f845a622676e78768eb7f0830a08b7b3df830877d9d08f0055143fea533e2c99350360041370899721b4217bd430acd4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342698, "uuid": "11517e9b-fc03-4f08-b4c9-71e99b4ab190", "value": "T1D3942324DCDA756B9B2DE70330EB433E25A4A941F098C076CDD7B83B2AFD91905B0E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342698, "uuid": "1d14e4cb-0b0d-4280-b96f-d2049ec48250", "value": "12288:JHb/LlMZ6QDBZEIUkIpT7bRx4a3ivdfI6d:lbjqbTFhYTJx4Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690342698, "uuid": "6d16492a-d0f8-49fa-b48e-eeb48bc3a11b", "value": 419492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690342698, "uuid": "37f64197-a204-49b7-a778-4f0c76fcb7a2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342698, "uuid": "9900a226-6168-41be-911f-909f78c81a89", "value": "10121759507928817295386125616372035441437274300726112860534020422.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c39eb60-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385057, "uuid": "56137d6b-985e-45fb-809e-4eaf4b97ff9d", "comment": "Malware payload", "value": "3c5b88656a4dfb71f1c840ab00533e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385057, "uuid": "5813c85a-2b4e-4d0d-97ee-ee3646c73654", "comment": "Malware payload", "value": "98938ab1080dfca4fbc61e2890b36d68d213e687805f374a000c326168028b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385057, "uuid": "2813a366-9d45-4284-a93a-ad9c2e489149", "comment": "Malware payload", "value": "ce848d3e834c78a2334ac0999860d25edb856f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385057, "uuid": "1492be40-8339-4ad0-a0c8-23aaf3c34fc9", "comment": "Malware payload", "value": "09a0489a68ddd13a87086da4cd57fcc5b872fb6d480e9d22e05146231e5e54a6a66bdb67f272bf5dfa2e51480f592dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385057, "uuid": "fffd7107-a44a-4e52-bde2-9bf66b7aae14", "value": "T14E84DF8773F58665D48DB77A8291000503B28912BA57DB495EF4A87E1DB338FBA0DE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385057, "uuid": "f738a334-4498-4e9e-ba75-60b9ec419417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385057, "uuid": "b88f7f99-36bd-4e17-aae8-8b552854c114", "value": "6144:/MrYfXeDnEYtbZM4HmxUCxBjIjAJ/vDSxQZ/V3HEhNZEkzz++3P:/MrYKnEYtbZJHmxtxBjqI/rSYtUhNqk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385057, "uuid": "61e3e835-b2ee-464a-a735-a658b9dc82d2", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385057, "uuid": "d927f66b-85af-4f6c-bcb5-f01b7bce9d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385057, "uuid": "38e26b90-7782-4eb1-aab2-8d3f5ce9f0d0", "value": "3c5b88656a4dfb71f1c840ab00533e5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95067adb-2b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690358040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358040, "uuid": "4273fbb0-c3bc-4a07-b20b-5bd4e2c1437e", "comment": "Malware payload (RedLineStealer)", "value": "e2fb938198b0ac49d6039f6788010c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358040, "uuid": "428c9a4e-ffa4-4573-ba90-7f21961cdd93", "comment": "Malware payload (RedLineStealer)", "value": "98bc9e2ae389acf70186fbc1e9296c4c4eb2b90b47ee70e526cccc52d9f3d949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358040, "uuid": "0d1532ef-df44-421e-8556-e78fdcb1faeb", "comment": "Malware payload (RedLineStealer)", "value": "038bc32057f9f447ce8bb7def8f9d68dbf55cab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358040, "uuid": "3e8591e3-c266-439f-b8d9-84676656658b", "comment": "Malware payload (RedLineStealer)", "value": "e7bf92a374d5cb7f1ce3932d176b6002d50dc88795c03f21b564e53b0728717dfb8f9538607c5f8ed9c4c28885780fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358040, "uuid": "e5788d39-2332-44bd-95b3-c0a0cf905604", "value": "T1A6D53396E740DCCFD99521326832C7BC2273EA1E8C75490C3A8DB6715E72B9220D7B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358040, "uuid": "304041b2-89af-4099-afcd-0b1880239553", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358040, "uuid": "73213134-3535-474d-9cf5-e33c1d6fa844", "value": "49152:VrTHpTyfliWULEK+7YD7W/oxAp+iIj/wV39zmWDzKoOXVnSwaP:VPH4liWUMED7W/oxAppIj/a3bDzOKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690358040, "uuid": "b6a0c97f-13a9-4f5f-9983-6d9a04d819bb", "value": 2994880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690358040, "uuid": "545ac45c-8931-4241-a6ff-a67845ec90d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358040, "uuid": "518b58e2-8910-4dd4-a83b-a0ae14c7b4df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1716d183-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690382740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382740, "uuid": "7213ba36-09da-425f-ba26-10f9158bccdb", "comment": "Malware payload (RedLineStealer)", "value": "4487e1cdd58ccb52a46645553b956baf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382740, "uuid": "8c309c67-cbd4-4f57-bfff-3554910d42e8", "comment": "Malware payload (RedLineStealer)", "value": "9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382740, "uuid": "2d3d836d-592b-4abf-a154-73a1a74eb8f2", "comment": "Malware payload (RedLineStealer)", "value": "cddeb1a3b04d8998c32b47fcee9e4c13d4e409a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382740, "uuid": "6224e53d-b732-4e0e-933f-aa2cb28350d1", "comment": "Malware payload (RedLineStealer)", "value": "8855c8b578ba5f823d96a586fe6abef33c4aad4e7534eb0749684ead24e0f0cdbd2e0a473ccb73226de8d1cf092d7290", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382740, "uuid": "31ca037f-847c-4072-801c-c4f06c520215", "value": "T112B41203EBD88523E9B517B04CF602930B35BCA68DB586673786999E1C72AD4E53133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382740, "uuid": "6918c569-b423-450e-b8df-f498e8b05444", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382740, "uuid": "cef40cd9-56ec-4a77-9689-3a8bd29b1443", "value": "12288:kMrdy90Me2oz7msLFkKLvUdJ+g5xbPJDMA9u2puSgF5cQrwmmU0:xy7m7mmVvU1xbPJMt2pxC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382740, "uuid": "c845d69d-52da-45a9-b752-642439a990e7", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382740, "uuid": "19f2b5ca-10c4-4ac6-b460-d9a59a0ee075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382740, "uuid": "3240b31c-9bb7-4379-a78b-15b9fb417158", "value": "4487e1cdd58ccb52a46645553b956baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e32c8d7-2bad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690373491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373491, "uuid": "5b7dac9f-e00b-45bb-84a4-f54971671a26", "comment": "Malware payload (RedLineStealer)", "value": "13ab2ab2678a1ede6715a9473bef7b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373491, "uuid": "247fe9bf-f89b-444a-a6ef-9d70a258cf29", "comment": "Malware payload (RedLineStealer)", "value": "9a3b24148ccdde551e729e06ff4e8aafeb24216f73c9d96fd93a993eca982f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373491, "uuid": "46b8166c-2ac0-4d75-83f3-052b277b2c54", "comment": "Malware payload (RedLineStealer)", "value": "ccf4377c9ac2d375c6fb7b6ec8ce32b62064b724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373491, "uuid": "5e95bb23-64a2-4117-87b7-95fc96ea11e5", "comment": "Malware payload (RedLineStealer)", "value": "4b75caed74d8a3e00a25fffc5d31445e9f3619683014a52246d64c8116e874e44fac6b62c0d91630b330200842ff092f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373491, "uuid": "aa60ed18-dc7a-4ad1-85ab-ef2fef1e6b23", "value": "T1BA840102E3D88073DAF92BF098F702C30A35BCD69D78975A2745AA5D1C726D0E67132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373491, "uuid": "af03d6bd-680a-49d5-bd39-4291442a57bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373491, "uuid": "ae32b5e6-8837-41f4-809c-d135abb61fbd", "value": "6144:Ksy+bnr+2p0yN90QE+NwS+H7hAY8NNAzuCQDo0xQRqjnCgBZ+t4tDM9fqLm8hL:AMrWy909OYaKzujDo0xQDgBYCtuyL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690373491, "uuid": "d7452b8c-3c98-4725-ae0b-355519c118ce", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690373491, "uuid": "3f84853d-74a3-45c7-bff2-72981304050b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373491, "uuid": "90b73ba2-5586-4f83-9ecf-be42b7b190d9", "value": "13ab2ab2678a1ede6715a9473bef7b05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651df5fd-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690365261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365261, "uuid": "44717dd3-2717-41d0-88da-83ba8988c636", "comment": "Malware payload (Formbook)", "value": "d73000c25e058145cac4f41f4d27928f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365261, "uuid": "ab2be4d5-b13f-442a-a477-072e5aead6d9", "comment": "Malware payload (Formbook)", "value": "9a42980c6e732e426166bc1d842e17f40249a0ce39c2b28d07928fdfb8fb616d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365261, "uuid": "791a5793-d58f-4593-9981-7a2d88562d20", "comment": "Malware payload (Formbook)", "value": "3f053274d8300f27003b14b272f39a9d01c25144", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365261, "uuid": "93f6e6ef-04df-4f3f-a544-e1533d16c277", "comment": "Malware payload (Formbook)", "value": "394cbe93d2de59f9e548ebb9d262e5890d69194db70704657d7170199ca603399000bc805e267e2c81bde48d5af51dbe", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365261, "uuid": "f1e8620e-a87c-4bda-84c0-f7fed27083e2", "value": "T1F975F103E8259E87C40C83F47E632DD95F0E7F06E4956CDB21123FAB3A32662995B61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365261, "uuid": "b8d91b23-359b-496d-8512-b9251da5927b", "value": "49152:lvuPR6VwEFG6VoiNhv3t5QXXnAg09kYC:lv4mwFmoMh+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365261, "uuid": "8038c0ca-5e41-434e-be41-38361efb263d", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365261, "uuid": "198892af-75c5-4a5f-bddb-e210c4765b20", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365261, "uuid": "d27e39b8-9821-4e6f-85f3-2b77c0798cc5", "value": "P.O_R477304.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031cc9f6-2c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690414059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414059, "uuid": "8f9776b1-aa72-4f23-aa5a-4cbef457f874", "comment": "Malware payload (RedLineStealer)", "value": "148b6fe5b9664b83b4638511e86c6c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414059, "uuid": "79dc6e5d-65d6-4a6b-8a54-fb46d5a5678f", "comment": "Malware payload (RedLineStealer)", "value": "9a72ed316bbd2e389eb2ecd7243e5841d041badae874aa11f831b452a7cff8b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414059, "uuid": "76781a96-523a-4448-8122-5f1b14348a71", "comment": "Malware payload (RedLineStealer)", "value": "2ed10943376474af81580c75911d18644060d893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414059, "uuid": "961916b6-cef5-4e33-b956-78ea990bb895", "comment": "Malware payload (RedLineStealer)", "value": "e66c809c1858b9593a1884133b453504fa1db16fcf93e5bae985b41475aaaed3501c18f225c15ec5a626d473c43ad767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414059, "uuid": "b95c00cc-5114-455e-8029-903c6806f0d6", "value": "T1338401176BE89033DDB527B068F703830B367C946D38936B2395685D4DB3690A8B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414059, "uuid": "7964afc2-96b6-40c0-93dc-8de6a4748cac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414059, "uuid": "7a713684-0c95-4e4c-9dc3-34d96c9526a3", "value": "6144:Kzy+bnr+Jp0yN90QERX4tm0kXjd0hkWWnZNuj++5LxpD3RsN+UBr5hPy11+GHHLo:ZMrJy90jow0e09++9xxBssUdnP+HHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690414059, "uuid": "7f434a78-35b0-4fa3-ae05-19ddde2cd398", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690414059, "uuid": "664193d6-abfb-41fd-acc7-2f8840f0ae96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414059, "uuid": "bfdec01b-e104-4521-ab08-e6b4582939ef", "value": "148b6fe5b9664b83b4638511e86c6c5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b655b7-2bc1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690382207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382207, "uuid": "fb3e1e9b-d3f7-4050-9c29-9efaae758ccc", "comment": "Malware payload", "value": "f1e373d2e6fe0dccff697b1f59646da1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382207, "uuid": "0fa510e1-5133-4403-92cd-40ea68a45095", "comment": "Malware payload", "value": "9a84f43c4be739f8a69f3b9c517c09b44f02a331258de9d3c6696122f61489c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382207, "uuid": "2b09176f-0994-4460-9d30-b2a305a97455", "comment": "Malware payload", "value": "52ea710e19005501a75ce054fe22d75ee1c003bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382207, "uuid": "b6aa25c8-1f05-46bd-a12c-0e27d6fece3e", "comment": "Malware payload", "value": "dc7df420316fee541970893907675430a0d92dae7703c6e441c81b0ebd0508120cea66d76c14abec100312d46f74fc8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382207, "uuid": "7163144a-4882-4762-b94d-12b94267fdc0", "value": "T1CC527D36CE0705D4CEADAE7009D95B6D0A51AA0AA24040E0CF790E5F3C717BFF56F5AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382207, "uuid": "b3978a53-84e0-4b3c-a366-6bea29322ec5", "value": "3fb7ec92dc5428dc25b22a2c07c4e9d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382207, "uuid": "60b754d7-d200-42ac-9a4a-de36a6f573ea", "value": "192:bRXMnNWUtopleop9FAl1kVipxmHxJ6Pgqh4K88XsVvG6dxzR9X5XHAfvq5eQ:bRLxDtrFAsVMOxJ59KW5L1F5XSiQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382207, "uuid": "20473cd0-0aa2-4e18-aa73-9b0fa69b8859", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382207, "uuid": "46270ced-4b94-460d-a3db-f79f1a99bea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382207, "uuid": "7168e79f-380c-44f1-af10-286879f76510", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26580.16287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715dd26a-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690365282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365282, "uuid": "357533d0-1ce0-48ae-909a-a8a17ae9a8aa", "comment": "Malware payload (AgentTesla)", "value": "c9fc4258a331cae34e2481fd662099bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365282, "uuid": "67c0e89b-136b-4592-85a0-501af732e258", "comment": "Malware payload (AgentTesla)", "value": "9a93faf5e2655e6be04da3a195d6221636a6adeba3c65df56f2fbd5ec77b1f3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365282, "uuid": "0100b6b7-2df1-4ed9-9753-a431e14cd473", "comment": "Malware payload (AgentTesla)", "value": "8b9b2aab582daa066df37da6b943da6bfcf948d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365282, "uuid": "fcd43ca0-54a6-4dfb-baaa-df600bd538e6", "comment": "Malware payload (AgentTesla)", "value": "9fac5dc8b916e032053a0428e56bcab74b503325ec944e94f7da0834eba721f7377269af37eb46896525c4c07f090366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365282, "uuid": "e681d73f-c709-49a5-b7c4-5729369b3f34", "value": "T14D235B5AE79F02A48F510273531B0E8996BDB23EF35151B134AC937433EDC2E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365282, "uuid": "e9ab0d0b-b66e-4d1a-97dc-03d5a92fe641", "value": "768:8Fx0XaIsnPRIa4fwJM/hFxLEQjCN2Hs3ejDQL:8f0Xvx3EMZF5yN2HsmDQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365282, "uuid": "096f9bfa-6ed7-4481-85a7-fce2c030121d", "value": 45833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365282, "uuid": "e4a2e6fc-4322-4ac8-9ecf-06ba12a80ced", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365282, "uuid": "eb88d4a1-3c9d-4c01-8cc1-652b85205b04", "value": "c9fc4258a331cae34e2481fd662099bd.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008336a2-2b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690347483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347483, "uuid": "d654ce80-fa85-477f-8c24-977ece897f0d", "comment": "Malware payload (AgentTesla)", "value": "a5bc222634ccd2ed18e4b8bf6af1ad67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347483, "uuid": "d4dc2dff-afda-4836-b4e9-56acc07dea2b", "comment": "Malware payload (AgentTesla)", "value": "9ae6f0700b3190da3b2d867b17111acea2af58fb24c220f2786443b73a88a20d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347483, "uuid": "46246510-8802-4a8e-b2e6-2397dcdc7fbb", "comment": "Malware payload (AgentTesla)", "value": "816d88e197ae2b06e946385febfb86dc37bd3011", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347483, "uuid": "5f8596bd-9608-4d63-8bef-f9a4469d4228", "comment": "Malware payload (AgentTesla)", "value": "78cdc78c456c805fb7a88a4fa80f629a30fc1d8d0b872da06c85011ca0f0195548b6b1b1a59e71f65a4446dc096bfd83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347483, "uuid": "a721b427-921f-40e7-ae1e-a1fee601f938", "value": "T1E4D42388CE44CB322477FB3D37820759B980BBB616AC2D9F51C61A8B1A9DB3DDD43449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347483, "uuid": "14e9c31b-89fe-4561-9e6c-d8d9d9d2d533", "value": "12288:kJZ1zNwMqWuap27Sr+6768ZN8pa8cuu7WQePXehs+lY6Rnr1cFPH:kduhm7nZT7Eus+lY611YPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347483, "uuid": "c4a3fd50-fb75-4938-b76b-1be89ce57bfb", "value": 610383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347483, "uuid": "77b856ec-4de5-4fb9-8748-637a92f128e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347483, "uuid": "4eb7600a-3d21-4e31-85f9-a6388f30a9e2", "value": "bank detail.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182f5f72-2b82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690354824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354824, "uuid": "9f95fca2-2618-466e-a061-e21c1bf3d125", "comment": "Malware payload (RedLineStealer)", "value": "c40a17d1cc469a42d2d7c93c035cbbe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354824, "uuid": "cae1b04e-9e5c-4d18-b8e2-d6b833a78b1d", "comment": "Malware payload (RedLineStealer)", "value": "9b8f89199268dfbca47484d10159461662b991372d96d31fde657eef6a0ca937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354824, "uuid": "52ba5bf6-ffd2-4c04-92d9-0f028eacea91", "comment": "Malware payload (RedLineStealer)", "value": "17ffd6f5c213f0266b552781a39665c3c46ef6b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690354824, "uuid": "12626fdd-616c-43b8-9960-d4913b05fc65", "comment": "Malware payload (RedLineStealer)", "value": "1ee04a4a8e539b17352ca0ed5630684f005da729b44da85a13170374594cae0da7dddd656e6ca484c34d88890cb0cae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354824, "uuid": "0cebb402-8b00-4d7c-bcba-0793d6acfee3", "value": "T17E840243AAD84073C8B61BB068FA03D30B357C615C78932E3685D96F4CB36D4A87276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354824, "uuid": "9aade440-a1ee-4658-a120-f729ae41119b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354824, "uuid": "b2028fbe-d00b-4533-98aa-eee5129e9c38", "value": "12288:hMrkry90QZfgnFQG3YcomhF5gBYC3Semh/1+FJskwB:Lry3f8fhnizCCJrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690354824, "uuid": "a31b8211-fede-4612-bb2c-6099eae5f3eb", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690354824, "uuid": "4a3223c3-8e9f-4445-b765-d87e720ae222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690354824, "uuid": "e2fdcef5-4185-405b-9d95-56d26bf08d5f", "value": "c40a17d1cc469a42d2d7c93c035cbbe8.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bff3216-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356334, "uuid": "02bd8f79-f40a-4e14-9ba3-7a181977c957", "comment": "Malware payload (RedLineStealer)", "value": "5cf20b3bca680199c834e93c0b9ee01d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356334, "uuid": "1cb96fda-6dd4-46b4-804b-640e13492bb0", "comment": "Malware payload (RedLineStealer)", "value": "9bb460bafef385e1e2fc07823016b48458f93e82ba5003736b3e004c9f835dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356334, "uuid": "d3e81602-c2e7-4404-aac6-8d8923178104", "comment": "Malware payload (RedLineStealer)", "value": "d265b4cddd851fc172b0b44a5810b5004bd4771d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356334, "uuid": "b307b38c-a0e0-419e-a949-3fd72c3d3906", "comment": "Malware payload (RedLineStealer)", "value": "5c537a3769a5ef6788d3583720c7c186b1501eb570540d90ab0ca9ff749c7e2a386c9fe567fd6599153abfcbfe5e0bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356334, "uuid": "6335be50-ff3c-485c-b2f0-0960e8341566", "value": "T1F0840246BBE98032D9B10B7048F703931A313CA16D79876B2786A95F1C737C4A67273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356334, "uuid": "b513ca5d-7ba0-4d48-84a0-2ebda7be9196", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356334, "uuid": "794b1848-f41f-496a-b7de-1a6bf9a79924", "value": "12288:sMrSy90fdDYaHxMmt6IMgBYCx32gihkO:eyMDYyMmTz521F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356334, "uuid": "b9976f3b-5c4c-460c-9908-ea0997ab4f36", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356334, "uuid": "305fb773-9ff2-4dcc-bd97-f4f160bae178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356334, "uuid": "8eb05ec0-2877-4c2e-8f39-f405bc1503b3", "value": "5cf20b3bca680199c834e93c0b9ee01d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7dcf31-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351155, "uuid": "5d3f3266-f55d-4a74-a401-1a5a79e1988a", "comment": "Malware payload (AgentTesla)", "value": "0de0cb7ae21fb56ad446b7824942ffb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351155, "uuid": "812a6a55-f831-4c8c-909b-563aebd1ac65", "comment": "Malware payload (AgentTesla)", "value": "9c1dfb4fb5b62214e9a1095dcb5e70f742e184fec69e70718c2fb46332a830f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351155, "uuid": "cadea706-d852-4193-856d-c61f1168ebf3", "comment": "Malware payload (AgentTesla)", "value": "793c6ef58bf6debf27929f8d9ee13923bbbd738d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351155, "uuid": "c9766eca-26a1-4707-82f6-5a232c744a8c", "comment": "Malware payload (AgentTesla)", "value": "d631e2a4068a873939280a29bcaa853a4204b53d199a69f5a5c85e74b96be9e5d51d53cfa66579ef90703b92eba0b23c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351155, "uuid": "ae547fd2-dfcd-4fa4-b3c9-8ee6058486cf", "value": "T16FE4121676BC9B16D97B53F53750960047F2AFAE2122E3A92DCE25CB8B2370112B1F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351155, "uuid": "fcc7f3c1-ae16-4ce2-9fd2-f1e59213dbe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351155, "uuid": "3d2eb7ae-bb47-4bef-9db8-6418891579b4", "value": "12288:S/2iN2GULMlXIlv1k4e/Zp+NRUwqXjn5vrhna9/s7CI4S0EPYVD6AxsJ:S/1xULMlXS1IZpo0Xjn19zCpgPYVVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351155, "uuid": "5dc1a6ee-70e4-4c01-a8c6-3b4b7b31d997", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351155, "uuid": "a9679db4-274a-4b1b-967a-5eaaa4bde10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351155, "uuid": "0bb72e64-6d7e-4ab3-9723-44305f18e8f1", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a549da4e-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356349, "uuid": "6ea91a57-abce-4570-bf9d-b7d442aff89a", "comment": "Malware payload (RedLineStealer)", "value": "50d41bab5d93294b6d08f8df771cdd93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356349, "uuid": "d0419689-ede4-4080-b214-cdcbe8bc9a94", "comment": "Malware payload (RedLineStealer)", "value": "9c1f8fed7140df7963609116dc14caeb5d579c9bb64e56b8cfd0b8b1159828cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356349, "uuid": "4498cec1-0802-4ab5-8c64-ecd38eb02ec4", "comment": "Malware payload (RedLineStealer)", "value": "0d9091065b8e4e843c6b620358489d97516dfd30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356349, "uuid": "a48252d0-f011-467c-bf31-710a98e0de38", "comment": "Malware payload (RedLineStealer)", "value": "d593a7744eb90438a330cc43f533dfe221636d9c520e88d5f79ef2ee4ef6c3fd2033e2d07fd7df1dcf03921c1c1feb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356349, "uuid": "0506885d-0f03-451f-bb89-6a992075e80f", "value": "T1E5840202BAE88073D8B627B028F602C317377DA15D78936B3745A85F4CB36D4A87576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356349, "uuid": "a4f88031-a0f3-47ef-a075-60057fb3b1e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356349, "uuid": "f52d74a8-f74a-42e5-97e2-b250b294caf2", "value": "6144:KSy+bnr+Fp0yN90QE4MZu7RHY60pr37d7hPJFgBZ+t4KDjddKcFN5KA2Su:yMrpy90KMZQiVhP/gBYCKHdMKNY55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356349, "uuid": "401b4aa0-9985-4d2b-bc8a-1e51ab95a6f8", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356349, "uuid": "518c721c-ffc4-4782-993d-cd7a342b726a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356349, "uuid": "88f4a46e-52db-485c-8531-66244b35d18a", "value": "50d41bab5d93294b6d08f8df771cdd93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d556db00-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385636, "uuid": "9052e26d-aa8f-43a0-8ef8-d034aa8f6a36", "comment": "Malware payload (Formbook)", "value": "c91d9427b6640e1bf118759b5e1bc0b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385636, "uuid": "b3fd27bc-4ecb-4128-9167-c03788f70887", "comment": "Malware payload (Formbook)", "value": "9c4729e8b07e00f05876ed556d5c27a993a60979374b7fdafe69c0aca66a7281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385636, "uuid": "548c4a64-ebe2-4735-9080-b615120fe984", "comment": "Malware payload (Formbook)", "value": "0e0f19dca0fa9b07d0306de82998ac8ab0f01e86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385636, "uuid": "0e262e0b-7b74-4d58-b1a5-955e5ac85b37", "comment": "Malware payload (Formbook)", "value": "e98ca84ecd8fc518f0d8cdee4c4420b242888196d9417289ff195b916e017cb8cc9881225d19628bd26d3ebea2dcd217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385636, "uuid": "4c82512f-d052-42e3-b939-e656a537338e", "value": "T121D4126123FCCB29D1BEABF7182154440FF0DAABA612E7497F9C20DA8E353114AD4797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385636, "uuid": "d661e05f-f952-4b01-ad9b-df80c0e750eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385636, "uuid": "ed6a9551-ed88-4244-8420-1cfd63674b09", "value": "12288:NXPZHB38itwoOoIvOuJT9nBKStfLLBdKpWild:neLnBtMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385636, "uuid": "2422a59a-90d6-4bf4-a091-558acb06e7fe", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385636, "uuid": "2b3e9e48-0c46-46a7-8ec3-5c87343abc8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385636, "uuid": "a0cc79e2-41bd-422a-b22f-ccbf013004ba", "value": "c91d9427b6640e1bf118759b5e1bc0b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a6c238-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361474, "uuid": "ce9ac2f9-8663-4720-89fd-f3556ab202b6", "comment": "Malware payload (RedLineStealer)", "value": "bc3b4fa31b83e67174c39170a084a805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361474, "uuid": "7cc9c381-0dd9-4fc8-a6b1-050e8a815cc8", "comment": "Malware payload (RedLineStealer)", "value": "9cbd68aaac57b883359f931fef90f89a4fa6b702ff87d5475241efd56f4c9d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361474, "uuid": "32f9e958-a748-408d-8c6f-74d975d3bf4f", "comment": "Malware payload (RedLineStealer)", "value": "243cd9b2d4c336eb0caa23a90d3145b4e6dbb959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361474, "uuid": "d495795b-0cb1-4e05-84cc-301ab6dd46df", "comment": "Malware payload (RedLineStealer)", "value": "6470c1f897e5a4c8529c1d815af681390513e806a1660ce4f586efd322fbcba2d87f4bc111be74c18ac6e9b54c75dc97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361474, "uuid": "c647f544-b438-4a42-92dd-9329ddbdc253", "value": "T131B402027BE88033D9B62B7018F717C3193A7D919C78C66B22D2A95E4DF2694B835727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361474, "uuid": "41a490a5-aaf6-42fa-8117-83028a13a3f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361474, "uuid": "a91b04e5-5caa-4d0b-838e-29b2f3a112f7", "value": "12288:AMrVy90oPCXGVEDWOlaZO33ZZA+EsBE9kFp:FyaXGVEDDlaC3ZLEsBEeFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361474, "uuid": "cd915307-e9a4-41a4-b9c8-b08d26162666", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361474, "uuid": "72851452-a83c-4f35-9c33-57fdb34ccde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361474, "uuid": "0afa67e9-232f-4eb5-999f-2bbd1b313684", "value": "bc3b4fa31b83e67174c39170a084a805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5561d334-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356645, "uuid": "7a543b5f-7b81-489f-89cd-9242fb31a455", "comment": "Malware payload (Amadey)", "value": "81560614122af8cae5ebbe09892f3100", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356645, "uuid": "dac641e6-64e3-49ef-9156-9a199617216b", "comment": "Malware payload (Amadey)", "value": "9ceffc1df3fd6c264c06d5a1093f5fd05150ee2f545a9c7e8a6ac4c93038339f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356645, "uuid": "138a7924-8204-45ee-bc24-0f553e93bda9", "comment": "Malware payload (Amadey)", "value": "f4c252e4527e197ac40c30a2119c305a1baf5d52", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356645, "uuid": "c8dded10-38dc-4fca-ac84-63e50acc604e", "comment": "Malware payload (Amadey)", "value": "b5010f5147bf5487f56be11bac7c7b04dd32d538f0afba184237f16d709413b250e10152358fc6c4decf7c3e4eb6750d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356645, "uuid": "c8722c8d-c374-4eee-991b-eb58255b766d", "value": "T135B41246E7EC8473DCB513700DFB13C30E3A7CA299B8061B235A994E0D726805A767BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356645, "uuid": "34dfc033-3f05-4b70-be69-72cf97f63728", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356645, "uuid": "1c818133-595f-4803-aaac-747fac0fe20c", "value": "12288:CMrxy902I2JkbCYLCRbSzj/rFP152q5OLdsRXcz4/grw9JosuXM:jyV+bCMCRbS/rR1MqoL7z4/0wbUXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356645, "uuid": "3d5f6ee3-965e-4b03-aab8-a02d31d8cc41", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356645, "uuid": "04249b15-a9c9-4407-9624-cf349ed9c191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356645, "uuid": "781bf033-57be-4acf-8234-4ba36f3d0062", "value": "81560614122af8cae5ebbe09892f3100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0f2ea6-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356981, "uuid": "abe4d4fb-d30d-47ef-bbd0-3ed99f916f3e", "comment": "Malware payload (RedLineStealer)", "value": "8b8c302f24fd773eaabdc10d703cdb4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356981, "uuid": "be89b2bc-36f8-4ec9-b0a5-c4a2a1a40671", "comment": "Malware payload (RedLineStealer)", "value": "9d07642e8f736da84e6a11ae55296eebc62c8586ba4d10ca4690871df1e2d7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356981, "uuid": "e8acaef9-a9c9-4e0e-8278-b9ee669ce87d", "comment": "Malware payload (RedLineStealer)", "value": "1c7d0144a8dab33510bb9bbf7604d22c8a4f6f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356981, "uuid": "9b786c0a-a31d-41da-9231-2fb50a99735e", "comment": "Malware payload (RedLineStealer)", "value": "bea201c6929ff9ea2c35dc3a3386353ba58cfc28ff098d18ed098cd866523d48e2f8b9cab4e298d91c6bed97e20eaf6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356981, "uuid": "bd183012-6620-4d02-8aab-5d6ea37815f1", "value": "T191840152EBD89031E8B517702CF607831F36BCA28C74876B3799A95A0DB36D4A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356981, "uuid": "f306162e-78a6-4975-9b60-6687c8b7dd0f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356981, "uuid": "6f946006-3adb-476d-b951-1d8f12c8c739", "value": "12288:eMr+y90jJI+gQxRE+qCwcGpyzVSgBYC8whP:cyaJwQxREU9syzVhzrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356981, "uuid": "0d358133-8cab-4d4d-af02-4401a5a1a528", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356981, "uuid": "3c5ba40c-b8e4-4128-84b0-26b88eac653e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356981, "uuid": "173f0fd2-07ef-4746-a467-b8d0cc507840", "value": "9d07642e8f736da84e6a11ae55296eebc62c8586ba4d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c50b10a-2bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690390936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390936, "uuid": "4c66a6a5-bc6a-468b-a5ed-39cd4280ee3c", "comment": "Malware payload (Amadey)", "value": "0bcaaa53b02670498b567fdada19c0b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390936, "uuid": "a4777319-69bf-4894-8b48-b6416b0c64ae", "comment": "Malware payload (Amadey)", "value": "9dcd0551edf5ce48afd68229d11e185bea7157d8f007671c26ad3d66006dd9df", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390936, "uuid": "089c80c9-11d3-4154-bfe8-2b2bdc6f567a", "comment": "Malware payload (Amadey)", "value": "836a56dc803b34f8c767cc1898d0200be3ebc09f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690390936, "uuid": "01abcf53-120f-471e-9d7c-e7766c6efb3b", "comment": "Malware payload (Amadey)", "value": "bec8b028c4b0fb1604fb1784eda0b02fbeea0fca080e2a4be7575387cd453d1dd833ad82866e1631fe7df57f279d1ace", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390936, "uuid": "5e659dbe-92fe-4596-83bd-3820e51adf6a", "value": "T160F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390936, "uuid": "f9d23978-27dd-46b8-a1ae-3f5d8ba7e19f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690390936, "uuid": "7936a77c-d01f-4bb3-8c3b-c4fbc2266a87", "value": 35967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690390936, "uuid": "326a92fc-1533-4c55-a14b-8c9c24efc7e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690390936, "uuid": "d6a08dbd-ead9-48f7-adda-7e3373adcfc0", "value": "0bcaaa53b02670498b567fdada19c0b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf854c08-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690356850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356850, "uuid": "208887d5-3c07-4ec4-a626-2f2bbf4c48b9", "comment": "Malware payload (AgentTesla)", "value": "49df820a397d3e2692e6b59ed11b7de9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356850, "uuid": "c6d95e89-9ced-461d-b3d4-4db180a42134", "comment": "Malware payload (AgentTesla)", "value": "9dd0d81c8279f15d6d56e600c58543563b5a2f5f8df416b33fb1acb5ce9449c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356850, "uuid": "662b3984-05e0-4ca5-ae90-6b0cb1ca528b", "comment": "Malware payload (AgentTesla)", "value": "8f9d3a3a2abb3c9bb78594609eec43403c0e3d91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356850, "uuid": "abde258d-5a1c-4fb7-83e8-1402697cd69a", "comment": "Malware payload (AgentTesla)", "value": "fa1c3538f3109be7e646aa6003010dd359ce82554996e13a67f01b62ff8632ef63b1ee9ab9c81bc71195392df329aa6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356850, "uuid": "1b5328c9-f7fa-4983-8cdf-b8595700dceb", "value": "T17C340F037E88EB11D6693D3BC2EF6D2453F1A0C70673964BAF88AE6525512536C6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356850, "uuid": "77327694-7fce-44bf-8558-9c33ff8cf7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356850, "uuid": "3f3a32af-6169-48e1-baa5-1fee01bbb280", "value": "3072:NpQn6ZxW3IH5TKuBa4HbTPf4qoL3IJYCFDl:NpQnexr5TKWasbTPANIJfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356850, "uuid": "287660fb-180c-4c8b-8fd8-c83146204b66", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356850, "uuid": "d3ca229a-22e5-4911-9523-9fe915354819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356850, "uuid": "08f976ab-4ae4-44f9-8056-d96007227d03", "value": "16903568476b908af8de6fa80ce83c0860bdab5a75c5d962b671392afe874afdf2c11298ad133.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12935c57-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356962, "uuid": "a9e3dc0b-2d71-45e9-a400-fbf92177083d", "comment": "Malware payload (Amadey)", "value": "fcba180a8d0783795826eb433edeb4ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356962, "uuid": "68c62f7a-13bb-4fac-adb5-c43833a19592", "comment": "Malware payload (Amadey)", "value": "9e7aeb08b682beeffd379365a9df35a3b7590b92c70f75ccc470a27258bb11b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356962, "uuid": "a7ed8dea-353a-4a41-bb76-e259199278b8", "comment": "Malware payload (Amadey)", "value": "1c0474f8d1b04d5a54e4f47dbb2c45fb9a933530", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356962, "uuid": "0272b50d-d559-4d6b-89ad-f649759acd8a", "comment": "Malware payload (Amadey)", "value": "19b2bba67dd20265062f1330c7deddbdb55f14a57775f2c44bf0b216a8918200f60cc8359e8bee26e7d7e2de54199181", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356962, "uuid": "82390f72-e50a-4794-8e28-b46dae8a1f76", "value": "T16584F113B7D58533EDB85B712CFA13C30A36BD9259B883AB2795594E0CB25E0983173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356962, "uuid": "cbeb4a3a-820e-45ec-9ba6-0dcefdb9d272", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356962, "uuid": "d1223e33-1bb4-4339-9c18-df965d3e1144", "value": "6144:KSy+bnr+Ep0yN90QEmCpsoY5/jFFh/P/Ks74peOHLNWWEN440Nm8PERpFhEvBa3w:iMr0y90QC+rFFh/6kXOH5l3MBhE5aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356962, "uuid": "96fb988e-e8df-417f-9dcf-57d60fbbe8f0", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356962, "uuid": "35009cf5-74b1-452d-aa9d-38f1d557575c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356962, "uuid": "e24b102d-e1c7-46a4-8895-4e8cd883eac2", "value": "fcba180a8d0783795826eb433edeb4ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0398f2-2bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690391227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391227, "uuid": "402bc599-91e3-4e3d-8b03-907e20eb29c4", "comment": "Malware payload (IcedID)", "value": "9d567c70f853b0947b0eeb0a442c6178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391227, "uuid": "c539d57a-8035-47ae-b203-8d9b60022bf2", "comment": "Malware payload (IcedID)", "value": "9e8408714a5a5830f047f1890497fc326c94fbc277bd90a03347d069a7a9c1d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391227, "uuid": "3c2bcd94-0291-44fd-b9ec-fa1e733e1419", "comment": "Malware payload (IcedID)", "value": "2a936b84d3a3b651f6882111f9fcc85f5f6c1ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690391227, "uuid": "3997755b-8c1b-4824-8222-d586ce795af6", "comment": "Malware payload (IcedID)", "value": "749fcb9f4481136633e3e2dad7e6e1a0337d5aa5e3350da7bcad6c465cd35b8b41596dccdc5d04fe958b4c399f45d2ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391227, "uuid": "ab5a971f-6ca9-49bf-b8a2-f2e431f9dcd2", "value": "T153A4F146D2660AF3DC27C17E98E2410AD66078839A56C71F1358C2693FB31758FABB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391227, "uuid": "99dd76e4-4105-4dc1-ba17-676132a0cc72", "value": "122ad25046a6ae342251fe184815d102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391227, "uuid": "15399736-1b9b-4557-8fd7-7f4306462b67", "value": "12288:ltRDFglzv4djn40Gjz8sH0Sy4GlJKqbUbubr1Iv:ltl+zv4dYv8sUSyBpobRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690391227, "uuid": "5e2787b7-e676-4530-abc9-be924171d088", "value": 477360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690391227, "uuid": "16af6d30-9987-4786-9159-8952cdcaa1b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690391227, "uuid": "ec3df23b-9b2d-49b5-829e-9a3eff620bdc", "value": "Scan_Doc_07-26(206).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a696183f-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396295, "uuid": "9ddbd849-9d18-4aef-aa36-a0237fa912c5", "comment": "Malware payload", "value": "2eb21acbab653f9007db89469ca991c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396295, "uuid": "d217b2fc-c4c3-41c5-8316-b7dd646e94af", "comment": "Malware payload", "value": "9ed0ffeb25bd64d20de3ae1a0134f535534e1bf66fba1a04a3b864b274ee5dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396295, "uuid": "e3717f67-69ed-4609-95da-91581ef38298", "comment": "Malware payload", "value": "3ae79bd5fcd9a1b8bb0c420c2f61ecdbac5d6b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396295, "uuid": "5bca5f2a-8194-40db-8bb3-822b094b2ce5", "comment": "Malware payload", "value": "7a42d91a01630c3c1fd21cbd734dac22f00725bf3868a52cd5582a9970b653bdf224415b53f9a8dc01a9f4dca2c1ae7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396295, "uuid": "3409db59-17d5-4b42-b91b-3cf3eea9dd10", "value": "T166F5BF195D68AC30CF10A23BBE634D472466BE63292DE60D3EE8EC73474A45716EDC4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396295, "uuid": "a6b4278d-9b9e-4a83-9648-19c48a2ff15c", "value": "7171dd3cc2e067362ea92a90a83c63fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396295, "uuid": "06b71fee-5164-4467-8103-4eef9447ed83", "value": "24576:74TY5HReB07yCo6OVtsdEFL/G3HciUfYgwJSUW99xNdkQ7+OT:8KHoayCqGuw3H+DPTxNdkYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396295, "uuid": "d9ed96a0-ab47-4d66-854a-d4bd858263a2", "value": 3453440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396295, "uuid": "b0916c92-e883-4555-a033-5484786d8792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396295, "uuid": "52a4cb6a-a644-460c-a6d7-de128f24b8f0", "value": "SecuriteInfo.com.Trojan.Heur2.sNW@If4VDppi.27877.25664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b2b70f-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408084, "uuid": "8b666187-49ef-46d6-b149-19c9ad0e9987", "comment": "Malware payload (Amadey)", "value": "917bb5f4d2e524203ec2f8b2ca6cde66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408084, "uuid": "6715a784-c546-4ebb-8358-3a9584f0b14a", "comment": "Malware payload (Amadey)", "value": "9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408084, "uuid": "ce1e99ce-77fc-4da4-a0a7-6be9799eb7f6", "comment": "Malware payload (Amadey)", "value": "7b18a47f6b6e167d9604449477b5b1fb8cb0a579", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408084, "uuid": "7d06cdd2-e04c-44d1-bb14-bc7fc9e44252", "comment": "Malware payload (Amadey)", "value": "67a301b6726bc31bbb8d2d1fca250da0386cdf619a5a532a83b3492bfe04703383cab22293a72d58cbf3a4c46279e176", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408084, "uuid": "f72a5fac-1d45-4252-86d8-1ac615ab8d87", "value": "T18384F143EAE88073DDB527B418F602830B36BD915D39936B3786984E0C735E4A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408084, "uuid": "6ead253c-5c39-4d65-abdc-c8bc25ebb057", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408084, "uuid": "e55ca775-ffd2-4518-8587-f0b17a3058d0", "value": "6144:Kuy+bnr+9p0yN90QE1vPgYPRrnkW6nZN7QR59Rm5DfBivUUBrJhYjqSB4aaiCx55:KMrVy90rNPRjEx8sUdXGB4aaiFq8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408084, "uuid": "81370752-94ee-4272-94f6-a920e7285683", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408084, "uuid": "cdd08ce0-ec64-4c62-aae7-85b599f7fc26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408084, "uuid": "dbd95ade-80a1-4a29-86d0-425c35124b52", "value": "9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542c26b7-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407753, "uuid": "251b5cde-47a1-4574-830d-1e4fa642e6da", "comment": "Malware payload (RedLineStealer)", "value": "9b5b4b59df85bd4d0398f474a304cf70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407753, "uuid": "f9084160-c7d0-485f-ad30-f1c0211617eb", "comment": "Malware payload (RedLineStealer)", "value": "9fdab3885ae58613fdf220987509571396721a0a5458629fa87bd7bfb1d3ab6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407753, "uuid": "6617df88-6998-4b1c-9df5-0cefedd120e2", "comment": "Malware payload (RedLineStealer)", "value": "70a24089db79ee4206458e1b639a4f4f916d48f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407753, "uuid": "591dae7f-4d30-470a-bc3c-9a9432cbc1c6", "comment": "Malware payload (RedLineStealer)", "value": "7f9570803f430b09c16831bd170711904f5c5b850b8c02536962eacce86bfffde3d9d4455690595741ffb82483100055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407753, "uuid": "52d734ca-0c51-4880-8572-09750adc14cd", "value": "T160840102B7EC8032DAB957B028F702930F377CD6993942AA3389794E0D72794E576767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407753, "uuid": "2499216f-ab35-4ca6-a616-d9b03b7f0154", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407753, "uuid": "6fc0f136-6ba8-4cdf-a6dd-54dc592665b9", "value": "6144:Kcy+bnr++p0yN90QECbxdZkWGjZNhTADotQnuSW0bnbmRvHoqgAW+eNc:gMrey90UbOTLSW0iIqfCNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407753, "uuid": "535b70b3-9328-4b61-84d4-e2265a3543cd", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407753, "uuid": "4c81fa96-1176-4e55-babe-f015aa76ff68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407753, "uuid": "5c2c90a3-61b6-4304-b751-a4d936261792", "value": "9b5b4b59df85bd4d0398f474a304cf70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15226bd0-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408077, "uuid": "e93eb64b-a670-460d-97ad-8ea82ebdd70f", "comment": "Malware payload (RedLineStealer)", "value": "455266b21dbf7bf5f468b14f305d54f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408077, "uuid": "4ef52464-0c81-42a0-b128-1b5f787c4b75", "comment": "Malware payload (RedLineStealer)", "value": "a05227e08c9813b78ddf7a869b64e8a78789257e0bafd4b3a9c72b2111eec7b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408077, "uuid": "2e12d286-f93d-4e47-ba1a-d4af05ee6a4c", "comment": "Malware payload (RedLineStealer)", "value": "66ab0093fafdfecb88020e1c19f9b6b63b9b21e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408077, "uuid": "c2f4ea87-b9c3-48a8-b3b4-6d1416ba5d90", "comment": "Malware payload (RedLineStealer)", "value": "807f911bd7dd79f49681a0e429e0cbbed17a16d688fd62afcf8cf8eb3a3489586824429641e4808bb78d47756d89c49e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408077, "uuid": "3bedee85-6e99-4bc2-8491-ee06faf60dcd", "value": "T160840287B7E88432D8B51BB018FA07C30E367C62AD74836B6745AC4A6C721D4E57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408077, "uuid": "cce72e81-7593-4454-b69b-d1cc128069ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408077, "uuid": "b0c42d1a-2bcc-4f7b-900f-795cd05b9eaa", "value": "12288:EMrXy90B7JDBn7tUZ/A5T+SFWgBYCINNQ:rygFZtUZ/k/z8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408077, "uuid": "d748413a-424f-479e-ba0b-298dd46fe500", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408077, "uuid": "9efa2956-5bbc-4640-80bd-30893e5f7498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408077, "uuid": "c429d810-bc43-4ac5-a189-3b592f5f5a51", "value": "a05227e08c9813b78ddf7a869b64e8a78789257e0bafd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16cceb6-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385629, "uuid": "9f28e81c-9025-44b3-8b8f-66128266a830", "comment": "Malware payload (Formbook)", "value": "71ec97501d959694bd688c4c9472b0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385629, "uuid": "1db6c877-47c6-4742-b960-cbbf05a9eee5", "comment": "Malware payload (Formbook)", "value": "a06ac680f7c3454cdfe9e777f1dc9e6867e3556d323986c428aead576d2ede5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385629, "uuid": "ca969925-c4ff-497d-ad0c-9f0a66a92483", "comment": "Malware payload (Formbook)", "value": "cd6b6ba6462f1abbb481808f11b17ee3c0083ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385629, "uuid": "d09f581c-d3dd-48b3-8c26-676f4d023221", "comment": "Malware payload (Formbook)", "value": "ca81931e1be381c68363ae0d826bd238f27db388405b32a5c035ae4b8ed9ccb3a9d817ddfa1eaf72a7bbfa76725f57de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385629, "uuid": "0a42fe50-4e68-45b0-9687-728475373807", "value": "T122D4122173EC4E3AC17FA7F6685044510FF0AE651332F3482F19A6E84F35B656A99B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385629, "uuid": "55b6d6a2-64d9-4e1d-82e1-844878ee9766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385629, "uuid": "ca5064e2-6793-4cbd-98dd-3b671c5d555a", "value": "12288:AXPZ7uB4RqqAbvWSIaEKF1IYowAgxE4RWyXGJo:4DYfIrKPYq0KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385629, "uuid": "efcf8f1e-8f91-4f17-9d9e-75f1ccdce9d2", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385629, "uuid": "4bbaecc8-fabd-4a8a-869c-0afeda39ac97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385629, "uuid": "c185586f-2400-4260-aa5e-924f11e2b1a7", "value": "71ec97501d959694bd688c4c9472b0de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fab7ac4-2b97-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690363964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363964, "uuid": "a7bd7eff-49bd-488a-9f14-e3086296891c", "comment": "Malware payload", "value": "a62a11a1ee413aec51d3779833ec9709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363964, "uuid": "da6a440b-b0fd-4d51-ae9b-a8239467ac61", "comment": "Malware payload", "value": "a0761890c1f033fb333ff83551bd797bb0185eb9825327982ebe29b5383870f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363964, "uuid": "63d5cf2f-b46b-422f-8dd1-7cc570c4f346", "comment": "Malware payload", "value": "5cbb5f8650b90ec1d44cd2d6f6fbd736e2cf8f8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363964, "uuid": "146dae13-05a7-466d-bad7-1c01e4df14e1", "comment": "Malware payload", "value": "edd9b017e6fb948e39843c0559188e574d8af464c476ab6eb15f684c09262929446725be4d8238ce243e01e8f1c37616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363964, "uuid": "986e110f-bb71-4967-80a8-40838d58bb96", "value": "T1DFE633592142DEA9DA7D5DF340A5D7FB64B89E738F48236173508706B8B2AE40B0713F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363964, "uuid": "25dc6fb9-e23e-4a3c-8e1a-3b90fee25f83", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363964, "uuid": "d0be64ae-6655-432a-8203-8a1bd08b1f76", "value": "393216:vvBMqL4RGUAaZj3ooBvm6eNdX06p+C5kYG5hqnMb:vvCqnPEjTm6ega+C5Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690363964, "uuid": "4e1e27da-13df-4a62-9978-d58514eaf460", "value": 15215065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690363964, "uuid": "bd2ed54a-2a48-4a28-b470-6ab6b2237047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363964, "uuid": "fe2e4247-20f6-447d-b1a3-ea0adf909c33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a897ba8-2be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690397831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690397831, "uuid": "21c9f0cd-0c89-4d69-8497-d715644256e9", "comment": "Malware payload (Amadey)", "value": "098895f81ddd26f7ec7fa089ae743548", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690397831, "uuid": "91d82a9f-a29d-40b1-a684-2822b91544c4", "comment": "Malware payload (Amadey)", "value": "a0ed11766430f0d6aa62c640dfd7516381fee46b35264f5bb8a48327e592fa82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690397831, "uuid": "182dc7e7-25e9-406d-a976-84cdec63e38b", "comment": "Malware payload (Amadey)", "value": "54ea18fa80fb0b0f9d61900ceea88cec8b011acc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690397831, "uuid": "cf335510-3d45-4781-9e58-ab9ddc5b7428", "comment": "Malware payload (Amadey)", "value": "39ec261770cbcf8797ba718b0643cf91899687a1ac28a446ecb8b862ec7f7d0ff307b895d1db59b94f48d50a5828bf68", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690397831, "uuid": "e340fb97-8d11-4db4-a5c0-9fb31c92a770", "value": "T13BB41216F7E98177C8B91BB05CF607931B31BCB1CE3886273784680A5EB3694A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690397831, "uuid": "cf2bf341-a5f5-4922-b21f-c35cd4c5e167", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690397831, "uuid": "bf158414-c02b-4000-b758-f70f52c9f95d", "value": "12288:6MrTy90xSpCZGd+Y9CbKHkEnesBTwaoAjqZjeGpRC/qi:JycMEGX4bKHRwaoAXGmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690397831, "uuid": "d360b149-7d3b-43df-8e0a-16b0fab91f1f", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690397831, "uuid": "de2103c3-f387-4f27-96ee-b86f55253c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690397831, "uuid": "015cc1cb-2543-43a2-9f78-6c5b0408ed27", "value": "098895f81ddd26f7ec7fa089ae743548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5691f43b-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356647, "uuid": "cf7a1ba2-139e-4e61-90a8-789e624644bf", "comment": "Malware payload (RedLineStealer)", "value": "cb619c355d70f1e90da101782d8c62f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356647, "uuid": "eb6afd5b-780d-45cc-b243-aadc603313c4", "comment": "Malware payload (RedLineStealer)", "value": "a145720ad5a7f9a4fafcfa11fe248b7a7e35b8d0b2c83e5c999c3b3429828a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356647, "uuid": "65463830-6b5a-4960-9917-4a88042903c2", "comment": "Malware payload (RedLineStealer)", "value": "4a5a42df302eba0f1bceb2d27e7b2ecbb12e5a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356647, "uuid": "1cb8e447-4aad-4545-8be0-785eb5b97b68", "comment": "Malware payload (RedLineStealer)", "value": "da0263c47b44e014cec72e616bec90546d7e31a9718732eb4e4cf627ffc20310e2222eea3b51ed83fcadda44a8b691cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356647, "uuid": "4bc24c60-3fbe-4653-b36b-4814b4dd9ee1", "value": "T1F2B41203DAD54033D9B927B05CFA17970E3A7CA25DB0875B279A695B0CB35E0A93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356647, "uuid": "0016ce92-c346-47e0-80f5-d99911dc79cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356647, "uuid": "4548ec92-7e93-4d1d-a4f7-2cdd0c297913", "value": "12288:1Mrry90ybFl9xP1fz1DJW6XO6Y4RL4WuFex:qyz93tBjrJtWex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356647, "uuid": "9681b8c4-eaa8-4637-8e01-d44c47b3b3fe", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356647, "uuid": "df3b7da1-ccd6-40bb-a578-c2a6215bb935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356647, "uuid": "a90ad76e-1baf-4f30-81bb-189ad389e643", "value": "cb619c355d70f1e90da101782d8c62f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a911c1d3-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690379978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379978, "uuid": "dc9bae03-79b3-4264-b693-942045228cf4", "comment": "Malware payload (Mirai)", "value": "5f95b145a8dea1412819db200a0696ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379978, "uuid": "70cb2a2e-5088-4e86-a6cd-0d36262af7b4", "comment": "Malware payload (Mirai)", "value": "a18572549d6b6d854ef41e38cafc2e41083523f4dac749dfc4f3f850e757298d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379978, "uuid": "87628cb9-67c6-4ffe-802c-ef2361141fbc", "comment": "Malware payload (Mirai)", "value": "846e414a3fed9c32bb6a5d8a89425a3660597104", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379978, "uuid": "0bfd5dfb-d5b2-429c-8804-0aadce68ac09", "comment": "Malware payload (Mirai)", "value": "c8afeb3f756f8593d449ba21e76e3492f4f73c2576f227c52a81ef16b1a64e96209ac5c5e5b50299fbc42248f12ac20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379978, "uuid": "de2d6bc7-fb49-4802-b69c-166fafcc4059", "value": "T182534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379978, "uuid": "d0b08553-6948-4df7-a3d4-c7c255f1645e", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG9UmtTy5EMcJ/J9iSzEv2xRgN0L6FV+tg6wWv:+5HAdOmGyZtTAd2iSgOxRgN+e+aTWIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379978, "uuid": "182ad575-0d51-43bd-84cc-8f8589a9ea72", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379978, "uuid": "51ffaa47-1704-4ed7-8c50-9e83ec84cdaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379978, "uuid": "6f7e5ac9-b472-4329-bda6-cf747abd76e9", "value": "5f95b145a8dea1412819db200a0696ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795338d2-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350692, "uuid": "26cffdef-aa1e-4413-889c-fc718f4eca75", "comment": "Malware payload (AgentTesla)", "value": "e14478aeb2442f3f1cc39c47e23220b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350692, "uuid": "9794e7fe-dfbe-422c-b86e-5873aa8464be", "comment": "Malware payload (AgentTesla)", "value": "a19c0c04a2c24a58561e7e3ac33044236b7978c2b7f18958e52af6a37705b6b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350692, "uuid": "b2da43e9-f101-4bc1-9caa-c00be35e74e1", "comment": "Malware payload (AgentTesla)", "value": "6dbd1197c601b0b154a983fe51a9fcfd1a84824f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350692, "uuid": "c8db6d29-ac94-43d5-a586-0ba69d127886", "comment": "Malware payload (AgentTesla)", "value": "baa23159602ed5dbc03c8675570d912b8d7f38a3e7c583bcd5a74b3c8232023414282c46619a42743df6d1aecf93f40d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350692, "uuid": "a5cfd1bc-07e6-473b-b702-669194d1a046", "value": "T10B256DD1F1908C9AED6B06F17D2BA53024E3BE9D94A4810C569D7B1B66B3352309FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350692, "uuid": "f72e3c03-3c47-4fc3-a10d-829cbe1b67e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350692, "uuid": "5cf07e30-aaea-490e-9c4b-d2db96c6aa21", "value": "24576:9f1xULUrxslAECRKRn3HK1l+O6nxNU5T1:VTbrACRKVOlC25x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350692, "uuid": "77f6320e-6c58-4a65-948c-7a67c577e740", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350692, "uuid": "e8a9d79b-1745-4f2f-b275-90e99db77cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350692, "uuid": "f8d21f79-1401-476b-98e9-19fa8756387b", "value": "ORDER#260723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1312076-2b53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690334895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334895, "uuid": "5c55e8a3-1b99-423d-8a8e-bb868d4a00eb", "comment": "Malware payload (Loki)", "value": "abb55f97755bbc75386f340ab48821cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334895, "uuid": "24e94006-b6fc-44bb-ab80-c7a90f991c23", "comment": "Malware payload (Loki)", "value": "a1cde47a700a9372c2de3c0566c895812dc3d9b7dd77e14c282c2e00611b436c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334895, "uuid": "493eef36-6760-41ae-9e2c-5fa28d456590", "comment": "Malware payload (Loki)", "value": "0747962ebd8fb775591b15f2a885470c79b584bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334895, "uuid": "d0c52ba4-6703-4f9e-ae62-b59ffab5847c", "comment": "Malware payload (Loki)", "value": "353fe717c2175076193f99f32643044ef853b6551a72fd65412d231dc42c12e7d9ed6b96d6ed0e3367d861acd6065c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334895, "uuid": "c426058d-181f-451a-8893-e564ba70a356", "value": "T1AD44BF223690C032D05399315971C6A21A7ABCF3EB7496CB33983E3E6E712D05B79B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334895, "uuid": "d39888b1-f987-4c06-af35-f3ab8a517c49", "value": "5ea05395629dd7cfa2fe7ed080de0303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334895, "uuid": "258e0e48-b177-4e53-afa3-3bc6d9ca622b", "value": "3072:OU1oxM31+Vg/ElDLPxWtna4ySbvky/KkTSmvVSwIgITHTgz:eeFIg/sDzxcIuvNPTSmvVSjRTHTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690334895, "uuid": "f560949a-252e-46e6-a588-f6d9d686bd19", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690334895, "uuid": "dbda5a5c-e81f-4938-9de9-775255e7b8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334895, "uuid": "165b26cf-0303-4f91-b4b3-763062ace2fd", "value": "SecuriteInfo.com.Win32.PWSX-gen.8115.29341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e99ca65-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690351426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351426, "uuid": "b1ef759c-4cf6-4bff-a11d-d983bf45105c", "comment": "Malware payload (Formbook)", "value": "aca9400dd47cbe30947c1164c80106bd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351426, "uuid": "e7dbc608-6460-4ca3-9d24-986bab530b21", "comment": "Malware payload (Formbook)", "value": "a1f5fcb4cb6542a83d15f3c9475050b0a38e2557d4d0b4b22c84085016b9f575", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351426, "uuid": "10907284-d25f-43ac-aeb9-2b12770c8b61", "comment": "Malware payload (Formbook)", "value": "67d3c4830fee6fe5ec46473aef3fdb1eff605bb4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351426, "uuid": "46706124-d5ce-4771-a098-176173f66a1d", "comment": "Malware payload (Formbook)", "value": "d8f2ca232496cb6842d3e768de0f70079e1f7277e1431a03fe3695ed01e890dc989b5fc8b6a6c02fdd3b59642cbe2269", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351426, "uuid": "a78f51db-cd78-4116-8a19-9a3c9207d650", "value": "T1F834237610EADB498C66F25B2AC215BB4DA3134C56FED4AF998CA3D30ED58C370C91C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351426, "uuid": "f52b9db0-2e71-42c2-904d-cbc0ea1ba830", "value": "6144:veehPctTzoMrZxM/0sXQKEsWT/kMJQwEAYVFt2gVBuoGapjyDpc/Y:GScpzxZxDfT/kHwwVFt2OBl+QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351426, "uuid": "e0f6da86-228d-4804-b266-7cf86087e4cc", "value": 245067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351426, "uuid": "edb9a8a2-ee9e-4ea5-887f-bf0543e52587", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351426, "uuid": "dcb41c38-987b-49a2-b911-cbaa296a406d", "value": "Order inquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd371d7-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377735, "uuid": "486f036f-a9d1-4c8d-bdf4-31a7934272f2", "comment": "Malware payload (Mirai)", "value": "9f7ad3e347b45d723c4913b6666803e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377735, "uuid": "15ba3d3e-3951-4ce4-9ead-54538bc4148c", "comment": "Malware payload (Mirai)", "value": "a21196e87dcc49505517aa11489d8855aeb49d35199ed026f88be6cc712e4bcc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377735, "uuid": "c2f20d1c-bb33-43a0-9167-a16abcefada8", "comment": "Malware payload (Mirai)", "value": "0a2a757a8b11f68afa392ffc6c998ee5b79d4dd6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377735, "uuid": "26b0365d-f569-412e-9cd2-cf1e1fc43857", "comment": "Malware payload (Mirai)", "value": "65a6e680a8ca46d7133df7d49bcbbed70306ea854d83b62ec17299e8e55baf0b4703aab9ec5f8056a4ca7e5ded6d27a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377735, "uuid": "6b0af897-494d-42a0-9da2-f09c8a2b5baa", "value": "T1B4534B17B54280FDC49AC1744B2BBA39D93775FD0378B2A677D0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377735, "uuid": "9588ca55-e90a-41dd-9cfa-7fabd9bd2c8e", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQWLiKimfFoktCe3fYRME:WShU3q7cEDlCK/0DO9i8Fok06fYRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377735, "uuid": "7ecd900a-d274-447f-ba74-72a3f2ae6136", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377735, "uuid": "7813e1b9-c689-4cde-a296-47f1eedb32b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377735, "uuid": "43a10f45-5628-47d2-9eef-8d59259847f2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7565fa65-2bb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690378603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378603, "uuid": "671b2613-bace-493b-aa13-f55a79c13c6f", "comment": "Malware payload (RedLineStealer)", "value": "415bd6336d23bb7e7b4e1dbe1365789b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378603, "uuid": "40b49020-943c-4622-8a92-2ce93a3d3f75", "comment": "Malware payload (RedLineStealer)", "value": "a21bdda20d26b32b4cfa812e1fac5d568d732ab561c3f0a7977d5c51f9bde469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378603, "uuid": "15b7f695-ce99-42ad-8093-0c55af536a4f", "comment": "Malware payload (RedLineStealer)", "value": "c1ac42a19a44abfcae913fef072ca17300cd0eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378603, "uuid": "362979dd-1729-417c-b188-7be8281f9923", "comment": "Malware payload (RedLineStealer)", "value": "903316d98c6ce8ca4e743f058573d5ddf51dddfa5d8167ab3bdac4d04f1ab94dc31be5a0b7a8d7bfb1552129d347c357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378603, "uuid": "e6ff4b06-4b1b-47ff-9e08-d60a4b84b6c4", "value": "T168F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378603, "uuid": "99ea0b3c-9519-4d8e-a50c-73d0332e2cc6", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690378603, "uuid": "d58fc603-96fb-4ed3-bbc6-5b86519af5d2", "value": 34267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690378603, "uuid": "2628b30f-4b28-4e4d-b542-8ba59364bb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378603, "uuid": "9bcd5495-ec10-48d2-b1e7-6580468f0c99", "value": "415bd6336d23bb7e7b4e1dbe1365789b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab07fbcd-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396302, "uuid": "0372509f-31f8-4df4-92c7-6dff6a5e8af3", "comment": "Malware payload", "value": "e9fa21e77877a8bc864a409cdb08f6d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396302, "uuid": "99dd7f7e-4d0b-48ee-b27b-1ca49c0f764b", "comment": "Malware payload", "value": "a21fc650d39de686d152a1920814ba7e7dfb07888bafe04b3a11ee91073ba8f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396302, "uuid": "653c1ece-55b5-4047-a7bc-461befdcba3e", "comment": "Malware payload", "value": "394b0f5d23aca6d96869909e08bd86a8ef3e9612", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396302, "uuid": "49c4dd69-6708-4f26-9128-5ee5ed73156f", "comment": "Malware payload", "value": "bce11f9a5249457074ec553cdc53890407a3308117cc07a4cb161cd542206fa598029d94dd9c7556d2f102eb2d231c5e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396302, "uuid": "0104e2c6-0a0a-4e5b-821d-8282263ed0cb", "value": "T1ADF57D13B3DC203ED06F0A3A4877E665983F7A217A1A8D5B77F5284C4F352522E3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396302, "uuid": "3fb0b602-ddb2-4bca-923f-d88bd9cfba87", "value": "8952b8c553b4d515b8f05953bcb35c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396302, "uuid": "d69e44db-42a9-4734-a656-2e2edd48551f", "value": "49152:nhpfv0QTlSzNSVBaW3AukE7rYHcSp20Ew0ThrRrq:nfEgpQaH2p20EjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396302, "uuid": "30e2c8af-4b89-4bb4-95d0-a2b6d0cf22d0", "value": 3403784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396302, "uuid": "d416319b-c6cc-421e-8e57-ef5c5d209528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396302, "uuid": "5753a9b4-b405-4f9b-a5eb-dec2fd7891b1", "value": "SecuriteInfo.com.Adware.Zaxar.111.26474.31777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c577abfe-2bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690381314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381314, "uuid": "be04cab1-7f7c-47b9-8516-89ed587d451b", "comment": "Malware payload (Amadey)", "value": "b48e81984f935c6655c03f21e7ff18e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381314, "uuid": "982b75a4-1549-4639-bbeb-be830ee5c49e", "comment": "Malware payload (Amadey)", "value": "a27264d64d1dea7cb707555095e749ce26f060ab64b75d911c691dd274be3714", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381314, "uuid": "f6ecb744-1f94-438a-bec4-07d218476c30", "comment": "Malware payload (Amadey)", "value": "f2ac9f31923882a036b1deaeb11bdfffc8c77fb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381314, "uuid": "aa26c6ce-e214-4620-aac4-6472e78f692e", "comment": "Malware payload (Amadey)", "value": "670590227257c40a6b0f152f6eb0abcc6bb024d89eccba99571d8cf7616661a37f6b026e295f1212a1e8e6797abf6a97", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381314, "uuid": "e0c4bba5-70cb-4a75-9799-99b71db3b338", "value": "T1BEB41242E6E8C132DCF5177054F613C71B377C926DB4936B2294A98E1D33BD8A8713AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381314, "uuid": "02107649-6536-4fbc-99b0-4c2d0eadbe83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381314, "uuid": "ba2c5d8a-68c6-4c12-ab7a-c9ae1437b44c", "value": "6144:KFy+bnr+hp0yN90QES+tlv8NrazGlXsf3VYhxC6XAkWxjZNGQRWt9nPWb0uDtrlQ:3MrBy90jqkArhPWb0utwv0lYkAxvL5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381314, "uuid": "a141f2fe-a0ee-4cfa-b616-24106e4f30da", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381314, "uuid": "86d69501-ab23-4ca8-8c45-1e791220e988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381314, "uuid": "d4d5b3b9-2abf-4850-bfb8-02b7dbc85360", "value": "b48e81984f935c6655c03f21e7ff18e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975cae17-2b60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690340435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690340435, "uuid": "c3edd772-ecb4-40c4-a57e-1564d3275fc6", "comment": "Malware payload (RedLineStealer)", "value": "d15734814fbe9f4b5646afa23e8dfb44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690340435, "uuid": "629f9ffa-96fa-4c64-8557-cab935fe4ea0", "comment": "Malware payload (RedLineStealer)", "value": "a2a43fdfe04d1f17342be55cd041234faeb16291b51bf4591c98b6f57bcded71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690340435, "uuid": "4080b0b7-f0e1-4e7b-8fad-bfc1608afcfb", "comment": "Malware payload (RedLineStealer)", "value": "5d5f89279a46e32872984da5ec8e9d4996523193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690340435, "uuid": "f7f58bb7-05ef-448d-bf96-69ff37aaed2d", "comment": "Malware payload (RedLineStealer)", "value": "deb5cd25e2eec0c9f0793568073b585aa45a79d963b30287b1e59f4daf0bc4531183a69bb28b53ac2681ed3f4f80c5b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690340435, "uuid": "2c5c4a93-e3e0-4a6c-b4fc-22be863e5bc1", "value": "T1F8840242BBE84032D8F527B058F606C31B327CA14E75966F3786A85E1CB36C4A97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690340435, "uuid": "5dc1a27e-a4c6-4c67-b68e-982e8c7c7cee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690340435, "uuid": "7dc9b434-ca47-4fff-8987-2cfdf4b91b32", "value": "6144:KXy+bnr+Yp0yN90QEpdfwHtexmoVmlu/Uy/ceul4LFzgBZ+t4gD6qK:tMrEy903dfwNOjVWkUxelFzgBYCgvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690340435, "uuid": "85a284a7-8f04-4867-875f-a8890e86a838", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690340435, "uuid": "c6ebe8d9-e409-4b82-a079-d4d1e17535bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690340435, "uuid": "2e0f6b19-af36-405e-9539-f6062fe84dfd", "value": "d15734814fbe9f4b5646afa23e8dfb44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089b95d6-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408056, "uuid": "43a2c0a6-574e-461b-b2d6-fcaafda9db2c", "comment": "Malware payload (RedLineStealer)", "value": "8dd39449e98f9ea4edf4c974c3e2872f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408056, "uuid": "daf43dfc-f9d4-40eb-bed8-e89e9095aa83", "comment": "Malware payload (RedLineStealer)", "value": "a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408056, "uuid": "4607d1c2-c78d-4a4b-ae06-2143d92d6d75", "comment": "Malware payload (RedLineStealer)", "value": "63c02fe8b295561277d33792a921ae770ba34afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408056, "uuid": "ad009b0f-8b65-4449-9b06-33cd95b821a3", "comment": "Malware payload (RedLineStealer)", "value": "96e9b9ab0b71e99d77e3d1a24fd48f44797a0f9acaddb818288d27ac26bc76e0526c0e744c2cba986b33416f02adf60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408056, "uuid": "b8d319f9-5e8c-466b-a9fe-cb6f4fb0d879", "value": "T144840213B6E95072E8F61BB048F603C3163A7CA26D799327275A984E0DB35D0B93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408056, "uuid": "d599f91b-d621-45f9-8bb9-13125a8936fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408056, "uuid": "7b81aaa0-1809-478c-a93f-dde5ba8db6ac", "value": "12288:CMray90Yj7GRDUyI9Iztzkdv0u44ENz0Nl:gyv+tU79ACdTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408056, "uuid": "c713e545-8f45-4aff-af8d-95570b90765b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408056, "uuid": "22f5dcd8-8cde-4535-a631-79f894fc4b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408056, "uuid": "b22a74f2-23cb-4dac-be82-ca19804ebe3a", "value": "8dd39449e98f9ea4edf4c974c3e2872f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a5e083-2bde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690394552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394552, "uuid": "6453769d-7a98-4807-9d20-33549f81989c", "comment": "Malware payload (njrat)", "value": "0f9ff9c1bc598da888955f9c30381875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394552, "uuid": "0840dd9e-9f91-45aa-9341-b881fbc927e8", "comment": "Malware payload (njrat)", "value": "a38615f23695e606dc5fcf8bf3af12d1cedb95632785ab643a7766e09885e18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394552, "uuid": "1fc7dfe7-767a-491a-ad6e-7f435bf1f29c", "comment": "Malware payload (njrat)", "value": "3248eead5f18f40e22967099bd4f0ba4641ca9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394552, "uuid": "67f9981e-1818-4ff4-8e58-bbd6ea8853af", "comment": "Malware payload (njrat)", "value": "a9d7e43062bda339827a70f7dfc1bdfc68d7e7447ce00ac070322b25b48f78cde0723f562bb401edd7987e39cc3e667d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394552, "uuid": "708dfd37-e678-4fdb-bc1c-46a9be2abfa6", "value": "T11E032B4D7FE18168C5FD057B05B2D41207BAE04F6E23D91E8EE5649A3B636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394552, "uuid": "1ee0bee5-e0c2-4461-94a5-206cd85bd46d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394552, "uuid": "404cc318-26e2-46f7-b0b2-a3bfbdf9a8d4", "value": "384:wNOKMizdJjnBhFbJ8ycPCojPjTwNsIterAF+rMRTyN/0L+EcoinblneHQM3epzXq:qOgJlLJfcPCojPysIorM+rMRa8NuD0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690394552, "uuid": "e207676b-7323-45bd-91e7-3808b99621a2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690394552, "uuid": "a6bd374f-d6fa-4d30-9e5d-d819aa92cf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394552, "uuid": "fd63b029-6b68-4246-a98a-de31b7f1b240", "value": "0f9ff9c1bc598da888955f9c30381875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e804df-2b9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690366876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366876, "uuid": "f0eb7989-3d58-4a19-ad97-dc09150ed271", "comment": "Malware payload (Amadey)", "value": "2787425c84cb147c6907ca4714b603b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366876, "uuid": "a5a7bbfe-ad46-4f69-b2e3-d0176235be48", "comment": "Malware payload (Amadey)", "value": "a495d2640ed9e2c33a67f1963093404851611f47ff112a65c45bd58e3cd997eb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366876, "uuid": "14300eb2-ee2d-4a4a-9636-832673ee8377", "comment": "Malware payload (Amadey)", "value": "1c0f323057ec0b96cf840ac3a64735e6e9fb2408", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366876, "uuid": "d3f37ce4-2184-471a-8879-cf831bc2c895", "comment": "Malware payload (Amadey)", "value": "3cbc5786190825a39c488e776c8844c569b917f2b239742afdab9f641981a123b3b9b9d346dc2bed9b43ef59be2f0023", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366876, "uuid": "47d4be1c-6d45-43f4-b684-0487ce877663", "value": "T104840143A7D99572D8B507B0ACF706830E397CA698B8876B23859D5D0CB37C4A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366876, "uuid": "6858e061-95ad-42ce-933b-390539a7cdd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366876, "uuid": "d989a425-1f5f-4be3-a21b-ef4cb3e923f3", "value": "6144:KWy+bnr+Rp0yN90QE4/aurASZo1eccO3LXSYblZbFGZGpZDdfe:iMrNy90AfGei3DrlZpG2ZRfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690366876, "uuid": "8bb6cda5-4984-4ab3-b830-eca66e9a8fa5", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690366876, "uuid": "1f7615c1-fac0-43ac-969e-85ada5cfbfa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366876, "uuid": "41178ae3-2757-46ae-b019-632303cc440a", "value": "2787425c84cb147c6907ca4714b603b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a11e69-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377748, "uuid": "d050008b-ccb2-45e0-b646-ec0679a07d57", "comment": "Malware payload (Mirai)", "value": "bf985f2a3154d0de2f4dd7b9c44d22c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377748, "uuid": "63a70b10-b1d8-409b-95d2-2756c357880c", "comment": "Malware payload (Mirai)", "value": "a579aa9c598ac83cbffcc61ad72a7eed026a7345d2acc1b3dbb71f749643f793", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377748, "uuid": "b5163359-c941-4299-ba9c-30039d15a8c2", "comment": "Malware payload (Mirai)", "value": "80bb6f0fab1a67c7714eeba5dced45b144543132", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377748, "uuid": "6fe16b99-4d7f-440c-85db-3ff418355236", "comment": "Malware payload (Mirai)", "value": "818f615f63d4483da67c799688b4a78c120f389c37820ca917240955d43150d7f7fcafe0d0cdc547d4391eb6d6120844", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377748, "uuid": "847abd83-fc93-48a3-a0ee-408679aa17a6", "value": "T1EB03E751BC829A67C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377748, "uuid": "a3b949f9-22a3-4d4d-9596-b18a82ba27a2", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTF/NYwW:svbUG5fPlUlDf4Sycv+PUWjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377748, "uuid": "7a7b9d46-3d99-4681-ba85-fea00f8f01ce", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377748, "uuid": "151cabb6-64a6-4e63-bc74-f8e288b829a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377748, "uuid": "d20fe3ff-e71c-4f94-b4a3-0b9d70444559", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d83c4e2-2bde-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690394347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394347, "uuid": "812d96d9-c579-47bf-aaea-3120f980e790", "comment": "Malware payload", "value": "660ea9b8205fbd2da59fefd26ae5115c", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394347, "uuid": "6be4ebce-fccc-43f6-a30a-e187ec93ae9b", "comment": "Malware payload", "value": "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394347, "uuid": "76eec086-3dce-4910-aaf8-da58ffa0afc3", "comment": "Malware payload", "value": "769383fc65d1386dd141c960c9970114547da0c2", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394347, "uuid": "8df79b03-b6b8-4bbc-8a7a-9a9a9f12007f", "comment": "Malware payload", "value": "ba59e7ecce86eb6aad60538dbe40066f502f1e8c8c57fc867fccdb8a100278de1a561d833460d26c9efac31cbf9a6f52", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394347, "uuid": "1455a7f1-0ad0-4843-938d-9d47be71437a", "value": "T1E536D006EADD252ED585F23C8ADD9733F121B4448120E35726D0FA64AE7AFD06F1A336", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394347, "uuid": "34eea721-4a7d-40d9-8d58-7bc087b9b537", "value": "49152:1bCjeeHVg+n0xtI6o+l85rfkYzh9PWAmDZVsTHxcD2fsaBNfWngI3/6zsBb+AnyJ:1bDP8hfkYVb/Any2Nk/nvujgjMMFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690394347, "uuid": "0b96f695-72ed-468d-a175-4f9b2870addb", "value": 4979136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690394347, "uuid": "d957de53-56e4-4473-b130-62cd9a436636", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394347, "uuid": "7613618a-725b-4a7e-9854-7252a9a6a508", "value": "maco_fat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7649c9-2b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690367478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367478, "uuid": "acf9ac45-4842-44de-98b2-4aac612b1059", "comment": "Malware payload (Amadey)", "value": "f7e21fe46471f2c2ed069aef315b7804", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367478, "uuid": "a17f4bc2-bae1-4d56-ae0d-b81f0261802a", "comment": "Malware payload (Amadey)", "value": "a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367478, "uuid": "3ff74560-1d75-4ca0-af48-7ea5f063b046", "comment": "Malware payload (Amadey)", "value": "dd6a5df8e71397f470e69c76f39d1c0cc9005028", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367478, "uuid": "6aa85e26-4998-4f0d-b806-924408b0fa58", "comment": "Malware payload (Amadey)", "value": "a7af99c74bd070ea5b348b015bf4a738ebefa79c0ca49a9c1e7e60a1905b624bcb1baf74a7a40098774fcf3d509aa80d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367478, "uuid": "0ff2186a-3d8f-4838-8260-59f97de3db40", "value": "T1B1B41243E7EC9037D9F51B7068FB02931B357C925D38862B2396A84E0CB2694A77177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367478, "uuid": "28ae56a9-fd80-4267-8cce-fe4c90104d6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367478, "uuid": "1f5362dd-0413-4560-9656-085f24ea7fe0", "value": "12288:fMrLy90LKDglCRXwYt1wZvidrr2fIfvZVHex:MybklLYvOvqWIZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690367478, "uuid": "5b4606a0-1166-462a-a277-f2f8bef3cbde", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690367478, "uuid": "a89a1ab5-a50e-46dc-8fdf-1acbf9dc0a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367478, "uuid": "7a5cd0eb-9e2d-4d27-ae2d-3fa5e0150c6f", "value": "f7e21fe46471f2c2ed069aef315b7804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fab025-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690364935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364935, "uuid": "9059908d-ce19-440b-a7f6-55af425d6bf8", "comment": "Malware payload (RemcosRAT)", "value": "7c75d25fcb55e27a84dba451969ba2e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364935, "uuid": "2cc4e4ca-74a4-4179-8620-723b6f8aacb1", "comment": "Malware payload (RemcosRAT)", "value": "a7689613c1984ba66e760376ffb5edcb6f9925f6cf8796d7f0bacd2d8905c55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364935, "uuid": "16eb0f8e-2922-498e-ae9b-a2f2d05dda9b", "comment": "Malware payload (RemcosRAT)", "value": "1404da15e8356cfd3ec8774a2e6054b25ea0e1cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364935, "uuid": "bf5f648e-1b25-4ad5-aff9-83622619e23b", "comment": "Malware payload (RemcosRAT)", "value": "d1ec77cae90ad6c7179f44526061fb3cefba5f00849e9337c4a2ad112552b437ae567e71e6b1753f74b2aa96c62904a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364935, "uuid": "aa8564c9-8799-4b31-a30d-d6fd0f777d3e", "value": "T14FF4BF36791F9C22C34C173AD2CBA604A374CB8152D7E64B3AC903AA55037DBE959BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364935, "uuid": "9b884228-4942-48cb-b5e6-53edff5fe79c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364935, "uuid": "478d6e19-f00e-4334-b520-98e09f0efcc8", "value": "12288:kvn6bd+WC11PUL4GynrfD3RFIJFd15rIu5w7jznIxk0zchhgJQ1YFsaRlyS0:kSxGPq2+PVIyw7o5zcEJmYqQMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690364935, "uuid": "31da59f7-6113-4964-a3f2-aa589c208d73", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690364935, "uuid": "58903060-1304-4c93-8a48-1783baddbede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364935, "uuid": "cc2cc0c2-2737-4739-b1dd-b897ea9a5a75", "value": "7c75d25fcb55e27a84dba451969ba2e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1c8a82-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690378909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378909, "uuid": "0c710976-aedb-4319-b42e-be35ab46227e", "comment": "Malware payload (RedLineStealer)", "value": "cc2de309e1ffbe93d14be03feaada46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378909, "uuid": "e59c129a-e7da-4886-a1a1-f1e500246397", "comment": "Malware payload (RedLineStealer)", "value": "a89ea0795d79b2c0ee7deceba8f293e7bdf72c33f828004579e4e12f686fae81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378909, "uuid": "111728f8-3b08-439d-a46f-fcee7ec36d00", "comment": "Malware payload (RedLineStealer)", "value": "3e829e312d245721807eabf3e80beec5c98a6a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378909, "uuid": "8c015db2-672c-4167-a555-ab13e1b417b9", "comment": "Malware payload (RedLineStealer)", "value": "111a8df975db7d18c8255d422e4403040aa7a7b914995d30d92c6172464f3c34c69341a3b1a275911f288309cfed0149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378909, "uuid": "57e3a4a0-7643-4dce-b201-6de34db7bd4a", "value": "T1E4840252A6E89133ED711BB05CF707A30A367CA16D34831B3791A99A0CB36C5A47277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378909, "uuid": "eaa9a421-7745-4eee-939e-abf45abfea1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378909, "uuid": "8b326fd4-f80c-4a88-b2cb-5573be27da62", "value": "6144:Kuy+bnr+1p0yN90QEG+lJaEga8nOMxRA/+QYHjbLtRS1dBHfY4AKnxTCGA6:2MrFy907lJaEANDxfLFsxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690378909, "uuid": "6d13f819-0fe2-4f4d-88bd-12cca88be66c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690378909, "uuid": "76b40f39-aaf6-4cd4-a050-d5b00d3088ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378909, "uuid": "65b70f7f-0994-42ed-8fb4-7dcc88e59c85", "value": "a89ea0795d79b2c0ee7deceba8f293e7bdf72c33f8280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42282397-2bd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690388825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388825, "uuid": "037a5b49-6363-4bbc-b87c-b4a4c66dac64", "comment": "Malware payload (Amadey)", "value": "17a940225bb825fc2537f812f2c1beba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388825, "uuid": "bf5a4b06-e452-4078-9e6c-8bb304ba7056", "comment": "Malware payload (Amadey)", "value": "a8aabec72f00f1817329005f10915bc69e1d453fa4cc506157a0b2f51b714835", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388825, "uuid": "a641a7d1-8a92-4fd4-83a8-79c164fd9232", "comment": "Malware payload (Amadey)", "value": "bf77b9c60403bf471c0e4d5cb92140d7ec9456a0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388825, "uuid": "c9b7f3aa-7773-4a10-b366-6f499e84ce52", "comment": "Malware payload (Amadey)", "value": "6409f69e37a99aa1ab4ef7f51fd9447e58b43487809e5ac2398ae4f89f085cfed6ef7ff01c5922d8d05fb12c113ff40a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388825, "uuid": "4ab4d02a-a48e-4382-ad2a-e3520414a475", "value": "T1AFF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388825, "uuid": "f7d57f62-d6c2-45ac-881e-caab40a96e14", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690388825, "uuid": "9c228e3f-b39d-4ec2-a525-143b4ab55ddf", "value": 35030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690388825, "uuid": "cade1ec4-8a04-460a-aaf3-bab6ff758440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388825, "uuid": "3d904959-ab33-4723-9099-4d28a38aa17a", "value": "17a940225bb825fc2537f812f2c1beba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c399c2f7-2b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1690343086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343086, "uuid": "cd761682-1d2c-4b92-8d4a-0ea7961ddc41", "comment": "Malware payload (CobaltStrike)", "value": "e4efed1ac69b15ff3dfc8024a28eb967", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343086, "uuid": "5ba0c309-00a6-4837-934a-ed7fd765b47a", "comment": "Malware payload (CobaltStrike)", "value": "a92a6d6f59fd04e04c6f911e39219c61eb6013e6db92905796642092dc1ce3d7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343086, "uuid": "9f3d907e-32c3-45a1-a6dc-0de5e50d5a01", "comment": "Malware payload (CobaltStrike)", "value": "d528beac509b44305c6610640cc939c6e21fa346", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690343086, "uuid": "d423b84f-1e2c-412e-a515-f76741e54527", "comment": "Malware payload (CobaltStrike)", "value": "ecc315672cce301fcce5eb705491f886a23c9a4430269ab7f196c4da6c21352b4cc6f48028731b3d9fd779aa06874eb1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343086, "uuid": "13e0bd5e-e2c2-4476-aa04-d400962e6015", "value": "T176B35B9B77F530F9E5768238C8521A05EB76B83616609F5F03A403562F332E19D2EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343086, "uuid": "768b4e78-1e83-498a-9a21-ef43c96b4307", "value": "a909ce3dc0c1554a6489869514b92d36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343086, "uuid": "ac57d3c2-e56a-45e3-b2d9-60d5dbd29a11", "value": "3072:V6F1nkPsgo2qtM6ri5ITVTrf3/h/J5BdtEsh:Y3kPQ2qtre5IThrHh/pHEsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690343086, "uuid": "c0767d5d-e7b7-450d-9c47-78f9ff718eee", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690343086, "uuid": "2f293beb-89c8-4151-abb8-63fbb8112a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690343086, "uuid": "c76b8b91-f92f-478f-ac25-a06a40c3917f", "value": "e4efed1ac69b15ff3dfc8024a28eb967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b23ffd2-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350668, "uuid": "035f60ae-7839-4767-8c0f-203f94e6cd37", "comment": "Malware payload (AgentTesla)", "value": "4835892c035b5d75a7a67906519daa6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350668, "uuid": "64feb431-91e3-448a-afa8-31f21a2da3ce", "comment": "Malware payload (AgentTesla)", "value": "a99019e3753a7babc2108dc67c77be0d5914b23051b1fd7a07f2b3a3ba840559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350668, "uuid": "1326f89b-70ea-4aed-8bd8-f533592cd706", "comment": "Malware payload (AgentTesla)", "value": "7aaa82927f61f8780ce5a598df41ad9d4141ebe9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350668, "uuid": "3efee554-9b12-40cf-9dde-db63e9a3856d", "comment": "Malware payload (AgentTesla)", "value": "71889c41d00632398389be7a89ef051df282ca89f18bf28e346aac808169a3ee5df870f5444262e7c2eb7e2ed58fb529", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350668, "uuid": "9ee7e63b-6840-49a1-bf67-bee0b55bc2dc", "value": "T15C14021573E1C0A7D5B30EB11E7A6B79AFB7F4115490A70723C06E5E7AA3180ED1E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350668, "uuid": "d9830bc9-e4af-48bb-803d-bf143c8af657", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350668, "uuid": "fc251e96-c370-4617-b998-6adb452d76c9", "value": "3072:XfY/TU9fE9PEtuqbw/jjjl5TfvZWdI6WFLDjEHmIxtG3MU8nhhAmQb3i8DRBUM1M:PYa6awrjjXZJ6o0H3lhAh3iuUMpcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350668, "uuid": "0eea13bf-0c01-413d-86ee-77779ee917a7", "value": 194237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350668, "uuid": "08570119-98ea-4601-b3bd-5a3c781eab75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350668, "uuid": "8ea080cb-9a7c-47ec-bce1-7b13091e21bc", "value": "07-28-23_OSME_PO#PHP020622-001_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff7da74-2bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690381332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381332, "uuid": "253b6c9a-89f0-45c6-abda-58951edab93e", "comment": "Malware payload", "value": "26c2ebd09ae89301de7b64633e55afa2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381332, "uuid": "076e6379-62fd-4acd-8bcb-b48b6f0e7cde", "comment": "Malware payload", "value": "aa894bd41b0562141863832fc897d0b78d47d476b87b2079c8ec0d925a42907e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381332, "uuid": "ec667339-428c-476c-9329-fbff4435cbcf", "comment": "Malware payload", "value": "a87715e2c277521894c0c8792da8e71eaace7723", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381332, "uuid": "636b107a-b6ca-4021-a767-55072f86ec07", "comment": "Malware payload", "value": "b03bb488ed10cb6907556ff57f0129a7f7ff06b8532fa08ced110ff92699b757c01dec68b1fe5540031ed48905aed2d3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381332, "uuid": "9ab0c7cb-a5e3-4ec3-9040-6f1a510fe307", "value": "T12E45029EE8026F49C336D5AB0ECE98343C9B02BF5E929F17716578839FC098A742551F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381332, "uuid": "3e0597b0-d9aa-48f1-bef7-bf7388b67104", "value": "24576:YhHQDro2jvpK40IvmjKJkhXNSztr9JnQxGuHZz+tQVD:YhHQD9c40M+SEdS7AEtQVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381332, "uuid": "8a855256-2ec2-4a3c-868b-97cdd40a2d60", "value": 1224908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381332, "uuid": "a3f232e6-fc2f-408a-abf7-9b5a5101e93e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381332, "uuid": "dc7a7bcb-5f8a-4036-aeec-179bf5cc65cd", "value": "libcurl.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f5e882-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690365554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365554, "uuid": "687d2e73-d264-4b5c-be14-bf21f17d374b", "comment": "Malware payload (RemcosRAT)", "value": "bd51ced4f3cc4a28244257bcfe53e8df", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365554, "uuid": "e3e4c1b6-0cb6-402a-9a1c-a7cb340c25dc", "comment": "Malware payload (RemcosRAT)", "value": "aad4730a1866a7cee5b0dbdedf286b17e597b9bf59c06bfd405f234e64f52673", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365554, "uuid": "1974aba6-6623-4b20-af60-d0fdbaf1b7e0", "comment": "Malware payload (RemcosRAT)", "value": "ad29c280b65c341d0307ea72122bd14e20b2981e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365554, "uuid": "0934e130-6bc9-4603-acb2-57724434c8cc", "comment": "Malware payload (RemcosRAT)", "value": "10cb52c6a87df0bbdaef7dfa7bd29b8fafe8f214f7ed62262bc038b3bbb067d2f6f6270a9e4e045ac69245f9014ce982", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365554, "uuid": "31997956-820b-4874-b782-9ba456175996", "value": "T190842342A3989072EE7563B20D3A97BEEFE56A6D24035F4B07051D40BD23A83791A0DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365554, "uuid": "617ae99f-98b4-480a-b887-b4b4e0e40181", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365554, "uuid": "32228b16-ff99-4d12-b846-9fc25915c76b", "value": "6144:gpkXchFzzxsHwqN1o08zQqmOvjFsfOyzKgJEwc+IxXzcg+Zw4fLodL+3uS6DPET8:16nxEwzHNsfOy1JLPmDLiwOUV+3uzPEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365554, "uuid": "ea2adce7-85f4-4ff9-b79c-94ca9147117a", "value": 387576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365554, "uuid": "0814b829-d997-48f6-8642-c323a03c180a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365554, "uuid": "108dcbf5-cd5a-4a38-a618-1b4eddc11dcb", "value": "Dhl_AWB.Tax.invoice.kr22710368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b913328-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690385083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385083, "uuid": "c8386a54-60f9-435e-b242-217869b0271f", "comment": "Malware payload (GuLoader)", "value": "ded3c40a4bdb15573c1cd00502996e97", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385083, "uuid": "8414cdcb-2de5-43e1-a0a1-b340d3fc6449", "comment": "Malware payload (GuLoader)", "value": "aadb0dc2e4d6d475b6dbb2bb9065dbaa24a2d136951860340c066aa3391708b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385083, "uuid": "97243c04-b85e-4f06-b2d3-84fe06c9487a", "comment": "Malware payload (GuLoader)", "value": "45999a760b2ef978991f76595efabe7b063c1891", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385083, "uuid": "b112b414-ba18-4fae-bbc2-9118a2c04c61", "comment": "Malware payload (GuLoader)", "value": "b85280350736170dfb44815fe7c0303e37b8d8453ad9c8fe0188281b74fd9101d7d0703eb905f15a80b7a1511d7b0707", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385083, "uuid": "0efd50e6-67ce-4e53-8bfa-b9e3f1ed142a", "value": "T1E175F103E811DA87C50C87F47E2329D98B1B7F06E4956CDF15027FAB3A32762891E66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385083, "uuid": "74c1a93d-cb32-46d4-b4de-84983c886a70", "value": "49152:VcuPR6VdEFm6VoiNhv3tCQXXnAgWj+RC:Vc4mdVmoMhXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385083, "uuid": "a55f8d10-7746-4b01-9b9b-b1b95b3dc2ab", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385083, "uuid": "ff8ac591-b92c-4f4e-bcde-a9b2efadf9d5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385083, "uuid": "863a34de-3a7c-45d2-bf5e-b1c41eebc2cf", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f5d4dd-2c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690410522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410522, "uuid": "88008ac6-75f7-4d73-a4b8-414e0455b359", "comment": "Malware payload (AgentTesla)", "value": "179975642c1e6fe458e446aaa9328596", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410522, "uuid": "e9ed864a-3cc1-4142-ae4f-132e9167089e", "comment": "Malware payload (AgentTesla)", "value": "ab701ac288408c45b6a0d0d7cc7f71b44309cd32b64544a3244511098ee20bf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410522, "uuid": "dcdd2571-7131-4212-b107-7e689b778162", "comment": "Malware payload (AgentTesla)", "value": "1bb87cc7186bae5bb29b420134384d1c88099624", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690410522, "uuid": "5c630247-dcad-41d2-a4af-978c54d64e0e", "comment": "Malware payload (AgentTesla)", "value": "1a73e592c6abfa80c2c432781bf5ccb9ea4956ec1191f3aba6773cbf814586767c4d1f5972916881931f5435e2d4cdd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410522, "uuid": "fb2f7463-0594-4dba-a924-0ac91113b0d4", "value": "T10AE41200727D6F66E62A9BF10A46644C47B0F567A82AC3464FC321F35EE5F058B75B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410522, "uuid": "2622cc2a-f797-4b30-9b7e-bdb7b8081e2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410522, "uuid": "300c1ccc-94cc-4c58-b4f7-08cef60b8150", "value": "12288:yJmefaynhThuA4qTgC79cK/uY6Fh9/pUMSmOYajb+9J49:DeCQkLulwxpyM5OFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690410522, "uuid": "8e730c4c-955b-4426-bd72-17153570be8d", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690410522, "uuid": "c8f68ad7-b54e-4543-840e-2628fd876100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690410522, "uuid": "34749aa6-94e1-492c-953e-85253b86ef90", "value": "SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c80f63-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407747, "uuid": "7f2b04e1-a0c7-4b52-82b5-9fb489ee4eb0", "comment": "Malware payload (Amadey)", "value": "3fffb72cfad68a2efbf74c6687155eb4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407747, "uuid": "17f2c132-8fab-40e9-a3a4-a2c460eb711c", "comment": "Malware payload (Amadey)", "value": "ab7e12fe66094df66cb5429ccab88b6ab881608b8bf709d1823fed05e38ffa54", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407747, "uuid": "c2312a72-17d0-4608-9e34-2e7f545a74e4", "comment": "Malware payload (Amadey)", "value": "5a71804780b92e18185bd5835afc0ca7a4cab2b1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407747, "uuid": "8a353cd2-2579-4bcb-baca-72ab8e70811b", "comment": "Malware payload (Amadey)", "value": "5bdc1bf5085d4d0b5d68a4ab87ddef39d1a820e10e64914dead11559e3f949b1e3810cbe00b02e7bfd29b12f8e3a69db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407747, "uuid": "00198792-8015-4b94-9727-ba0dcf6b181f", "value": "T164B41203BBD95473D8B42B7058FA1393077A7CE18AB483372792690B4DB16C49A7277E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407747, "uuid": "ef8f6eb2-2ec9-4321-910d-c725159f7148", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407747, "uuid": "2ee1214d-efb6-4e0c-8e85-3eb9457db021", "value": "12288:QMrNy90nZ58jxFeuNb3jzvHX0Zpqq1a9im5Ey:NyRjxFeu+J1+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407747, "uuid": "028798df-abb4-4c4e-95cd-f33fffc56fc9", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407747, "uuid": "41c617c4-440d-4b6e-820d-5f341cd6c4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407747, "uuid": "237379b6-f013-4dce-9e38-283d4d21e442", "value": "3fffb72cfad68a2efbf74c6687155eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6968b0f-2b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690348621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348621, "uuid": "9c391bed-69d6-49a0-b742-6d92610059e3", "comment": "Malware payload (AgentTesla)", "value": "ebbbb2342220ade28af68b49a9048969", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348621, "uuid": "6363d805-ae7c-404c-a947-0c225e2fa246", "comment": "Malware payload (AgentTesla)", "value": "abaa0a631b47aa89596ec18a9f1600e0dad07ee7c40c7dd6dcde69202db335c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348621, "uuid": "bb0e6231-b017-4569-8681-e12c82469e17", "comment": "Malware payload (AgentTesla)", "value": "a898a9b7d71b7424b8698247a824e085592bac92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690348621, "uuid": "d6eb35f1-9eb8-4537-92ee-cbf798509e54", "comment": "Malware payload (AgentTesla)", "value": "c5d333fc26bc5f884a5e4ad945e60220a0f87a7be3c90e9568f01e8eddc3a25635aaf6cbdc36f1e132ed3cb085c0d4e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348621, "uuid": "ccde960f-ad34-4472-b10c-cf85ea40fb65", "value": "T185B423EB7196F6D1A2526AE8E1308EB3447A3794104D8CFAC8192BF5EC6C1DD3F43919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348621, "uuid": "bede87db-86e7-4d37-8d1c-4ec4285a670e", "value": "12288:gxVWy3Gx8F6A8LzxrWvrsVR+LFWT51BCM6Mbw0AlU:gC/8jez64VRRrjtAlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690348621, "uuid": "d23f8365-7328-4b30-b5a5-669445305341", "value": 532669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690348621, "uuid": "a81e2472-3436-4ae0-a64d-eeb4826fecf0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690348621, "uuid": "41cff5c3-5335-4823-afac-d1be531e9aaf", "value": "Payment invoice.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f32ef4-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690385335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385335, "uuid": "17c97e83-1b3f-46b1-be03-4fdf5d0122d4", "comment": "Malware payload (AgentTesla)", "value": "b303df9beb5e61cfda5c177a010d1759", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385335, "uuid": "eba94fc7-fe4d-4000-a019-8d20285afd70", "comment": "Malware payload (AgentTesla)", "value": "abff3974ab1ba9737f1ca97779f340922aad4537477f054a4095a46e261607e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385335, "uuid": "7c93c37d-c69b-41a8-af72-1a7826018d86", "comment": "Malware payload (AgentTesla)", "value": "635c31cb2df5a63c014d1a31073489e8e522b9e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385335, "uuid": "8854415f-bc71-43a1-8bf2-0f0a115d6180", "comment": "Malware payload (AgentTesla)", "value": "005c5f0df60e3732c79b95a564572a1888141d6210187e2beb9288f5632a284ba9f46e9ba0ca819cc5c2115d20009e51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385335, "uuid": "5c8fe8b8-594c-426d-a876-bcc6cf60f888", "value": "T106143C42EBFAEF30CB24153FC39573245F7E2EE141A2BA8A344CB1642EBAD449445797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385335, "uuid": "de94a249-dc1f-465a-835c-ce97eb0b24bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385335, "uuid": "5330eb0c-ba62-4d1c-afd6-f0959a92ad06", "value": "768:CoZ++T3rxGVQ/6gkX6JYph8oxU5aWzcMdA5/Y8L+4UwfRJES0JXtghVm13j2tSHh:CoU+3qQy3X6JCRO5aWzcMm/1Lf5fISi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385335, "uuid": "543259a0-d74f-4296-ac23-6e9e4caf1777", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385335, "uuid": "5d4f96cd-645d-47d4-8df9-3a90fb49accc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385335, "uuid": "bbed6bae-3f58-4eb0-8847-f1a0e40189bc", "value": "Ag Gra\u00e7a_quotation_9827652425672pfg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57976eeb-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407759, "uuid": "231253fe-8780-42b4-adfc-8d807e9c7231", "comment": "Malware payload (RedLineStealer)", "value": "8edae791c2f8b43bad7344d8b980328f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407759, "uuid": "2ed5b90d-f893-4bc7-b31f-f8c1d8b41eae", "comment": "Malware payload (RedLineStealer)", "value": "ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407759, "uuid": "b397a5f6-f6e7-4380-9a48-4d93932299b9", "comment": "Malware payload (RedLineStealer)", "value": "25ecd604ac6a58b47783b8e1c53c666c3069611a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407759, "uuid": "55020f66-222d-4c9d-8963-382e5f88bdbe", "comment": "Malware payload (RedLineStealer)", "value": "f66601ea46b19ffd6327372209f2510e97a804276b10b0cdbc3583f27384a75417a3069b1db0b230dedadfa509af95bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407759, "uuid": "fc728880-13b2-4f45-bb0b-e5e063a77f4b", "value": "T1C4840202B6D84532D8B6177018FA07D31F36BDA65E7983272346A89E1CB22D1A43777F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407759, "uuid": "424ef2b9-6d04-4865-bfbd-2bde77cc7c24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407759, "uuid": "a6f0ea37-5d43-4cfe-a624-0399849da6fb", "value": "6144:KGy+bnr+pp0yN90QEPoOf+JNc6o/L8g3g9h89l1W48eZ2xjtu:2Mr5y90Voxc6TfaMZeI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407759, "uuid": "f2926839-e9a2-4117-a8d4-e56f70ecf6bb", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407759, "uuid": "c152d1c1-14ea-4158-9346-676d56259b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407759, "uuid": "90b8484b-5958-4526-9573-70ca0aedf62b", "value": "8edae791c2f8b43bad7344d8b980328f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104e90a1-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690382728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382728, "uuid": "e9c93a6c-f235-4d11-a224-ac4e5dbcc415", "comment": "Malware payload (RedLineStealer)", "value": "7e377f4ff59d6728c5077c6031d3e8bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382728, "uuid": "6181b424-4a67-482b-a4c0-60bc482e8491", "comment": "Malware payload (RedLineStealer)", "value": "ad58d661130f5513d3d86b6789bab6f5a44cc50d5a961da6b3f339513f7b6a63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382728, "uuid": "d5a6fb90-ff45-4a69-b6fc-e1b403215b45", "comment": "Malware payload (RedLineStealer)", "value": "2355f1d62dcaaf126fecface661232dc3e50ad0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382728, "uuid": "4ba8b6d1-f01e-4266-a07f-4c494c157667", "comment": "Malware payload (RedLineStealer)", "value": "e21697398c9cb20bb61c61114735d0ae30725087c8dc032d6df1391499252f385ac80a475cd44a4ff306d426c5d176ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382728, "uuid": "4563ef3c-fe52-4d58-86dc-f06129e4c8ea", "value": "T11E840202F7ED8032E976177018FA02830F3BBDA19979D3672786955F0DB2690A4B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382728, "uuid": "f341ae4a-e9b4-4e39-a322-b1af2ca9c8e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382728, "uuid": "3c7fd0da-4e92-496a-ac90-0315eb8699b5", "value": "6144:Kuy+bnr+np0yN90QE9c7xqtZyhWbyhGlmFqXYNWWWADhs4wkm9HMIJk9UKUfOP:2Mrzy90TPwJLqXhWWA1vL19YfOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382728, "uuid": "0b4ea505-ca90-44b8-a703-26657d65933f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382728, "uuid": "6ec2fcd1-26a4-4e03-b5fd-169c2df6da1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382728, "uuid": "3225235c-74bf-41df-a92a-e8a361dcbad9", "value": "7e377f4ff59d6728c5077c6031d3e8bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badd9af5-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690380008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380008, "uuid": "70019af0-d60f-44be-8913-f717473be777", "comment": "Malware payload", "value": "e668ac854e5cdedfc7c2d194f9845614", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380008, "uuid": "e557691d-f095-45e2-a408-1f8b9d1e9640", "comment": "Malware payload", "value": "ad7e2a59da4a649070c68fdf8c3d6233da0b16b1390fb31a43a5cf3b65f84495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380008, "uuid": "b0c0c367-c697-4666-b3f1-c6ac9a9a5e0e", "comment": "Malware payload", "value": "60e8b38a101425353d19066827c0fba5d9a1dc23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380008, "uuid": "b23ea691-d966-4204-a8d8-5fee722dd58a", "comment": "Malware payload", "value": "3f603f75210a64828e8e07bdcf0471cddbae2c9bf1bc4a24e8c59b73a8522a57da33ea3d3194771ac275cb5596f18d21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380008, "uuid": "84baf973-54bf-48f0-8384-0ae4960effe8", "value": "T140E39F01F2C280B1E5B3157915A0E260DE3DF9344AFD5EBF5BD40FAE1F311A0E62996A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380008, "uuid": "9b3c6342-2bcf-4179-8ef5-af72a7b7143a", "value": "0139538a651a21148db92c7ae213c5f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380008, "uuid": "cef0083f-6f76-49db-8c39-afaebac56271", "value": "3072:u3A8KaSuCmqO/pL30CgUOOZESk84l2uRclBsAsWmZzP4aWVJ:ukaSG70C9+asxWVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380008, "uuid": "c4e278c8-c837-49a1-b1b3-33972c483fe1", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380008, "uuid": "ec117c7d-71b9-45d9-9e3c-2fb4421333a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380008, "uuid": "6c4a2621-31b2-4449-911b-6be53346dbc2", "value": "e668ac854e5cdedfc7c2d194f9845614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6ef999-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408039, "uuid": "ac22dd9f-e07b-48dc-b64f-bf549d638bda", "comment": "Malware payload (RedLineStealer)", "value": "bb002c60488c5ef7e62f582fbc73646f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408039, "uuid": "5afe3648-82c0-49d6-90ce-fc4c333edd89", "comment": "Malware payload (RedLineStealer)", "value": "ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408039, "uuid": "859b9423-1383-429b-a4c2-c076755d4132", "comment": "Malware payload (RedLineStealer)", "value": "0e67525e9d135927871ab92f6db6dd936b7e1b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408039, "uuid": "a3af5071-0878-4bed-aff8-c475c873962d", "comment": "Malware payload (RedLineStealer)", "value": "4eada443fac1b7958b9081dcb993526f7597500c6d98e99fb32eeaae2241440ebc491db75e0a88abaf6c14fede90a115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408039, "uuid": "47a6fdea-e3d9-4ab6-8aca-8f03a02a1741", "value": "T1F1840103A7E88432D9B917B058F603C30A35FDA299B8436F3758695E1CB35D4A93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408039, "uuid": "bc989a4b-ff39-48b5-b4d2-a8e0e382c681", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408039, "uuid": "8190d7cf-9348-4ada-9682-1e6293e9b466", "value": "6144:KNy+bnr+zp0yN90QE79p5+F4wAg0rKWKc5Fu048imlYLPrB:rMr3y90NQ4KCHKPolYLPrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408039, "uuid": "c03e2f01-2a82-4a2a-8556-d3a3d8f7a3cf", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408039, "uuid": "ee3be2a4-45f1-4ae8-96ea-a6a952008fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408039, "uuid": "3a716ecb-6575-4109-b5a5-be4835f959ab", "value": "bb002c60488c5ef7e62f582fbc73646f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f71315-2bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690393683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393683, "uuid": "7991e1ae-a93b-460c-8526-620e39b642c1", "comment": "Malware payload (AgentTesla)", "value": "fba6ae77eef30cc413e0e3e90d67999f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393683, "uuid": "b432fb47-0284-4317-a8f9-7c4cdf42daf6", "comment": "Malware payload (AgentTesla)", "value": "aea4ac1c910d807878e375aacde942a685bfc7b97844f7dc4e5102a933471267", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393683, "uuid": "01e6ee86-a920-4e43-9fad-6558d6a9a6ce", "comment": "Malware payload (AgentTesla)", "value": "709b3ea4dd38829ce3619198599b58b831c3949b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393683, "uuid": "29db624e-8c48-41a5-aab7-5fee5e3d0d1c", "comment": "Malware payload (AgentTesla)", "value": "f027aa01c750315cb017a9b954384c24c10bc49276f22882b8f9b7828eb9aa2f6c14cabf7cf1610d6fae5bb7adf385a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393683, "uuid": "20cb0658-6c71-493c-b837-42f34093db32", "value": "T19DD42391277AD372DEBD65FA20E62650A3726ABB4325E70D2C9530FC0722F054B11BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393683, "uuid": "280b6276-a18d-4697-92e5-5536d43ed9ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393683, "uuid": "2b49317f-99d2-46ab-925d-f2b279367149", "value": "12288:FjOnFBOYCyyxzMHnPmrBD0Fc0PZcssVCEEiWp+U/GD63mn:aPO8yxAHPKwkVLEis+Z22n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690393683, "uuid": "9c796a3d-a82e-4b08-a789-20366b21014f", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690393683, "uuid": "b576757d-9179-4dab-84e5-8f0ce03a62be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393683, "uuid": "ad7b7aaf-ad22-4768-9660-5f03605195a9", "value": "DHL_DWH734825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4abacd-2bec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690400547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690400547, "uuid": "b35178f1-c084-40db-a36a-3745c576474c", "comment": "Malware payload (AsyncRAT)", "value": "0537a01dde770d95c5f313029437d00d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690400547, "uuid": "812901df-625a-4f39-8964-b82c989291a2", "comment": "Malware payload (AsyncRAT)", "value": "aee3a2519ade35b1089ca6e349311425dae95e44be3c47fc26157afb6886da06", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690400547, "uuid": "11433f14-19d6-4c7f-b662-e50af1bf6d3b", "comment": "Malware payload (AsyncRAT)", "value": "3f0694c68580c94089c6fb7b50b020dbad45efc3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690400547, "uuid": "e118f7f9-bb8e-4367-8a0b-cd23e6f29dff", "comment": "Malware payload (AsyncRAT)", "value": "b3c8c3a9cf1652d29e9046a0b12714deb986e9dac25725d20493b8baaa840730e70caf3195da4b65f19475521b470de6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690400547, "uuid": "73993b84-f999-42e7-8084-cf550e9b64a8", "value": "T17E6308013BE98029F3BE8F7469F6618446FAF56B6D12D95D1CC410CE0622B829A51FFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690400547, "uuid": "086ebcaf-2de6-45c3-a5c7-7c5eb8bdb728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690400547, "uuid": "f352b02a-c630-4941-9f9c-a8caa8a8664d", "value": "1536:amImJ6tX2kNff4sKu+UYFL32EYip9bhUpV/7u98q8ZoHrPlTG1x:am9J6tmkN7Ku+UYF7x/9buzq8Zcd+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690400547, "uuid": "beeeb8c7-b3ef-413b-95ef-039471ad1349", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690400547, "uuid": "6f8cd2b9-8cd3-485f-a6a9-f076869667b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690400547, "uuid": "1c18d90f-8b1f-44ef-8be6-49f0f5107599", "value": "0537a01dde770d95c5f313029437d00d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8253f551-2bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690373900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373900, "uuid": "d29a5597-94c2-45ba-8026-dec125f6d440", "comment": "Malware payload (GCleaner)", "value": "e2e7271aef9311b96533ff54dd953f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373900, "uuid": "7cad1ae7-1483-4450-8105-fba762114ef2", "comment": "Malware payload (GCleaner)", "value": "af0fdd68cdda6201f5549c393836182d2dc450aff3c456556bc9b07c2a72d569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373900, "uuid": "22e29111-fc31-4d47-9f3b-02f13d829741", "comment": "Malware payload (GCleaner)", "value": "b490bb81b426a7335a9e7983fcb214f66cde0f40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373900, "uuid": "05c3c51e-991f-49b1-8d99-cf41a43b170c", "comment": "Malware payload (GCleaner)", "value": "0d485810997295094b1089fa106c44d2b53d3f06bb816be2c6add30b0169615c80b65f3f3516db937ae22dcd94821d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373900, "uuid": "6d4c070a-1c1b-4fe0-a6ba-37fe63b8cf5a", "value": "T1C54523155254CDBBD13BC6B00E3DC22589B6BF46283D6E6632DCEBDD1A3B251CA95303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373900, "uuid": "e37a56c0-f43a-4568-85a0-575453a3eaca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373900, "uuid": "5d5d6717-c7f1-4376-bb05-5d496770436c", "value": "24576:+2lR4ZjXa2NGAjIZsh8j3O1xN1/oQgAs65Mh9GxanV:+2gXakGAIsh8je1R/bjTMhMxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690373900, "uuid": "9b22181d-8b00-4ec1-81af-c02f23552fb6", "value": 1195226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690373900, "uuid": "0a93d5ba-a951-40df-bee7-7dbd26235fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373900, "uuid": "7cef36d3-15f1-4d51-bd18-41c45d1d19c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5593ef8-2c00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690409258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409258, "uuid": "7e3243f7-33e3-43dd-a959-accf8bcf3d70", "comment": "Malware payload (Amadey)", "value": "49c96deef87570c04d31914e09ff63be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409258, "uuid": "f773c585-dcfb-4343-9747-0004e4156d5d", "comment": "Malware payload (Amadey)", "value": "af1379c2cbc8abd767e205c1b0a8be9e9c8b5765083700eb3fd2313bf3a76e5d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409258, "uuid": "20248c84-f8ec-44bf-a82a-de14fda6ae8d", "comment": "Malware payload (Amadey)", "value": "3a4e4c8a5173863f6845b3234f9f9e6bc31fdaae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409258, "uuid": "e3774db7-79e9-4601-8a10-070ad793b5b9", "comment": "Malware payload (Amadey)", "value": "e885f0eb554bcf417432d02b52b2d319daa191b7b1d9e62a9cb465a16f9c2f8deb336b61cffdb04f477835fe6a8c80a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409258, "uuid": "67d56cff-5395-4295-bb2e-e0425fa69425", "value": "T124840202B7D99472ECB11B7028F702C30A36BC629D34976B2785A95F1DB37D4A53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409258, "uuid": "582484ea-e118-4db2-8371-9ebb79e29455", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409258, "uuid": "17612a67-e253-41f2-8c14-4815fceb3ec7", "value": "12288:5MrWy90azBG2m2bq0htHmjM7gBYCQAljb:Dyu2bq0jHmZzXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690409258, "uuid": "509c5d2d-b286-4cff-8cc1-6adfbdb2a536", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690409258, "uuid": "c6d89ad6-73af-4d62-bc72-eed8648d6b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409258, "uuid": "9fed7824-8345-40d4-94cc-7ba18e70024d", "value": "af1379c2cbc8abd767e205c1b0a8be9e9c8b576508370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f59fd68-2ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690368580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368580, "uuid": "6f60ca23-165a-4b66-b296-11856e4a844b", "comment": "Malware payload (Mirai)", "value": "a02294fee21748dcffdd1c531f074129", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368580, "uuid": "364a49ef-910e-4f5d-bcc6-4fa45f076064", "comment": "Malware payload (Mirai)", "value": "af2e3aac89c91cf95bc4d33ebb7d76bb5aa5c526b36ebe4bda00c3fe35ac431c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368580, "uuid": "04de9a75-a9db-40e7-a832-384a6dffcfae", "comment": "Malware payload (Mirai)", "value": "bfae7c4f5220218346c62fff2e9e7370d9853415", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368580, "uuid": "e2051d11-b411-454e-853d-f894f0a4511c", "comment": "Malware payload (Mirai)", "value": "b278f0a61052b2bcf57d5bbc20439c70a4b3aef1cfb6ddb3012277964a49941221c13fa13a516df936639de5828792f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368580, "uuid": "8b571afd-856d-4239-9c02-934a4e4a5d59", "value": "T141A2D025D345AEF9DFAF9D9452C1C2C276E582C7278BC8E240EEAF013506046BB89C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368580, "uuid": "9aa3a56c-a7b8-4774-9929-d7a941250b53", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5C7Ut5M4uVcqgw05VxJ0:mRxsSVsMD6xiJJE5zRWN47n4uVcqgw0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368580, "uuid": "b02c58a1-05af-41c2-885b-572a55b25a95", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368580, "uuid": "df5a095e-3798-45a3-93f1-7eed3c91595c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368580, "uuid": "7f9b29e0-f186-475f-ba8a-1add1c1b7251", "value": "a02294fee21748dcffdd1c531f074129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8587663a-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690356296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356296, "uuid": "cc0307ab-4c11-45f6-9e3a-86d25812b77d", "comment": "Malware payload", "value": "7026aa63daa63f4c8440d6390c903c9e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356296, "uuid": "98fb8f86-67e0-470a-ad45-b2d2f437c740", "comment": "Malware payload", "value": "afdfbf0c435545c2595180dc2242320e93a16909ae8d3d6a0f8265f5e20f989d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356296, "uuid": "16f8879e-2c3c-4030-96d3-0be6e4e1bb16", "comment": "Malware payload", "value": "57432661d2c29f696c9bfbcfcb82a4748e1b2ed8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356296, "uuid": "f89cd305-9834-46dc-959d-3b1b2d87df52", "comment": "Malware payload", "value": "7d98173b7d62f85205a33f22c612dd9842e66cce75ffe99a02ff64f13a46396349fb4e9bf7b1fd5b530dcf62f7891923", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356296, "uuid": "29eb650b-c5a7-4b47-bb7a-892294612450", "value": "T1E113AF5AE79F02A5CB911273131A0E89A6FDB63DB35154B1346C833433ECC7E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356296, "uuid": "c6d209d2-f799-46c5-b9b4-bc64354490a0", "value": "768:sFx0XaIsnPRIa4fwJMDsRck1ZFKnzF8UUJsh/Zz5BO7lGZFXUvdl4:sf0Xvx3EMjk1jKTUONF5mGclS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356296, "uuid": "6a5d6df7-bf27-414c-96fb-e85ab413b208", "value": 44716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356296, "uuid": "f438ba70-1188-4ed2-bc2d-e9d99c6c6f69", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356296, "uuid": "4cde8243-67ac-403d-8ae1-cff28dd93535", "value": "PO-6700051214.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91963036-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361470, "uuid": "65dde4f0-9fea-46c0-929a-73f7b2016f4d", "comment": "Malware payload (Amadey)", "value": "b4eca79dfbbfe3b06c12e33047146e9a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361470, "uuid": "39a8f3e7-be3c-459e-b1a2-a680d178af09", "comment": "Malware payload (Amadey)", "value": "b00e0391a77d09f2733cb3f6ff57125ec462a9d9ec74e915cb7888e45f7030f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361470, "uuid": "92595bad-006d-45e8-b012-6d3b0e5647b8", "comment": "Malware payload (Amadey)", "value": "e0e05c30531cf5530af7202edbf410af5959a657", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361470, "uuid": "51a65fe7-1bf3-44d5-9aa5-a284ad3653f5", "comment": "Malware payload (Amadey)", "value": "7bee35afd6c80c72b0e0551d8a861e6d68860e68a71cfab30c4d9d189da50c6e4c9378240853287215a51050286f39e3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361470, "uuid": "48e3e8d8-33ec-41a3-a0fa-a468b9fc2c01", "value": "T103840116F7D88172ECB5277018F607D31F36BDA19838822F2B86995B4C73294A97473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361470, "uuid": "219e6879-1bac-4d5e-b9c4-4290e065a98e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361470, "uuid": "73d71db3-ba06-438e-a960-39bcf7d74413", "value": "6144:Key+bnr+Gp0yN90QEiyilykyPhlahUjO+xQHWEdlcTqqxBmsLemhSIlAjJF:aMrWy90AyiokShlO3HWEvcpxBFE6KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361470, "uuid": "16cb2e53-08c0-40b7-b5e2-5563b3e9a514", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361470, "uuid": "f694630f-7991-408a-b770-6585d47b0536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361470, "uuid": "eb168ada-86f1-4b21-9295-88af04d9a3c8", "value": "b4eca79dfbbfe3b06c12e33047146e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2de092-2b7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690352953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352953, "uuid": "124ee43c-f192-4c9c-9270-72df2035f5e8", "comment": "Malware payload (Loki)", "value": "2f290df5befcc831165d22ef011d29fb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352953, "uuid": "f596a601-dcbf-4507-a7b1-a785a62e7c73", "comment": "Malware payload (Loki)", "value": "b02e97be21b8c13924b999a9520fca882a3c4908d5cd86f236d9015ec349e2d6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352953, "uuid": "acd5ea03-4a5f-403a-9200-823daa757b8d", "comment": "Malware payload (Loki)", "value": "ea4364bd0d4711860c7d4b0ebfea6d9d4dad2ad1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690352953, "uuid": "3b776190-2ffa-4e56-a73c-cd8dcd0271ac", "comment": "Malware payload (Loki)", "value": "f9069ba53c9b5456eb3443259c76ceccfb6c438f56fe306d2abd59a4800674281e0eb70a321bcdeb02f03c28cbee0e3a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352953, "uuid": "3b69d798-5958-4d1e-a21f-5f486969cefc", "value": "T15623175AE78F0264CF511277131B0A8996BDB33EB35554B178AC533433EDC2E06A6ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352953, "uuid": "d9ef7fcc-7c4c-48eb-b85d-8624830d1902", "value": "768:WFx0XaIsnPRIa4fwJMHjryhd9G1tgbVGUUMioeGeZZfRJ157prbcYmuUlN:Wf0Xvx3EMHjrOd9GreVqozcbH57prgYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690352953, "uuid": "66be52dc-f72c-4a97-9040-d316d4f66364", "value": 46662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690352953, "uuid": "ffd7370c-d55c-40ae-8156-878d4ba8d654", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690352953, "uuid": "1344f611-aea6-4bae-96e0-aff1fb2a206c", "value": "SecuriteInfo.com.Trojan.GenericKDZ.93390.11217.19951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c23a6a-2bb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690378303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378303, "uuid": "1b046405-2e86-4353-9a0b-41d48e8e33e0", "comment": "Malware payload (RedLineStealer)", "value": "41207187a052b1304acc8f89494f9bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378303, "uuid": "3343b52c-59fc-435c-9fb7-a6c103289d40", "comment": "Malware payload (RedLineStealer)", "value": "b0a448370cbab4bf8414da1577f3790f39b442d8860948edf652100b033d3405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378303, "uuid": "d8b6a886-15bf-4baa-b987-323a84fb221f", "comment": "Malware payload (RedLineStealer)", "value": "8e912d6295c143dc42f9dd0388d00d0dc4717189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690378303, "uuid": "3541f7fb-6e7f-47ac-a9e3-7f69d435e595", "comment": "Malware payload (RedLineStealer)", "value": "a7fa71bb02fd67ab7ff67ee3f487ca432b055de6ddf4a266dd811b9a05657b7a85ea54c0e36eba2d96b463804596c746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378303, "uuid": "e4c9e16a-27f4-49e4-897e-c04ff2d367cf", "value": "T18BE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378303, "uuid": "96cb5742-cf64-4538-9b22-bd286d3356d2", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690378303, "uuid": "971f37e1-5cd1-4c02-be45-a2ae263dd965", "value": 34231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690378303, "uuid": "30e305fb-3c0e-4880-b44d-90a3d08bd790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690378303, "uuid": "2e081e74-5248-480b-b1a7-49c36c56f8db", "value": "41207187a052b1304acc8f89494f9bed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0b6279-2b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690358159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358159, "uuid": "ebbaabee-debc-40c6-835e-252407382b5e", "comment": "Malware payload (AgentTesla)", "value": "64f25ba605e7f50fbd9413c150a586d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358159, "uuid": "8edbef4d-8676-472c-a491-69dac454138c", "comment": "Malware payload (AgentTesla)", "value": "b0f2e905a3fa8441269e81009204a9eb3d9738b412da2af3c6426c362b801eb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358159, "uuid": "e7e57de3-3143-41b6-899b-5bc7a6a26d96", "comment": "Malware payload (AgentTesla)", "value": "0d006461fa1de55a25cbbfb95d34d610540684dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690358159, "uuid": "1831e04c-89d5-46cb-84f4-d4ca2ba1f6d8", "comment": "Malware payload (AgentTesla)", "value": "0fb5261ee6e43fde0ec5442cbade2968f27b5c65f5f8a5eaba40285a426868f3d36a9bf478fced7e6f49deef951a465b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358159, "uuid": "917914bd-7782-41c1-adb6-3ccf71e9b45e", "value": "T1E4821A07BA9F7630C218CB3AF49BC5401E739992257BCF5B374B13020813FAED58969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358159, "uuid": "a58a760e-e503-4702-a2fa-5f7439d82d6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358159, "uuid": "19406f5d-e825-47b7-9165-98845b2769c0", "value": "384:K6wvB0MbNMgm/dQkg6ZMEt6N6ysIK0BZIvmA9uLPpM:s3bOdjg6ZR46l3Rm2ube", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690358159, "uuid": "45980306-cfb9-4400-832d-d3f8020fe69e", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690358159, "uuid": "8e9c980a-cb37-492d-97df-dddf36b713f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690358159, "uuid": "1cb12432-a8f9-481e-9425-b73739968b07", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997e0eca-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361484, "uuid": "bcf60e76-5d5b-40d0-a2d0-51aad7ca126a", "comment": "Malware payload (RedLineStealer)", "value": "8514b6557e3c5caa157f1c3c5e53c16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361484, "uuid": "ebfc7698-49c6-490d-8b68-bce1253b71c8", "comment": "Malware payload (RedLineStealer)", "value": "b2964b21f1420b8e26b1afdc02ddf1cda0647001e2d670054fd6a96b17d27a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361484, "uuid": "c6b4f600-d19e-43c1-a0a0-b114143c2715", "comment": "Malware payload (RedLineStealer)", "value": "536304c646c2eeb1ac5de988254e7b318aa03d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361484, "uuid": "c230c533-fcb9-42e1-9829-555b7eb5e24d", "comment": "Malware payload (RedLineStealer)", "value": "ac6ec832e1fba76ce09be9386bb1099262d937585f9795ceb3ad3e82352ca25da7a93a64c7da7e129fd926518d97391b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361484, "uuid": "76d65bf9-2edb-4df8-a02e-d4948057c4c2", "value": "T195840203EBEC9023D8B51B709DF712931A357CA16D78832F2B85685A08F26D0E67577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361484, "uuid": "1d2019cd-09ff-49c6-952b-7704a25bc2ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361484, "uuid": "291a8d83-8187-4253-accb-05aee683116a", "value": "6144:KAy+bnr+9p0yN90QEgzckNoc9IBs9YmJ1F5K3QSPdjToIKnwVWUhm1wUx:gMrJy905kNoc9RYg1K38IKilhm1wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361484, "uuid": "cf71462f-e4b9-4504-8583-df2dae1f17b0", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361484, "uuid": "a64c2d5b-9bf0-4e05-974c-75ae7bb1e8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361484, "uuid": "951b40e8-2193-4eec-b481-33ad09f43756", "value": "8514b6557e3c5caa157f1c3c5e53c16b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da5ee3e-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690365651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365651, "uuid": "dca50dd7-ea68-4d69-a457-7dfdfd756a10", "comment": "Malware payload (AgentTesla)", "value": "0a5275b129da209b36c4f600c1b91aff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365651, "uuid": "1b506023-b850-4f0e-9da5-4cc09fee771f", "comment": "Malware payload (AgentTesla)", "value": "b3174f733fd844023c76b997e21311287dd47342db80a1ccd97deadb6f3dd85a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365651, "uuid": "5a84de33-dc46-4cf5-ac9e-4f06ebad46f8", "comment": "Malware payload (AgentTesla)", "value": "8d238c6ab8d41e3fff48c4da65e5a4146f23b5b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365651, "uuid": "e9760cc3-af72-49f9-918e-ee24c514dbb5", "comment": "Malware payload (AgentTesla)", "value": "7866e18f49ee00316fc184eec13e8a624dfc06c89addbaed94734a2ceb06150cea874744f8334cdc98b39a4a28115bb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365651, "uuid": "24ba264d-1586-43f1-9fa7-96cd5efa908c", "value": "T107623B00BBA88233D9FB2B7A5CF253400372A5C69860DF9E6D8C129F9DE37559D42379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365651, "uuid": "d4fb7c7f-8b4e-42de-b881-00715abfe51d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365651, "uuid": "79aa3059-1a06-427d-800c-2737ddd7cebf", "value": "384:N7CwchRffi8DYiV19jZ/daqelPFY5gClj:N7CVySdall65gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365651, "uuid": "9fb36a1c-f17e-4cad-a40f-dd70939cc3f7", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365651, "uuid": "d129e326-c97a-4e17-835b-ed93640d5eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365651, "uuid": "52f0834f-c13d-4678-8dbf-308adc73146a", "value": "UPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94876555-2bfc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407431, "uuid": "cb9a9a9e-dbe7-444b-96e7-f7626d2425d0", "comment": "Malware payload (Amadey)", "value": "08756b1e9e8c05b88b872a614abb9456", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407431, "uuid": "db757043-28c7-47bb-ab00-f1ac33a7b435", "comment": "Malware payload (Amadey)", "value": "b3eb736a5d62ca99c3bb61ab1572ce044dd3f3d33a0f83509bfc2cb1204b0b9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407431, "uuid": "5f1348b6-2f4c-42bd-889a-6c4b7415b25d", "comment": "Malware payload (Amadey)", "value": "3261f8485d41b39bb51c405736cde6cc83511e71", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407431, "uuid": "0a5ebbf5-5226-4c66-ba2b-bf616a6bc801", "comment": "Malware payload (Amadey)", "value": "66525ba0d263c6a5ad58c7f60c3ccbf0de3f8e5e539c8df9d34fc0d9546ce0fca82043bb1e013c94d17b63c8aa9800b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407431, "uuid": "6ea013e5-7484-41a7-9f57-97ac36f884de", "value": "T15E840202E7E58033C9B41BB068FA07C30B367DB25DB5972B2746995A0CB27D0A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407431, "uuid": "155aafc2-ffe0-4033-9193-4dd8c600bdde", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407431, "uuid": "15469dd0-8c59-437a-9bfb-a6ee3276b667", "value": "6144:KBy+bnr+Dp0yN90QECqKcLI9GyF4t29E7JrovGA0jgBZ+t4WDu/J6AiKXztd:fMr7y90o63AY6vGXgBYCWXKXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407431, "uuid": "aa7f0eb0-26af-449a-baa8-c80982ed332e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407431, "uuid": "f4c7a403-d8d2-486a-98c6-7269a93b14e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407431, "uuid": "ff48c081-d8c8-40ba-a64d-4dd727c8a3e2", "value": "08756b1e9e8c05b88b872a614abb9456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b0a7d8-2b4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690331731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331731, "uuid": "9d6d8e4f-32e8-4a82-a944-8e06dbff49cb", "comment": "Malware payload (RedLineStealer)", "value": "413f1f867389074e29874721e58119a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331731, "uuid": "057c306c-29a7-476f-b8eb-e914cbd6bd6f", "comment": "Malware payload (RedLineStealer)", "value": "b42f4aec0e24f2b9606cfed415e958686accdc17b0e200e0711bf8ccdc435c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331731, "uuid": "adce05d9-4bac-45d5-87db-5708ea2fe1ce", "comment": "Malware payload (RedLineStealer)", "value": "6f7bd9858692a2640f40ea03bd9be558de246b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690331731, "uuid": "31c65cb9-6ef3-46e2-9e26-866d9dfc773f", "comment": "Malware payload (RedLineStealer)", "value": "d4b3eb9b409d3c492fab31c75ac622c9320b4acead1c1d76a580d1cb4b5cb941292e40ef2430fa035527c99076435896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331731, "uuid": "e322640a-5201-4526-a8f3-c78723f9d41f", "value": "T1F5B41213E7D89032DCB5277019F61B831E367C905DB082673795AD6E1CF26A4EA3232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331731, "uuid": "eb3cdfd3-b57d-4868-8419-fecbc64a1ae3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331731, "uuid": "f6a7b14e-d3ef-4bcf-ab56-c0d1565f1fa2", "value": "12288:dMrby90TNPIHpnx37obwy8Ti9paMr0edHI6Z8TLuPEp:qyHp63BqMZo6m2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690331731, "uuid": "56fe4939-7df5-47b9-bdad-6e5196aa570e", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690331731, "uuid": "7246ac56-4df7-4493-b10b-4c4d435e91cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690331731, "uuid": "69e51257-5bd4-4ebc-b6c3-aaf799160bba", "value": "413f1f867389074e29874721e58119a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb0c2e5-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356043, "uuid": "b5235e1e-ef26-423f-99d2-77437419a8b9", "comment": "Malware payload (Amadey)", "value": "4f61cd05b93e4d6d35620249ec30b364", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356043, "uuid": "076bbfb7-da5b-410b-b185-863ba9985ebd", "comment": "Malware payload (Amadey)", "value": "b4bb815abef8a27ec1a84aeefe5db8fb7368ee54964aebfdce2677d9c993bda5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356043, "uuid": "f5c67c13-ffc7-474a-81bc-87063c35fda1", "comment": "Malware payload (Amadey)", "value": "330ddfe3614313ebd9f58dcc612d968a44b27196", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356043, "uuid": "91292201-1ede-40f8-b653-87bd94c2219d", "comment": "Malware payload (Amadey)", "value": "97b28293d444c0965ee01938890a59684ae9c20d2378ee94183a2102143af996c52d5d9a422d5a2d52262729047bbcf2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356043, "uuid": "ff57a0e9-8a97-4f78-a393-744e2c312cae", "value": "T1E7840103B7D98073C8B127B058F606D31B36BDA26D70932A2746A85F1CF2685787677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356043, "uuid": "b06c160e-1077-4a6c-b8c1-873cc50fe43d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356043, "uuid": "997df70f-f98f-4355-8e4d-1f2443535b1e", "value": "12288:nMrFy900i9oTyqeY3fchLjgBYClillwB:Gy8GTz6tczwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356043, "uuid": "ad5d83cd-d3e8-4cb9-83e3-3e4ade76c007", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356043, "uuid": "a88c2b65-ab4b-4432-8692-5748c2ebb525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356043, "uuid": "da3e1aab-3a48-4286-ab14-e675144ca607", "value": "4f61cd05b93e4d6d35620249ec30b364.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16664bde-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690385315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385315, "uuid": "ff15c980-6e8a-4906-81e1-743c3020c2ec", "comment": "Malware payload (AgentTesla)", "value": "d90caa9f138f25d5c8d529ebe772eee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385315, "uuid": "2061945d-6262-4adc-8590-9c19195f29f7", "comment": "Malware payload (AgentTesla)", "value": "b4dabcf3ae91e2f1c92ea90797501d2a9b49549d2246b8910f1236eb119bc54e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385315, "uuid": "f7234c52-ca30-4f2d-8035-31fa19b73436", "comment": "Malware payload (AgentTesla)", "value": "d8a2891fafff7b72047ef641dfe86e29b0c4f9a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385315, "uuid": "104a905b-58cf-45e4-858d-43a6e31bc98f", "comment": "Malware payload (AgentTesla)", "value": "6bf282aca9a4cb6a8ff34e54e278e5e1373605fc0438883c12a64d07dc426d324dc3be8dee5d8102ed0bb650c9e5b3fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385315, "uuid": "6e6b08db-da96-4884-9d10-517001d407f3", "value": "T1ACB423598CDD144CD93B3AB6780E8167FB39B393D3132EAAE94950CFAC13E1C8721592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385315, "uuid": "7a707ae3-1969-45d6-86c8-bd78601878bf", "value": "12288:NlIw5cdueNjoFCWWlNVUiYbUhPP/tGRNZG3m7PH4:Nuw5M91PdUirZHUHZG3g/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385315, "uuid": "f6eda1c3-2ffc-4959-aa54-34c21b6103c2", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385315, "uuid": "024b3bf4-6932-4436-9b65-8e422713707f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385315, "uuid": "1fbe7b34-1f6d-42f4-9ee4-6c38e1fcb24e", "value": "4304-002LF&43094-002PH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015bdb83-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690351350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351350, "uuid": "7e61fd7b-3c91-460d-9401-8307bf149ab4", "comment": "Malware payload (Formbook)", "value": "567bb723e7a489d8a2b4df7393854279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351350, "uuid": "f38f3ed1-d81a-43be-ae94-03f1e34c5cb4", "comment": "Malware payload (Formbook)", "value": "b52c64c0828748cb8bc0c3c08b3b26a54d0d491a7de67f4b8b6d9d1aa23e8103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351350, "uuid": "8abf64bd-c48f-437e-9973-ecb12ffa46b1", "comment": "Malware payload (Formbook)", "value": "9021c42e5b89296957b916486e580a4d1890c435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351350, "uuid": "a330543e-7db8-4463-8f27-321f00145639", "comment": "Malware payload (Formbook)", "value": "2d9bc471649d44e0f075d4c6f325c5fd0fa097a786ca7ff7c8663181d2764be4c8e4942cb9ac9c22dd66e3a6a21e3f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351350, "uuid": "2e8ea5a9-c61b-4108-9839-4671eaac27e0", "value": "T18C44121D66A8C077D8F30B3216B52E9F9FC6E82A09B6970F1750561E38A75D0E50F3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351350, "uuid": "934cab9b-2915-4419-974f-8c87b2df60b8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351350, "uuid": "0314c24d-7383-4777-b8ee-5f4ffea83d11", "value": "6144:PYa6+M9nbFAh66zPydRaEr2qvpRf9dIxJ30iI:PYA2nbFS66Odhrrrf9OJ3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351350, "uuid": "7942f89b-f3d9-4ddf-9899-75778fd063ca", "value": 260957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351350, "uuid": "46f1a3f9-9518-4414-bd6a-736e32a72a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351350, "uuid": "26909def-06ec-4b53-931a-c82b4ce6d57a", "value": "Revised invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e78777-2b8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690359224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359224, "uuid": "4a0bb248-2130-458b-874c-9c48dd6841f8", "comment": "Malware payload (GCleaner)", "value": "c95f001459b467f2858a7beb89b0cf40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359224, "uuid": "bbd0ad95-96c0-48ea-8371-5bff94e3199d", "comment": "Malware payload (GCleaner)", "value": "b59e99ffe4fadaf763a31aeddb7b33444536e5a8b163b08813b6aba1ffaaeb96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359224, "uuid": "e69cd16e-a84c-4049-a935-106649c6883a", "comment": "Malware payload (GCleaner)", "value": "833dbba940f17d9b9eeb87b578fdb5c293d2604b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359224, "uuid": "e11efc9e-4da0-4c53-b26b-a70d48761797", "comment": "Malware payload (GCleaner)", "value": "81a3ec4bb9dc5442cde8259602eff63be94c8e91de7a5dc23ce7721280130f983dc538899057dedd6bf8aa4f7cc8b0e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359224, "uuid": "fcd8ccab-2ce0-4334-a975-6d923ef2e902", "value": "T188452317D1469C76D0A28D7029786214EAB7FEA34C3A28BC78ECBE4C5FB79119C41379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359224, "uuid": "bff09686-9fc2-4948-83c9-262fed599083", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359224, "uuid": "34fbcf41-f2a5-4d74-86ea-6d05ab071389", "value": "24576:+2lhbeekocDvS/NeyXdgsfKaTqdoYXNsvrqGWO9su4/Mh9GxanV:+24RAUsHLY9SVWpjMhMxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690359224, "uuid": "e1736ab5-5391-4311-9e26-8ad86085620c", "value": 1193216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690359224, "uuid": "8ad8f7ba-ae89-410b-9269-66a7ffbb4d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359224, "uuid": "942547c3-ff9b-42a7-b8d2-bb8a25df0137", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f07665-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356047, "uuid": "b759c0e9-cdfe-4878-a5ae-7d3cf441d4bf", "comment": "Malware payload (RedLineStealer)", "value": "32411b34ce0586205b52ce51b5bdc42e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356047, "uuid": "e3429b13-a766-4d11-b16c-6c200811831e", "comment": "Malware payload (RedLineStealer)", "value": "b5ffb2fffacf3d64690be141623475c358eb29dd37c3f39d0df80761d37c2022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356047, "uuid": "a83eb632-f37e-417d-859c-0661832a44a3", "comment": "Malware payload (RedLineStealer)", "value": "fe6bd67895e2f9de1db88ce745b9498b6392a015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356047, "uuid": "0eb27ddb-26e8-4700-a602-63770c65560a", "comment": "Malware payload (RedLineStealer)", "value": "3d685d8521b86fa03eeb6e04591c9f15b818fa38e440aaa816fa14310260b226971161febbc0d79b8f6ed52ecbf8db0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356047, "uuid": "219b2224-2fb7-483c-8e59-adb8d9407e55", "value": "T113840202BED95433D8B22BB054F613931A367DA19A7893AB23815D5F4CB36C5A93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356047, "uuid": "afa9a8af-5dbf-4c59-a07d-473e0453b9cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356047, "uuid": "93c51c1b-1ab5-40e2-9f34-03ce455335ea", "value": "6144:K3y+bnr+Jp0yN90QEC7y9EGcDzp0kSMQl5NyX5ovMmAI5ctrhsJ4HL1xy7P4Vdp:1Mrly90QyCGYYuqtj5Sd1Rx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356047, "uuid": "4043fde1-74cc-4bfc-93d7-cfa42c728e0a", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356047, "uuid": "4b9e334a-23a5-4dd2-bb16-89655cc0b615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356047, "uuid": "cfca50a4-dae3-4066-b077-4a5e7c3b0833", "value": "32411b34ce0586205b52ce51b5bdc42e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e38082-2bd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690388346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388346, "uuid": "aea4dfe7-d3c5-49d6-9136-dbad25e55df8", "comment": "Malware payload (RedLineStealer)", "value": "cf2e9292b43b0fdedde6606345fd614e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388346, "uuid": "f80394ad-6d24-4ae0-b15d-a664a3ce9f31", "comment": "Malware payload (RedLineStealer)", "value": "b6418d468a161bda7ad867d983e9dee360e4478aba45baa24d52fb23394316aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388346, "uuid": "f4aecc97-70a6-4f07-ae61-9c7b3eedc59d", "comment": "Malware payload (RedLineStealer)", "value": "828c9a2939fa1e6db785dc30d3d5a3bd2dfe5874", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388346, "uuid": "2ef506f4-a6bf-42d7-8449-38befa5ef250", "comment": "Malware payload (RedLineStealer)", "value": "6cab6bf6fc6de91cccab84968648dcecb5d17ca494cb23fe2c6dab56bebb276257e19c69a41099d0da6e1939267e79d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388346, "uuid": "cb4ca9d1-13d1-4933-b566-c98fe1a997e8", "value": "T1A4840112A7E48033D9B917B058F713C30B3ABD61597486BB27856D5F0DB2AC4A47273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388346, "uuid": "f2a59034-d55c-4b97-962d-41c2e6e3f069", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388346, "uuid": "225deb3c-7abd-458d-9cb1-d5674d1e6f7a", "value": "6144:Kjy+bnr+Vp0yN90QE7Xrxf2sDHCEsDhhOBCs72s6Gmmw2WgdtrtGqp0xX:1Mr5y90BX9OaiNOBC9sfdfGaoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690388346, "uuid": "5ca01fca-f814-42cf-a9bb-32cdc32e08f6", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690388346, "uuid": "9dc0a583-ad9b-467f-ae06-f83d2aa8f95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388346, "uuid": "90603648-658e-4665-ada2-a63e789923c8", "value": "cf2e9292b43b0fdedde6606345fd614e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8d58ff-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690385759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385759, "uuid": "62ec3ec5-0897-4ae8-b928-d3d0296c3b08", "comment": "Malware payload (Smoke Loader)", "value": "8e3e7dec60c4b69819c40761d1fd6948", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385759, "uuid": "cd0c611a-f6df-473d-b30c-dfa003f16342", "comment": "Malware payload (Smoke Loader)", "value": "b6c5fe3a7a81997d6c6c8dc7763ddbf9c2eb2519c8a6e68da4c38bb075f20879", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385759, "uuid": "fce4c621-2172-4107-b60a-07bc3bc40b90", "comment": "Malware payload (Smoke Loader)", "value": "d819feed587ffe5917326dbec114ca76b07595aa", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385759, "uuid": "91fb2482-33f9-48ac-94d1-213534b1966f", "comment": "Malware payload (Smoke Loader)", "value": "ffb14a320a7a2c033bed63234fc5028771b441b37ec46a560c42d44b56fc36682b8831ab09b61e34db88ea2d9ed1bbea", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385759, "uuid": "7a32bdc9-c3e6-4789-8275-e8187f32750f", "value": "T12F74C74383A1BD46E9258B729E2FCAF8760DF6518F4D7B66E2289F1F00B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385759, "uuid": "e29f345a-fd70-4aff-9a68-d827c35fe685", "value": "bc04db2ad2507103ec76e744e96f25ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385759, "uuid": "0c82d091-0186-4532-b021-1583a6c7f3f0", "value": "3072:KD9+9FMLXcx6cjtSymwFLQHvjpC8sG35wr3owlGvPGT1lTU0C:K9OFMLXWYvj3ar4jv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385759, "uuid": "21d7ec8b-83ad-4594-83af-26cc28ae35b1", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385759, "uuid": "91fbf855-8c9c-46db-b5c0-b3a7fabff840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385759, "uuid": "50ff7df3-32eb-44b3-ae43-0824d697aeb1", "value": "8e3e7dec60c4b69819c40761d1fd6948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053fc49e-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408050, "uuid": "d3fcb991-78f1-439d-ae90-565c349cd89e", "comment": "Malware payload (Amadey)", "value": "b62325de4a16fa8ef1be00aa14a9fbaf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408050, "uuid": "69f326bc-45ca-4ab4-bd62-cef7432130aa", "comment": "Malware payload (Amadey)", "value": "b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408050, "uuid": "e4277b51-7687-4e6f-b204-abcd1b9c4104", "comment": "Malware payload (Amadey)", "value": "e4a6a42b2ded3585cc3df5a8ae50d737af8ab89b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408050, "uuid": "d7741189-4157-48f3-9a83-755998848f15", "comment": "Malware payload (Amadey)", "value": "f98a68f9b789bad705d27ab887b1da3d733accd7312680bda257c3dd62a4a13625915a1375aba2556d38a385265d52aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408050, "uuid": "f0ca7aa2-8a1d-4146-8be7-242ac06c4473", "value": "T1B1840212A7D99032C9B51BB068F702830E357DA15D78836B26C5AD9F2C737D4A4B2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408050, "uuid": "61ad0163-75c2-4b6d-b372-d2d893572aa2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408050, "uuid": "e62510cf-ba41-48da-976a-9e7e4b2dbb89", "value": "12288:KMrRy90wf9rYI/TeNvhlroLgBYCmThEW7Sfz0vip:bytNYwTs7Zzm1EW7SF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408050, "uuid": "375ca754-f70c-415d-b17b-3d173def151b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408050, "uuid": "da7dba0c-395d-411a-addf-34ca23bd0e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408050, "uuid": "e2e2fa0f-a49d-4ed2-a14e-8b7151d0d0ba", "value": "b7da28873d43a4b6acac44b82b109a2489323a219d2ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bcb5ea-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690377026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377026, "uuid": "0e314a1c-3900-4eed-b000-9ed5c7d7540e", "comment": "Malware payload (RedLineStealer)", "value": "b268ac227f61080c783c56005fa2ff83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377026, "uuid": "1c9a0564-956c-4240-963e-84d8ed5e0847", "comment": "Malware payload (RedLineStealer)", "value": "b824349984caaa7351d0c62a0b04e0ff3412834c24e7f9f29e9c1459c525ccb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377026, "uuid": "16012d93-5b26-4de9-b8a5-7288a403d28e", "comment": "Malware payload (RedLineStealer)", "value": "8b4e46ce1b66655fd893e87fb12fc4bb89f46578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377026, "uuid": "01484dd5-a751-4ecb-9a6d-ba9628170155", "comment": "Malware payload (RedLineStealer)", "value": "e51a229eb6f1840002f1d8402a5b3de8a73310565eb415b2559e6de0dece9b3e35dd81b0dfbd1bf1b90c1d26737d810b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377026, "uuid": "282c412a-8181-4799-8bb5-4d300b8752f4", "value": "T122A4094383A1FD44E9258B729E2FC6F8770DF6508F4D7B66A128AF1F00B52B6D163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377026, "uuid": "b32ce3d1-9284-4d47-91d2-d66e36a43a98", "value": "2e397c9834ec7dd7b9e9265900df8753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377026, "uuid": "0941b11f-ed19-4ada-a5dd-14df681dd396", "value": "6144:2QYU8LE9mXbBb/Adg1RZceDBfYHbbk21Erzpjv+HT:AU8IYoASbWpjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377026, "uuid": "3f5fcd4d-2081-47a6-bd0e-afcd489e2ef6", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377026, "uuid": "99f19d85-508e-4db6-82ef-b6f9acdf6c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377026, "uuid": "8dc2059a-ad11-41a6-a0ac-3efc22f7fce8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73db8530-2bd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690389338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389338, "uuid": "eb40e1c1-e9b5-4363-ae88-3c5d7cda7883", "comment": "Malware payload", "value": "1d3a4bee28581f5c36ffc82b26ed01d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389338, "uuid": "b67e7896-e008-4396-b7e6-5836b4f0480f", "comment": "Malware payload", "value": "b8447315d2bca085efb939d95b78c8f513344095ca0a05c8f77ce2dcffdc81ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389338, "uuid": "cdf8cf79-2a40-40b9-b001-61178d01b6b5", "comment": "Malware payload", "value": "52c0a947bd3f6e5e4bbf3e081e6960e23502673d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690389338, "uuid": "0b9b049b-d5aa-4b4b-a13b-6a8536939569", "comment": "Malware payload", "value": "24ab496bf95ff69620e2482c0132b2456f69e7f44b32eb2e0745b2ace435759728a0993e202188af98afedd046eba8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389338, "uuid": "5480b4e7-df3e-4417-bb46-9a9c6c6f18a2", "value": "T1C6C423CAD3A62DB7EA370E35BC18F215F7FDDC6861761E1F9708404318D9A9EC9012A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389338, "uuid": "9a18aaf3-c61d-47cf-904f-10a53e5e332c", "value": "12288:+2rsyYgr4Dyo/hbhf3lMJYulWNjhsCnufw1u+0/WLG/wYm7PHU:+2inZ/hBUlWNhsuuI1MZBg/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690389338, "uuid": "28f26529-c366-4027-a07a-79546cfb4501", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690389338, "uuid": "80ed334d-f803-497a-ad59-c2ad4db69ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690389338, "uuid": "5ede1c6f-6e16-4bf9-8983-f265d70686e7", "value": "SecuriteInfo.com.Trojan.Packed2.45490.5551.18947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530809ca-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407751, "uuid": "f9333672-a461-486e-8f71-877416a8063a", "comment": "Malware payload (RedLineStealer)", "value": "83d18cc576c29e2b4705629c497a451e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407751, "uuid": "a2a41576-c6a9-42bc-853c-a63a42d62096", "comment": "Malware payload (RedLineStealer)", "value": "b84a3763e332f6ad2624e18a74c9ef950162ccd677786bb416a5f6d4b19f6d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407751, "uuid": "df5d8f2c-0f46-4710-9625-563fd85d9d25", "comment": "Malware payload (RedLineStealer)", "value": "147770719e3df0cc2a6beeb65ab35b2a1e746cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407751, "uuid": "7b761262-9ee4-41a4-bfe4-62e90703de9e", "comment": "Malware payload (RedLineStealer)", "value": "d1c1c3e437947314e708f63f0aeef78719107a5c6370ee3b66576aa6607b9c59fe79c7ed4a706fb5a47e3ce14a2487eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407751, "uuid": "77449597-856c-4286-8d85-82d09201065f", "value": "T18C840102E7E98532ECB8177068F713830F36BDE19D79836A2746A95A0DB3680D57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407751, "uuid": "6b6daf3f-9c58-4034-b2c9-0f1e2a60684c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407751, "uuid": "4274f37d-47da-4f29-b180-f9fb628d5032", "value": "6144:Kzy+bnr+Vp0yN90QEZekm4QDlPR2BXHHOuKrYCEPHyrmoIzr5zNJF:FMrBy90KkyDeBX/KcCEPHyyz1HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407751, "uuid": "311d1adb-6eaf-40d1-965a-b8e7ebaeabe3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407751, "uuid": "172b11bc-f978-46f8-baac-a712a56cfa46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407751, "uuid": "ee937b9c-36a6-4c8f-9943-2c85487f6784", "value": "83d18cc576c29e2b4705629c497a451e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc29225a-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690383124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383124, "uuid": "40e595f8-431d-4631-ab78-c99fecfc9135", "comment": "Malware payload (Amadey)", "value": "cb4f7ce4cb4d114c101a933eaf08e23e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383124, "uuid": "05048a8c-0e38-40e8-81b3-2860f9ff66e9", "comment": "Malware payload (Amadey)", "value": "b85edef1a11d8617bc6436f83a439cccd7c8572cebea82234479fb52be789df4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383124, "uuid": "995a6da1-c36d-47ea-93dd-15623c7604f6", "comment": "Malware payload (Amadey)", "value": "e462f88fbee1b8181b389a667b0ed66fe637516e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383124, "uuid": "14d838ae-acd6-4098-9948-c9ac00821438", "comment": "Malware payload (Amadey)", "value": "bb2fe9848a585ee0a7904892fc213439d5a3550318cc15ada00c89b38ac75766b74d3ba8cccfcb282a17c63d55dcf80e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383124, "uuid": "ff06253d-df7f-424a-b25f-d39bee75b2f4", "value": "T178840156B6E94133E9B9237058F713831F3B7CA16D78836F2346695A0CB26E0A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383124, "uuid": "58ceb565-3e4b-45e2-8b74-aa967294c28e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383124, "uuid": "8626c3d2-b4a4-4335-8820-35e9f8130e69", "value": "6144:KSy+bnr+Jp0yN90QEWZ1tYwRbukEiaInOCDRAYiieEVZzxSYrMgdXIAmZLCGYnNl:eMrhy90LGdEW9N8ObSYFdQCx+i/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383124, "uuid": "28458ea8-abe0-46bf-9c42-df13bfcce247", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383124, "uuid": "9f6623ff-ac00-472a-a1d9-3a976497a320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383124, "uuid": "40a925f6-1648-477c-8e76-ef5b497b092f", "value": "cb4f7ce4cb4d114c101a933eaf08e23e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5a882c-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690375927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375927, "uuid": "0d175cd0-3076-4978-80d4-2de086586e46", "comment": "Malware payload (ModiLoader)", "value": "7e3bac2b62f1cbe305e1ac8281969125", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375927, "uuid": "a912952c-4713-4ac6-981f-b7ce05f4208a", "comment": "Malware payload (ModiLoader)", "value": "b8ce7b8f60bb42477ea6bba328bfd310cfec0c1ebbc1f60ce4b2571e240d9d57", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375927, "uuid": "513e41d4-c6b0-4763-a8c1-8227c0031b8e", "comment": "Malware payload (ModiLoader)", "value": "7185b30bb42a7907c30a93dd345646ed8f694fd2", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375927, "uuid": "0e70eb48-cc57-41c4-8c29-0b31bd1b213b", "comment": "Malware payload (ModiLoader)", "value": "cb845850fc69af222b2a9eb53eecc05ca150f9f731520b5566736b5496dd893532daf091067ba527de163ad55654c0c8", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375927, "uuid": "7bb701f2-f3ad-4cfc-ae6f-ea40c2b29095", "value": "T1154533AF3266F583A59F1CF2999C77119E019B7108329EB03823897473F27C95D8E6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375927, "uuid": "dd41199b-c41c-45ae-bff2-4d88cc28499c", "value": "24576:/KeEuyabQw5jTlkclAu8MbYalgYOCcvBVtOJA51wPKLRuxAyH2k2GlOPdWs4bJ:hEkN5fMFmXWYlcvBVt2FyLRuxXWGlOla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375927, "uuid": "20983a9b-3d81-4a69-81cc-fb94fed9c3c4", "value": 1193224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375927, "uuid": "1fc5549a-a02f-4e6c-8754-23997122ddd6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375927, "uuid": "253d8c35-c9c8-4cd9-ae39-f2a8a7f27d6d", "value": "nfattura scaduta Pdf.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e198ea-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356639, "uuid": "ea9033b5-31e5-4fe6-a407-1da6722a89b8", "comment": "Malware payload (RedLineStealer)", "value": "894dc43759602b7cccfbd1ba7ea5ee6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356639, "uuid": "236726b9-dd91-40b1-9454-7410ba26a20b", "comment": "Malware payload (RedLineStealer)", "value": "b991990c6545adf6278bd9390b8145ef7c8a838ad2026bb778c3a43a8a2e364b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356639, "uuid": "dc995415-eb72-46d5-ba5d-7050082aa890", "comment": "Malware payload (RedLineStealer)", "value": "7d66c81e0a1031fca31f7fdaaaec93bd11c29585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356639, "uuid": "36a271cf-6029-4909-a076-c8a09b26e5a3", "comment": "Malware payload (RedLineStealer)", "value": "35e16770a956671d7fca1830ac99fd62ad28c15cc8cca234ce24169397efd583786bfbce9d39287be8aadd0138aa4688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356639, "uuid": "4d069dca-3a6f-49d8-af73-80cddb1e0489", "value": "T1BF840146FBD89072D9B92B702CF716830B39BCA1CD74832B3245A95F19736A0A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356639, "uuid": "8f9ea5d6-aa69-425e-a955-59d88051f064", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356639, "uuid": "47b1f5b5-8b95-4675-bd52-2ce3f91a80e0", "value": "6144:KDy+bnr+Yp0yN90QEUiK5SIh5P/ssARti64QJOYWfMSqU9gBZ+t4GDsznMMLMqdk:pMrMy90xCvhx/sXRtFwgBYCGQLJB6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356639, "uuid": "02666000-9fa3-47b8-95f6-557cb405f1e8", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356639, "uuid": "2e4252b1-d850-4712-819e-0eeab2832a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356639, "uuid": "1c260fa6-fc1b-4631-99cb-e17c4f727b69", "value": "894dc43759602b7cccfbd1ba7ea5ee6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a09c8da-2b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351445, "uuid": "4b7943e1-c792-4dda-b650-56b1fc47200e", "comment": "Malware payload (AgentTesla)", "value": "10309b809569b0396a095b6ce0f0fb97", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351445, "uuid": "56e60305-87e1-40ce-81eb-db247f839f67", "comment": "Malware payload (AgentTesla)", "value": "b9ebc76c8aa613b7d56bb93e4be998a75d020c5f62be161b46c7d4ae6a189062", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351445, "uuid": "7954a657-7e8f-4503-b432-6ba2f5d6c8f2", "comment": "Malware payload (AgentTesla)", "value": "9f8492ae08395c8e5e796316d4a302b1904c35ee", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351445, "uuid": "97c51080-e61d-42fd-8678-189fef316d95", "comment": "Malware payload (AgentTesla)", "value": "80baf4b67316faa2a8ffd01134c37797da09905aca4766bbabd6abcd2e67d39ea12042a079a1bff21458a1c83e43cb71", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351445, "uuid": "7aa73e1d-a7e6-4c2a-8f7a-7dcdf3945736", "value": "T12FB423484A992F25E59BF92E3CC936E187BD170F8947F788AD1ACC43523FE00129D6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351445, "uuid": "0d398ac8-41d7-4bef-afde-d551993342c0", "value": "12288:b2KnAtJeqhFeOWMT+3Ma3bC64mGyRJkuaedi2grAHL:b2KAecMPm6gyRJkua6I0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351445, "uuid": "0dece8d4-0547-4500-a02f-b6b39faf6065", "value": 502360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351445, "uuid": "691284fd-da5b-483e-b328-b4974b2726f8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351445, "uuid": "424a1bfd-e5c0-42ae-a3a9-e7c43383a5b0", "value": "CI-23JC0607-TWO USA.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4483c22-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385661, "uuid": "e6bf8e36-11c0-4204-b9f1-8debb5ff6f62", "comment": "Malware payload", "value": "45d4118084ecd3a0b0d1d774975dea26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385661, "uuid": "f3d75243-7ff4-4ec2-87ba-fa5ece825445", "comment": "Malware payload", "value": "ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385661, "uuid": "7b9cd747-0018-4578-b6c8-5c1ec30302d9", "comment": "Malware payload", "value": "b3bb7761bf51d2ae00733bb1d609ba153743d4eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385661, "uuid": "8717117f-1a73-42b7-b60d-a9b7324e1c66", "comment": "Malware payload", "value": "15a6adb1b3dbcc199825c0369c9ec704af1978d1c78ea370b6df3bcd278b46f237e8f0b7cb344dc1607f94fde1f0b651", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385661, "uuid": "e0e13daa-7dd4-4694-b35d-3180cb4a244f", "value": "T1CD627D75CF974078CFAD5FB00AEA5D2F5604AA69324801904F271F4E9CA1BA7FE4348E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385661, "uuid": "751dd7ea-6a7e-4b59-93d5-e47b1705fa77", "value": "3fb7ec92dc5428dc25b22a2c07c4e9d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385661, "uuid": "05d28522-4b35-47d1-9fee-265190d5e6c9", "value": "384:Tr5ZDtrFAsVnIhdP3RmCT3pGyGtknOdw:TvIsVI5pGyGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385661, "uuid": "19cbcecc-8d82-4891-b408-a0e469f48659", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385661, "uuid": "ad2a8f97-3ad7-4cc7-8611-61b43fec202e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385661, "uuid": "af5509bb-4587-4244-9520-dc8f5f70b298", "value": "SecuriteInfo.com.Win32.TrojanX-gen.18348.29040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff33dd4e-2bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690379693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379693, "uuid": "e8eae0b3-470a-4e81-bcb5-3f0b92c37960", "comment": "Malware payload (RedLineStealer)", "value": "1609a44aaea41e6f7d2749f49a60a1af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379693, "uuid": "3f0510f3-5d87-4428-8d3f-94778f4cae4c", "comment": "Malware payload (RedLineStealer)", "value": "ba769ab00897d4fb55dffd961262aca94281c6efccb3b806cc40b3c0bfa64fcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379693, "uuid": "db1ffca8-2278-4edd-ad35-2f9ac74c8a76", "comment": "Malware payload (RedLineStealer)", "value": "bd745dd9d52800299333f09809c9caeab5ea42ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379693, "uuid": "81831a70-4d2c-4c48-88be-a81396a549cd", "comment": "Malware payload (RedLineStealer)", "value": "4219ac270d9933c46151f4b2437b10c8c734f571ed72354c8ebb1e72d5ecb8f4f1663fbfb1b11eac6d8a81376d418d13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379693, "uuid": "fe618481-0c59-4a78-b53b-06eeab246262", "value": "T114840243EBD99072D9B517B058F503830A36BD62AC75D32B374AD96A0C73AD4983273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379693, "uuid": "157e182c-110b-43ae-99f8-7c1761d8944c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379693, "uuid": "b1fd5afd-b267-454c-8893-7f790a02541f", "value": "12288:lMrxy90Auu38NGdG+riCgBYC+DTTjl6SZV:oyi9xzwTj0mV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379693, "uuid": "abf980ad-aa3c-4510-9ba7-41806d14aef5", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379693, "uuid": "62e13689-301d-44e5-a0f0-03dc4cf4f1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379693, "uuid": "0c246be2-5f7f-44f5-8578-5ca0717c75fd", "value": "1609a44aaea41e6f7d2749f49a60a1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188870e1-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408082, "uuid": "64a12bf2-2b04-4bb9-829c-956a9ad9e54f", "comment": "Malware payload (Amadey)", "value": "0ac62c0d23be9b2b0411eaacea43446d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408082, "uuid": "c6e1e706-14e1-4ac4-9de6-fa24f935906a", "comment": "Malware payload (Amadey)", "value": "babd836631e288a3898e6b871ded792269de5c0014085887296a642d03a14d1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408082, "uuid": "a66cafea-194d-4202-8350-a9689466dbbe", "comment": "Malware payload (Amadey)", "value": "bcdb0f062db7feee2ade7f8b39e456b1e8484ef1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408082, "uuid": "214408fb-2f9b-4041-978f-e59f13a47623", "comment": "Malware payload (Amadey)", "value": "4292babdd17439ee3985cab9ccff78c99b900509e765c72aa780caeef78935c2197155eeeebf49e9fa86137a9e50389b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408082, "uuid": "2af4dc9a-058c-4c41-a5a2-084f397520ec", "value": "T19DB41253EBD88036D8F91B7008F603D31E3A7CA39D3587AB2785A95A0D726C0A472777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408082, "uuid": "3b3d05b4-0956-4bd2-83b4-236ff1c9122f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408082, "uuid": "cb0a90ef-ae0b-4146-85df-1c277adeb8b5", "value": "12288:hMrry90Ur1Cc6vD8ZF1dRzBzgsGC9CaRcEixn55HgC:WyRscyPsWn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408082, "uuid": "745377c9-96a7-4a9d-bb29-5a5933408f09", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408082, "uuid": "90ef2f5a-593e-4e99-9357-00170618c5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408082, "uuid": "c4c88929-2352-429e-8eaa-9126919de47c", "value": "0ac62c0d23be9b2b0411eaacea43446d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe84bb7b-2b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365089, "uuid": "840e0689-c033-40c0-b680-2b16268d383c", "comment": "Malware payload (Mirai)", "value": "0efd8e3c9920de648f5250239a45e029", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365089, "uuid": "9cf9efde-698d-454f-bc44-1ef5b3d371d5", "comment": "Malware payload (Mirai)", "value": "bb00e382770d558c1fb72dd4c7662541b4587f09833e692cc569788a1794e3f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365089, "uuid": "15d54c5f-abe8-4e5b-9604-7354f8a0ae56", "comment": "Malware payload (Mirai)", "value": "551ba7356769b9bc311b5414f0e2dedafc2e4d99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365089, "uuid": "96a67b57-167a-4055-9e6e-d6d89f43fc37", "comment": "Malware payload (Mirai)", "value": "f80747414fa1cbec78c18709314d233202dfa64cdd885fecc1928a4fb5a0f547d12dc1b7bd33e0fda1659ae33e62d82f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365089, "uuid": "2f45cb89-90f6-4eda-a4f2-f23b8907ce79", "value": "T1B5C2E1E07726FD31C420AC3DE53B4D8A7A511A7C91FF393664258C398EC165A63E48FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365089, "uuid": "94c8514b-c96c-4dab-ac08-0d59c49fbbf9", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrt9q3UELuG:OKy4qfqoeJdXWgALT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365089, "uuid": "bf810c76-31b7-4a3f-99e0-92539b1cd9fb", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365089, "uuid": "f631e136-7215-471e-80cc-487234e4bca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365089, "uuid": "0f5f6f0c-7fea-4d00-aeaf-c0af136e1c1f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929cc7c8-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361472, "uuid": "db50fa61-a7f3-4472-b4c1-1c77ad81b842", "comment": "Malware payload (RedLineStealer)", "value": "6483e000d8e4ddb5c2bf2e375fc4175e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361472, "uuid": "391029a3-501d-468a-93ff-e6477ad36e3c", "comment": "Malware payload (RedLineStealer)", "value": "bb5835b478f26264d041942698494bd5787ba57ceaf98814c846c735087caa74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361472, "uuid": "c804b77b-dec5-4a43-af8f-f05dd5d0ffb5", "comment": "Malware payload (RedLineStealer)", "value": "9e50ef17a79f0f5f06a1f8dcf9dc39d34258adeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361472, "uuid": "987dee7f-3191-4518-a5a7-5450c25ad03a", "comment": "Malware payload (RedLineStealer)", "value": "064a47028e215c8384a03d08ec63498cc3ec87943fe92ef4c7c74504bba613d3177196195b38292fbf3775e03c670b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361472, "uuid": "a2c0c77c-ccce-4f1e-814c-5a2bcd494e5b", "value": "T13B840202ABD49472D8B067F098FB06C31B39BCD25D7C931B2785A94E1DB3680A97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361472, "uuid": "83c0e9d0-bea8-4467-b72c-6ebd19f83b62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361472, "uuid": "1767a2f2-2c28-42eb-ad90-c459ab50074f", "value": "12288:OMrzy90wAhV+8lFAbM5rJcSRgBYCNBZuYY:JyGgdb6v6zTZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361472, "uuid": "5217791e-eccf-4db9-b0b7-57483de79bcc", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361472, "uuid": "0593f01b-ff28-4fad-bbdc-e74c80dc24a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361472, "uuid": "c86e3970-d1f8-411f-8721-84f4d358a1e5", "value": "bb5835b478f26264d041942698494bd5787ba57ceaf98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c92bf6-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356060, "uuid": "65d8d2b6-a1dc-44e3-80bd-66660caeb6ca", "comment": "Malware payload (RedLineStealer)", "value": "52dfcf09ae37a4293bacf3923fa20b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356060, "uuid": "af9be0cb-3016-4a87-b8ce-e1de75b5f946", "comment": "Malware payload (RedLineStealer)", "value": "bc00ab76f1f4d45b056d3cfb4f45a0f34b0108701fe1f041b63af502e4e42808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356060, "uuid": "31e529ef-0ae5-40d6-a953-27e19961fe1b", "comment": "Malware payload (RedLineStealer)", "value": "25c7ce9e9bc29093185c52ecc492a0e647e1e498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356060, "uuid": "3ebc4982-78b3-4984-a65e-0f780d24ad10", "comment": "Malware payload (RedLineStealer)", "value": "56a30e3c52eaad0b11388e2764faced2c2cb826414c80e22d12f1aa2ca37d0a27969963bc9f548515ef8b85a262a413a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356060, "uuid": "676271d4-05d6-4713-9c84-a53cc7ef931a", "value": "T180840102A7DC9033D8B55B7028FA13D30E3A7DA18C74876F2392994E2DB36D5A47176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356060, "uuid": "d1d5457c-4c47-4360-a9ed-44dfed021f8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356060, "uuid": "ccd52755-9473-467c-83eb-e813621d979b", "value": "6144:KFy+bnr+Ip0yN90QEZ3XE+sv04cnFOpG3Yh3NSuuRgBZ+t47DjFDG4F+cN:7Mrky90THvnFQG3Y1wgBYC7F/Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356060, "uuid": "119e4ef0-d208-4cd2-9d3c-6ee5a14bec48", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356060, "uuid": "538a6c0e-48ad-4c77-9865-68eaaba46238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356060, "uuid": "b625143c-5ba2-4734-b160-67eb6631a0f1", "value": "52dfcf09ae37a4293bacf3923fa20b5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c07eab1-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408088, "uuid": "aebdc99c-1e25-4e22-871e-83587fbab56f", "comment": "Malware payload (RedLineStealer)", "value": "ecb22f79e71a59c4894d1e5d8c1e5fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408088, "uuid": "195ab1c0-5b6e-4bf5-a2c3-f9f9cf07d8e7", "comment": "Malware payload (RedLineStealer)", "value": "bccb41d4cd07f22dc7128aa361e7b2b43320ef072e11627fd143b376cdee0817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408088, "uuid": "47fd6e05-a1c6-4a98-a15e-7eed039c9e2b", "comment": "Malware payload (RedLineStealer)", "value": "2207da5846db951af84b3bcc1cc8fb55ab05cb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408088, "uuid": "4c24418b-0be2-44c9-8fcb-3a8ca050d9c3", "comment": "Malware payload (RedLineStealer)", "value": "d02a4afb1ad6c6afdeae86690c2557c0af6815c41e7dd9931d48dff3ec6f8b04501eea03779eeaabdb52fa26d5227318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408088, "uuid": "ebc099b3-1628-4ad0-acc3-f5cd73721998", "value": "T1C1840202A7DC9072D8B623B068FA07931A367CE19E74862F3755686E0D736D0B47673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408088, "uuid": "78e78b48-19e0-4721-afbc-a40aa3387a5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408088, "uuid": "da032477-a301-47e6-8446-61c4c8cb3d1c", "value": "12288:FMr9y901Cn+QmrzXRYcvB8gBYCsmbp4cy9:cy3+zjRYc5zXbpi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408088, "uuid": "c45d493c-7f83-4849-8835-cd75e5acf242", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408088, "uuid": "78ec977f-b355-4c44-b983-efc8e60802ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408088, "uuid": "e0c25e8e-aaf8-4842-85a3-ab7fb32fd68a", "value": "bccb41d4cd07f22dc7128aa361e7b2b43320ef072e116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6037052-2ba6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690370631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370631, "uuid": "c6e5945b-3524-423e-84c9-5e25dcd2ec93", "comment": "Malware payload (GCleaner)", "value": "ff098b3bc57686cf107cb8e758c5ebc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370631, "uuid": "f5e061da-147e-42bb-ad56-adf6ce4d80a3", "comment": "Malware payload (GCleaner)", "value": "bd8196d15198965d4ba84e9113ab0926d68f3fd532f9770190cba2518dbb18e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370631, "uuid": "d6a87e81-6b08-429f-be5a-dec742dc7ed7", "comment": "Malware payload (GCleaner)", "value": "1a815407b2f7fea64d72e4ff610ff3bcc3391d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370631, "uuid": "3dae5cba-8c86-4a78-b002-5f04ad298342", "comment": "Malware payload (GCleaner)", "value": "8f87e58508fe6d863a1ec7a21318691e9b44d3a935fd9ef186ae7166446138a4058c2bc8220709c3baae362cfe6df4b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370631, "uuid": "22962b3e-345d-493d-851b-46b9602f7b90", "value": "T1554533D1D2B5CD3AC157BAB61E39C14589672E55643818253EFC8D9C7F3F2E3CA02262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370631, "uuid": "12e06381-137c-447f-a495-b7e0445b9d6b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370631, "uuid": "3f1a66dc-08b8-4aec-997f-bda47d53087e", "value": "24576:+2lTq2OrvAR/gJeHv3CwF6fyE2FvORHkmnvJo9iJMh9GxanV:+2tq2UoR/hX6qEYvMHbRoQMhMxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370631, "uuid": "cfa921f8-dbf4-4500-8393-771c3cf2deb2", "value": 1193212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370631, "uuid": "931f8d72-5ea4-4fe1-b40f-5b5620cb9eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370631, "uuid": "c1ad2680-bf62-449a-b51f-0b0afdd252a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb24f325-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356064, "uuid": "0a82a9ec-3159-41bc-a98f-3952bf2f922f", "comment": "Malware payload (Amadey)", "value": "24e4c1e1c0e59aaedf0cc1a3c423cf9e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356064, "uuid": "e289207f-eb5e-451b-82c4-fe142141cfd1", "comment": "Malware payload (Amadey)", "value": "bf1197da97027aaf533a446cc52bdeda766eeb310fe03355045d91fa4e2e26b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356064, "uuid": "1e1fdc7d-cff3-4c50-9f5d-135d5b87c1da", "comment": "Malware payload (Amadey)", "value": "c4872e436c50cb4ea77894792e48877653e63b28", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356064, "uuid": "72ad4a88-9a6d-4037-958f-d36457a9f0f1", "comment": "Malware payload (Amadey)", "value": "966d586e5198a67633066f1f6ebb54ab5c5800bcc0df48ad8bfb5c7f1182ba2dd836bc10975d68e190ad0502b17e155f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356064, "uuid": "0a5474da-f39c-479a-8bed-335fa4fd2823", "value": "T194840252A7E94432EA741BB058F702C30F3BBD715D74926B3785690A0CF2684E976B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356064, "uuid": "e4185d19-f727-4c25-acd1-3b1a60a0eaf4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356064, "uuid": "7498a6fb-e336-44ae-99cb-0be00d61d692", "value": "6144:Kay+bnr+4p0yN90QEPlgSNSnurBH8TeAr04lPvAPmB1aW8zpSQy:eMrwy90RSi4eAQ4BAbtpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356064, "uuid": "cc6d759c-d61e-4d33-812d-d4ed5ddcbb11", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356064, "uuid": "4d541bbc-09e3-41d3-a438-38aa3bb5a6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356064, "uuid": "545a3b3a-7588-4818-9774-b873abc023d7", "value": "24e4c1e1c0e59aaedf0cc1a3c423cf9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0b1e47-2b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690342783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342783, "uuid": "8d975d77-aad7-4b3f-9563-59983441727c", "comment": "Malware payload", "value": "0eb17599a6d6340826cde1fb9555a801", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342783, "uuid": "67a8c367-6ec8-4157-9af9-839cbad7ec88", "comment": "Malware payload", "value": "bf1462ab1a3cf16b7d68d3adf6e045445295dc6aeeb282a8aa2cbdfba764bae5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342783, "uuid": "fd389252-11f6-4cbc-bd50-5976428a2513", "comment": "Malware payload", "value": "797aad926eacff642d89a30c03d0b0c96470baa7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342783, "uuid": "a49d3ba8-5837-4b76-82d2-7fd1fd60fedf", "comment": "Malware payload", "value": "021cfbe61e6b2b04288db4bf696239c9cea7ebfb6d1f9ed2cd4ccbb440ae0850efcdab1c7af9144068204226b80b96d6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342783, "uuid": "39fac35b-bb0c-4039-809e-7a1bc0a9395d", "value": "T1AE934A5B73E530F8E5724239C8A11A05E776F8361661CBAF43A44A5A1F232D18E3EF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342783, "uuid": "ae9e8b46-ff30-4beb-b108-7a6145ef97ac", "value": "3bd4d8d7ac218192f962c78cd0a6d8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342783, "uuid": "c7f56006-04fc-4b67-ad91-35b0bafc735f", "value": "1536:uszP8laTTjQTUCoL+bfDioMqmmQqVsW3d09dlP9uCZc5:uszEmXQISLioMkQEMh9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690342783, "uuid": "4121cc2b-2617-4e96-ac9d-06f13f6b9137", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690342783, "uuid": "6c8c4a92-f8d9-4ba9-a923-840293aa7f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342783, "uuid": "2a6d026c-0737-4790-8ea9-49dfdf62d588", "value": "0eb17599a6d6340826cde1fb9555a801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755998b3-2bb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690375596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375596, "uuid": "c03e6b09-670a-4d58-89d7-ec61bb67b83c", "comment": "Malware payload (Amadey)", "value": "daced29c3c7dee8e1145f0c390975aef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375596, "uuid": "8523cfbd-51f4-4897-ad65-aab975e550c7", "comment": "Malware payload (Amadey)", "value": "bf3b8bda05771909e046448c6c761b7580fc4cc5d907d7deed86cd59435c5826", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375596, "uuid": "2e99b32a-95cc-4e3b-86ce-a0ba00a7aa6e", "comment": "Malware payload (Amadey)", "value": "6d8015d05bbdb4ca09e208fa2eca303ce2c94ed9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375596, "uuid": "08ed147d-bfcb-4c96-a2f4-8f1ef91cfb5a", "comment": "Malware payload (Amadey)", "value": "6fb9feda2a323119d602367762c9bb812619ebc0ab65b84c6940a98ddfd23ce8e4431c35cc304d85445ef40a27247ac7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375596, "uuid": "f2027423-1197-4a9d-9b36-24a9018e73c4", "value": "T110840153A7F85132D8B127B058F702D31E3ABDA099B8437B37896D5B0C73294987276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375596, "uuid": "7363ccf2-f31b-47de-9544-06bcb45916ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375596, "uuid": "d65219ea-954e-412f-ad69-b6ad763598d2", "value": "12288:YMrEy90SGyAKpGK6kpDSaEJdeYqS8P9kN:syUyAKg+tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375596, "uuid": "bf982d85-f6ea-43a4-b2bd-9d72be9a82b3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375596, "uuid": "02ac12c0-50be-4a93-ba5e-cd3102716e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375596, "uuid": "ef1ff918-5cf6-4112-ab0f-294f61a327ee", "value": "bf3b8bda05771909e046448c6c761b7580fc4cc5d907d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cdd3b3-2b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1690360404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360404, "uuid": "be3ba7ba-e3dd-433a-92f0-3094be348ad4", "comment": "Malware payload (CoinMiner)", "value": "0fe4cd989e5b3992e9bf3b118f838436", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360404, "uuid": "7560dadc-900f-4378-ba1b-e7a85d16ef96", "comment": "Malware payload (CoinMiner)", "value": "bf9afe70f71b3fdba34f67e6274f39cbe170da5d8b3b50857465fae59b7d090d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360404, "uuid": "cc22d065-e8fe-4b8d-b186-de74cf71e73d", "comment": "Malware payload (CoinMiner)", "value": "93c37b7a3b41dfb5d43487a3e595fa53cd220114", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360404, "uuid": "fe69e842-72d0-47fa-b50b-e967d9e61dfa", "comment": "Malware payload (CoinMiner)", "value": "dbe694ecf05bd3d586edf5c599e503627e493ab10010db1068076c2d2459fcec802e3da38ae969b95be8226c94662a67", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360404, "uuid": "559aacdd-a53c-4368-8a76-223cd2967faa", "value": "T1E9A6CF3343738B66C46C45FE951572FE38B4D6B4863EBFDA640C8E30BBD0598B296A05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360404, "uuid": "b51c4215-5108-4f0d-8bb6-464b76c94d3a", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360404, "uuid": "b51eba7a-39f1-4cdb-b96e-adeaebd0005d", "value": "196608:/16zy2/eMamgcaYhrvkRnRacvf8Li+DsA8hK9//IJMrk:/sd/eDmgca8cLacvf8EY3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360404, "uuid": "d87e831b-8bd3-4f57-a9f6-7dd5ca40002a", "value": 10257920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360404, "uuid": "1668adc4-d243-44bd-9161-1c94f6c141c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360404, "uuid": "f84ea941-2209-4abe-a195-429f6c35ad48", "value": "SecuriteInfo.com.Variant.Barys.382682.19571.14086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b12980-2bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690379680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379680, "uuid": "53296a79-86e1-41ac-98d8-0a6feb1015e4", "comment": "Malware payload (Amadey)", "value": "797a5feff99655f0d85ce2a57b7db03c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379680, "uuid": "0b554c89-a1cc-451f-8760-ae8254ce899c", "comment": "Malware payload (Amadey)", "value": "bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379680, "uuid": "b121d392-601b-4e70-b46b-a4e8a953fa57", "comment": "Malware payload (Amadey)", "value": "4e6faef04eb706282a621b44f12ab9f1d46c2922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379680, "uuid": "90136c6a-8985-4a7f-aa36-e89ab0f74507", "comment": "Malware payload (Amadey)", "value": "95789e31b31e7541ff8705ad351631551e0b3c2fd839ba10c6e4de69ee630663d345deab729477a9f1268e6da8500611", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379680, "uuid": "ac6e9c2a-1956-4e11-9060-5b0d0044e53f", "value": "T14E840212A7E95436D9BA177058F603831F36BDA29C78436A3382984F5CB36D4B67133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379680, "uuid": "96e19398-61f4-4649-bd7b-24b0c8cf12d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379680, "uuid": "9e72d6fb-4153-4166-a048-7e5b7bb5733e", "value": "6144:Kty+bnr+1p0yN90QETEySSJAvVcQlhRAbR4SZZ1QMmHYYgtVNaAL0C/:fMrxy90xEyFkXARPqkNTYC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379680, "uuid": "c349e2f0-5d86-4033-bbdf-f6bf030657f9", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379680, "uuid": "780fd112-3100-4622-8a70-adea6c5fda17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379680, "uuid": "d85e1461-766a-4a12-9b49-6c7be6b58038", "value": "797a5feff99655f0d85ce2a57b7db03c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e452de-2bdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690394970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394970, "uuid": "63e496b4-97ac-4925-a744-78e294b5d6df", "comment": "Malware payload", "value": "4b7a4079c0279f9dec236709ec48e846", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "deleter", "colour": "#A2911E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394970, "uuid": "bb54d6eb-c224-42c0-b6bb-8d4aeaf69355", "comment": "Malware payload", "value": "bff19a54d49f53adefeb203e0a366f03ac6417474776253d6f2104e917a11157", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "deleter", "colour": "#A2911E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394970, "uuid": "9ca380e8-41e1-44dc-9186-303335117590", "comment": "Malware payload", "value": "3eecdba3701b12839e8491e6fe8c34615d98319e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "deleter", "colour": "#A2911E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690394970, "uuid": "a7b8abd7-5642-4a2d-8750-9250fbdbfec2", "comment": "Malware payload", "value": "4bb5f83105d17669c3fc6d445a23e377109cbc36ddb81d3f7e3427efc1c2d12b7764e1fd88d18b3aec4b0966a821c246", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "deleter", "colour": "#A2911E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394970, "uuid": "9f5bfa5c-698e-43de-bea4-c60f39fe7ffc", "value": "T188C3F1E1A0125895B8AD8E7404ECFA445BAFD7C5530BF19D81EA64C4D82C7930B8FEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394970, "uuid": "300168a5-76b7-4a8e-994a-64d26505d1f3", "value": "1536:QxxDknTp+cMbyQo2+9R5h8baEAMB8pS5cESh7c54GDAaIL8653M1keQy9n834iZV:QXEccwU2+9nbMmQ2E67cyG055Ikry8/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690394970, "uuid": "6eb3415d-746b-4469-82c2-447c151c32d1", "value": 123911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690394970, "uuid": "2fa14a02-5af2-47dc-b6b0-99a7daccb72b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690394970, "uuid": "473b29a6-7c63-4314-98a8-9baff0928452", "value": "Demonic.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb01228-2bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690374963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374963, "uuid": "acfc460f-15bd-44dc-8c51-ff7073efb4f1", "comment": "Malware payload (GuLoader)", "value": "f50856ebf2e0f1ba628ff860763042e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374963, "uuid": "a85a64ea-2e6d-438b-bb73-11494edc1e96", "comment": "Malware payload (GuLoader)", "value": "c04b253a6825ca7bb6e677c6375520bebd4434d584fa8b8572fd56a35383ad9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374963, "uuid": "213d0c7d-9730-4d03-a77e-a565215330a6", "comment": "Malware payload (GuLoader)", "value": "7f6a27390462201f1c41c83ffeae2531a372c5d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374963, "uuid": "1bf7746d-d672-424c-a662-6bd59ac9e845", "comment": "Malware payload (GuLoader)", "value": "3ce74fa935e7688f9e99e21fb1d4fcd4b50364435579afbbf98649c48482dea011fab419a510cdaefb89e27dc4732d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374963, "uuid": "b58181f0-38c0-4062-bf46-9361ba594b1d", "value": "T10E059E772980C7EACFB1BDB2792B48787B66AD7F8054545B338033C90BF65A39832615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374963, "uuid": "d8f9309f-c905-4771-877e-bf4cb0d7d014", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374963, "uuid": "d1b8889c-2d76-467f-9f85-c45162f48808", "value": "12288:DIkdkz6kw3kfkVxkUxkekKkpkRqkwk+kTkZkJkDkqkzkAkkYkk/ck7kAkkPkkjku:Dg3MRT3FSf4hAkCXQWgIhQRaN+QajS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374963, "uuid": "f4b21446-20ab-41c4-ac66-d7abce6cb40f", "value": 845344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374963, "uuid": "62f16549-6d02-4538-b90c-592b9b2f6504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374963, "uuid": "399e56ad-32c5-418b-b1b9-ef46959bd8eb", "value": "Sis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17634baf-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690385317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385317, "uuid": "d630aa8e-b134-4194-9a0e-0d5d5d79cc12", "comment": "Malware payload (GuLoader)", "value": "a6bf2eed5d5f7da9393be197456abc8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385317, "uuid": "0aa051b1-f491-4aca-982d-bbe2b65e6b09", "comment": "Malware payload (GuLoader)", "value": "c0af1e1e4d989e49e5fd9963bc5ae272e3b8f3a46b66768ca5fd9cd0214fc5bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385317, "uuid": "e09704ec-6e46-4487-b3cf-4ae76854b8c4", "comment": "Malware payload (GuLoader)", "value": "622e2892d84aaae6fa4ceb206f9ea4036cbafb9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385317, "uuid": "7993e080-39ab-4e0e-a1ad-e5da1d1d41fe", "comment": "Malware payload (GuLoader)", "value": "18ff1ec4750f075b49fb9ba133e2db6d4acbe749b93888f1ae8f6efee6f70dd7250fc4c59982b0a8ff9265eb7f0a94fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385317, "uuid": "a163b5e6-f95b-4b93-bdf4-7aa478cd8ae6", "value": "T1CD6412391DF8E583CD925FB15DF9CA6F7B75E12519A5420B0774274C3B0AA908E0D32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385317, "uuid": "c283f60f-cd16-4798-af33-73253b9e1ba9", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385317, "uuid": "6e2f1953-4e6d-4b58-932f-15018838339a", "value": "6144:Wp+gguTJs0IRDX66sXIbn3h59XJNCFkgtjszB914RT8G7RyMgZl/u8+y7iKz/:i7TIRDCY7TBJwFrNRIwEMe1vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385317, "uuid": "cefb8a04-6b77-4321-88fc-d1fc45685454", "value": 316184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385317, "uuid": "0cd5faeb-1e51-4013-b768-81b1fc88304a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385317, "uuid": "2138fe3f-85e2-464f-9d03-42517f72662f", "value": "NOUVELLE COMMANDE -pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec99282-2bab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690372659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372659, "uuid": "77195806-fdc0-48af-afb6-5503139fa1d8", "comment": "Malware payload (GCleaner)", "value": "ce8830989a9f133a40c592305d5ce548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372659, "uuid": "1868da8a-857b-4602-9da8-9bfc54884336", "comment": "Malware payload (GCleaner)", "value": "c0eb4f6136ced01edd1b17b7dfceddcbbbad6126038df543b4409b967da0f380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372659, "uuid": "ff3c2986-0bc2-4408-be03-3a76707be836", "comment": "Malware payload (GCleaner)", "value": "7ae17b342869863689aff0d5bb41d2ae1d7f7879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372659, "uuid": "24cc3d14-d6fc-4ee7-9696-df1f63d136ed", "comment": "Malware payload (GCleaner)", "value": "a726743d7d262b7f61f910f093cb975e5f958eb4e833a32f10ab4e904ccf82a4949e451cb2399b90e009e26deaea887c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372659, "uuid": "4a5daaff-0202-49ec-aba4-94f72a45d022", "value": "T124452322D582DD72C153D8B40C6D4260D5B37C132C3EBEF879ECAEAC5F6668B8546386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372659, "uuid": "aa9c52f9-1c39-4d42-a3ed-3cb50745fc66", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372659, "uuid": "d0407f1c-b031-4b2b-8c11-e3c54c12653b", "value": "24576:+2lSClIbhI4nypbsTzNN0F9BbXO/JLAutTqr58rrfXcMh9GxanV:+2bmb+zpwJNubk0ule58rrXcMhMxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690372659, "uuid": "9d5fc589-f90a-4513-be8a-74677ec998c3", "value": 1194365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690372659, "uuid": "fc6c1ddc-8d45-40c0-b6c8-5a5220711512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372659, "uuid": "553ebcdd-0f74-480d-a53d-8bca747a0760", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f90ed6-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385040, "uuid": "a9a057d5-71ba-4c66-b738-a5d040601812", "comment": "Malware payload", "value": "922d9f33190ac85f320941d3c2869f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385040, "uuid": "3886e08e-0792-424f-be96-0e90157346d8", "comment": "Malware payload", "value": "c133c7228f314cc79197b863d795252be1a9878f7decd5f7addcdaebf7ed7b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385040, "uuid": "4ec7859b-72b8-416a-9979-058c96ba6d62", "comment": "Malware payload", "value": "74875dc1e3f1076f4005bb3a4b8d5f0bee8d3ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385040, "uuid": "8e259c8e-ce21-41bf-820a-37375f3e9f92", "comment": "Malware payload", "value": "3ab9f0792500fd87d72e4b0ec325879e236d539cef99f6ce6b1cb5f700622b4c244eaa73773ba6fa0d96c4f919bebc50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385040, "uuid": "1debaac6-3715-4c30-a19e-b762521c7845", "value": "T18C651230BAC084B2E4AA14755AB647716B7D7C306B3ACBDB47582B1E9F205D0DD387A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385040, "uuid": "b433bb77-2ec9-42c4-8dbd-462491458473", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385040, "uuid": "2223d994-b2c2-4fdc-aabf-921a8ddbd5d8", "value": "24576:8cbD/e1EBTY4CAwl+33UoFsBf4WVJFz85A6l6BccfvZgfgKDV6wtRDEN85zGxBd:8cbi6tHHdCbVnQ5A6sBcc3Zogokbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385040, "uuid": "f5c699dc-605e-444a-93ae-bb30eba972e2", "value": 1515720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385040, "uuid": "2e2b7356-69cf-446d-90e0-609c883de0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385040, "uuid": "a42ebaa3-b798-48bb-9eec-18a0950e1207", "value": "922d9f33190ac85f320941d3c2869f43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51d516d-2be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396802, "uuid": "b57d23be-3204-4250-a1d1-8e4df7619e5f", "comment": "Malware payload", "value": "c8133efa393bd6bd0996529f980b50e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396802, "uuid": "bae0ff05-04a2-49a9-b09d-cb17cfd26de2", "comment": "Malware payload", "value": "c17336d7c543eef6427833e8a3f419dd02c7cd2fd7665725732c35e61a354f2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396802, "uuid": "9269ca4f-76ed-4760-a6be-6a3efe38554c", "comment": "Malware payload", "value": "da91afcff5c44bc3b8e23bb2028d1197f24e9a32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396802, "uuid": "59cc34ae-f8d5-4e23-8c4a-c21d4a452832", "comment": "Malware payload", "value": "7f7291df776043587cbb9fa4a4a0c38c08e2924f155eb75aa9fbefc27cde868338f9e596e7dd226920ca7d41c6ef4532", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396802, "uuid": "5379f862-73aa-4bca-ae59-bfc2ff92c76a", "value": "T1D474B74383A1BD44E9258B729E2FC6F8760DF6518F4D7B66A128AF1F04B62B2D173710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396802, "uuid": "3bb4c644-ab32-440c-b80f-88d7cd3909ec", "value": "90bb6a3da0583450c6f11becc85dcf42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396802, "uuid": "a4bf49de-a02e-478d-baf0-4a7cafe4a6d1", "value": "3072:9VKHrjUKLo8E2thrmrGWmSwwU09SrsM5ECw3P5kspmmlwlGvPGT1lTUM:3KXUKLo8ljimuSr5TImspmmljv+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396802, "uuid": "e5d2cfc2-03a9-40ac-9c5c-e5867f557bdd", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396802, "uuid": "97a81795-9e3e-482a-a75b-00fe882dfa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396802, "uuid": "8898f2af-ef72-4932-93ff-573fc2ea4169", "value": "c8133efa393bd6bd0996529f980b50e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64c63b0-2bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690374095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374095, "uuid": "91978c8f-e11b-469d-905b-a9ce000bdcb2", "comment": "Malware payload (RedLineStealer)", "value": "27244e5f630cfab1b514ce4d15b1028b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374095, "uuid": "fcbe75e8-e503-4644-9c55-f96e25176730", "comment": "Malware payload (RedLineStealer)", "value": "c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374095, "uuid": "3f2f1a65-72f7-430a-adb9-f362581aada1", "comment": "Malware payload (RedLineStealer)", "value": "36c5eed78b2ce9e253c2e176e6d6ae6a8ab849b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374095, "uuid": "7c546666-2450-4640-b28f-6e74b59bf737", "comment": "Malware payload (RedLineStealer)", "value": "5ebfadee3ec4d9d93b1454f0fde906cfbf7a0f41e022fa3f3236046493b6f04410807f25571c645029b5897a6e9eb744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374095, "uuid": "e27c1f60-6dd9-4374-8d42-7abe5066bbe9", "value": "T1D5840213F6E98436DAB927B518F201C30F36BDA55C78926B3705691F0EB26D0E87172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374095, "uuid": "a1b056cb-9d68-48f2-b986-7144bd2aad50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374095, "uuid": "9be4c224-4bec-4837-88d8-6f14939a6a38", "value": "6144:K6y+bnr+rp0yN90QEO8EikWGjZNJkp7w8ZWj9jJAVmAAhKAU4u:mMrjy90FEMvWj9jJrhKAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374095, "uuid": "6ad3543e-a43a-49ab-9869-0bdfe701b6ec", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374095, "uuid": "9713cfd1-6f64-4ad0-ad14-6af03a19e6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374095, "uuid": "a80ed319-7e3e-48e9-9315-82a770250411", "value": "c1a9af1ad640c504ed95e8f26021a55d127de1e35d079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5c9570-2ba6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690370486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370486, "uuid": "fe69589b-5528-468e-8b9d-c1fdcc46fbd3", "comment": "Malware payload (RedLineStealer)", "value": "65bd764de0a2de7ba43d8e3d73e162e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370486, "uuid": "ada58521-f263-4050-abb1-8497f0c251b1", "comment": "Malware payload (RedLineStealer)", "value": "c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370486, "uuid": "4b0871e1-70fe-47fb-b346-2961f105a688", "comment": "Malware payload (RedLineStealer)", "value": "08285f8d1d2f31557959b1f302c7641b2cecf9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370486, "uuid": "e9c2f9bf-112c-417e-a7c9-673d43b02c34", "comment": "Malware payload (RedLineStealer)", "value": "07b5b12aa9a9d1065f6b43eeb0c736d61cf41181b4520a436399cc48fe68bd2d5b65073b324e372a90d6325fbea47a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370486, "uuid": "35834629-6463-4406-944c-4d3d66d3a483", "value": "T1A484020267EA8437DDB56BB05CFB13D30B3A7C644978935B2785AA1E1DB2780983173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370486, "uuid": "cd9f06c9-aa88-42c8-be88-e749d4d68942", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370486, "uuid": "24e69356-69cc-478c-8a9c-1246c6715133", "value": "6144:Kly+bnr+2p0yN90QEq08pRS/JM214DJbgSWpmo9SemeD3kksy4TAvUui:zMryy90IRjSeFgNDUfJU8ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370486, "uuid": "47343ec3-f85e-4667-bf48-a02413936f79", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370486, "uuid": "557a6f06-cc58-45cf-b102-5b4d102dc346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370486, "uuid": "0333f512-fb9f-44f9-9e74-47ec0177f1db", "value": "65bd764de0a2de7ba43d8e3d73e162e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa1a41c-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690350614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350614, "uuid": "081d022d-cbe3-48d3-ae44-31c12ac4ef61", "comment": "Malware payload (Formbook)", "value": "8352536a22636ec6ac4efa4a35966459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350614, "uuid": "b8712eab-c65b-4606-88f2-6a7065141aee", "comment": "Malware payload (Formbook)", "value": "c1b9e627f3beaa8e365c0bdc240435e2eaf47b664d28d1c2c2fd859bd9373d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350614, "uuid": "c85392e8-b898-4c03-bc45-4be6928bb99f", "comment": "Malware payload (Formbook)", "value": "3e6a3ba2dc7380aa3c84acd63a5a44be531ff867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350614, "uuid": "ffe5dd46-7084-46f9-a731-72045a7a2719", "comment": "Malware payload (Formbook)", "value": "1f1040aaa006eb80e048f440ad4105332dd8089f25c075239606c1cd6eef6c10434b4be5bef08cc586438c165eef82a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350614, "uuid": "90a26447-9082-4206-b022-98384b7ff966", "value": "T194D412457ADC1B1AC97A13F66AA195104FF1F99B9131E3182ECB20DB4B23F5112E0FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350614, "uuid": "cb8d5d25-734d-483d-935c-f58d0b7aa1bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350614, "uuid": "7851d7ad-b680-495f-aef4-cf70969cffe6", "value": "12288:Uf2iN2GUL0TXwHEutvqcLEeZydm2qYIAMvyNxyST0hxn9h+8hPpDz5k:Uf1xUL0Tgkutvq/R02x8Cxyjlc8hPZz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350614, "uuid": "8de8a9ba-9df6-4f7f-bb5e-40223ba1254e", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350614, "uuid": "a3432264-52ab-4357-8da6-3f5b84dc90db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350614, "uuid": "db3f0981-a7eb-48f1-bded-cf9c0ece010b", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa96e29-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407745, "uuid": "afb71f7f-ab45-412e-9cb0-861f773fed1c", "comment": "Malware payload (RedLineStealer)", "value": "4eef81a446777e5f229d991387e8ca75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407745, "uuid": "032b47b8-28f8-4f47-9407-8803379f694b", "comment": "Malware payload (RedLineStealer)", "value": "c1d8bc76effa916f88f87e1c8f1180a0211191d921a30167f8dc63e161c6fa46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407745, "uuid": "eb0c3f88-8eba-4cc7-96da-d8ff9dfb2512", "comment": "Malware payload (RedLineStealer)", "value": "e0518ae6037b37f151b33a9ed2e7317725d0de98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407745, "uuid": "9abed6eb-8392-41e3-9b20-7d11870e3285", "comment": "Malware payload (RedLineStealer)", "value": "1b738b545ff65a8ccdfb5042db7514634b2f608392c3fdd200bf11591e2d2747c82b8f199e089f2462f4a9500100febd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407745, "uuid": "9a1ba62c-c25e-49d3-86d1-b644e646a6fc", "value": "T111840212F6D94032EDB657B05CF603C30F3ABCA04D65826B27859E9A1DF2AD4947173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407745, "uuid": "579c626f-a570-43c2-a659-c8f36de1861c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407745, "uuid": "f6b8cd41-4004-4abb-a1d0-59bf3a1f0736", "value": "6144:KUy+bnr+6p0yN90QETM3sbJe8WbiRdIwulmDD9LMomJj/VHDturd8b8q7:kMruy90JbE8DD5LkDtrL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407745, "uuid": "274a1577-9536-4405-95f8-aaf9603ca57f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407745, "uuid": "d2bfa827-3f81-40eb-8164-62a9852dc1fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407745, "uuid": "f1f444df-6c39-437a-8ab2-ca77e1d706f7", "value": "4eef81a446777e5f229d991387e8ca75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6e3c96-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361467, "uuid": "0b1cb0d6-66b4-474d-bd4f-e24880789fbf", "comment": "Malware payload (RedLineStealer)", "value": "46b4098b0755804eb6ad71600af006a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361467, "uuid": "c1b2869f-8a93-434c-9b26-845168f76021", "comment": "Malware payload (RedLineStealer)", "value": "c1ea472a3c04cccf7d82f8f1953ad18f6f2c21b8c08c2be9029db69071d467c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361467, "uuid": "62a69e5e-3456-4934-a1be-faa6142a8da3", "comment": "Malware payload (RedLineStealer)", "value": "8f42378bfd7854460f8a3efe078d6431b4729ca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361467, "uuid": "60ab1f2e-1630-4dbe-81ea-fdb7245dbace", "comment": "Malware payload (RedLineStealer)", "value": "2e2451e44d4687c9bd0bb111808c1e58fbf4755fcd1b3313df2e3b793c7656d6c2c4b33cdd09f3328c403fbecfecc39f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361467, "uuid": "2b6684c3-f4b9-4946-8e00-97bffe21274b", "value": "T131840213B6D98072DDB52B7028F61BD30B3ABCE15D7883AB27456D5D0C72280A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361467, "uuid": "c7215778-c2a3-4a80-9305-dbc9ba5bfb74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361467, "uuid": "8bdf0cf2-56ed-41f7-97d6-628f47a295b9", "value": "6144:Kqy+bnr+Rp0yN90QElyF0dkW2nZNWNmYhCzSEZp3gLPzIOBtUoYizayqVj7:WMrty90aF0bczpp3gjznBtUgz54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361467, "uuid": "077e74e2-9429-4138-840d-e29d73952765", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361467, "uuid": "b5bc418e-8ed3-4d10-9a75-059494936e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361467, "uuid": "2093b63b-d401-4374-8fbe-7336d09d25ed", "value": "46b4098b0755804eb6ad71600af006a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102458ec-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690350945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350945, "uuid": "89055da6-393e-4ee2-acb0-4f014462d094", "comment": "Malware payload (Formbook)", "value": "6d6be2fe929e0d27bba0b12683939844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350945, "uuid": "8bf9ceab-a41a-475f-ad4f-c5f96bc7c049", "comment": "Malware payload (Formbook)", "value": "c22f7e6ed2e27a1863b7bf519f4254afafeffc69cadbee3ff2eadd3b3ed36492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350945, "uuid": "eff2b353-cb71-49cc-a8f3-0c7fff44328d", "comment": "Malware payload (Formbook)", "value": "b84335c2b08ba011c1cbd322e0b4630b0f108e3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350945, "uuid": "71d7de82-5b9a-4cd4-9b1c-143ef5fcb98d", "comment": "Malware payload (Formbook)", "value": "55b4d39e57ea22405e25c2c4207bf06d5a6f11e01308ec09023ce5895733e37671a984c59f444d9f2efe4c6d561f9418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350945, "uuid": "deca47e3-7385-41f0-bea3-4fa5f318eedf", "value": "T108D4121133EC8F6AC97DABF5099150100BF2D95B9122F35DAFCC54DB4C20B552AA6B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350945, "uuid": "209f39a4-a964-4876-8361-e58af26660b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350945, "uuid": "5c7cf55e-2b34-495d-aa54-df917c886a07", "value": "12288:CXPZ247C8zWb/SnLZzcL1v5Nxqaws3JcJaNQSMVv6m:/MzWbKnBcL1NwgcErKv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350945, "uuid": "a8c844a1-3e7b-4e2d-a7de-1a33c9902b94", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350945, "uuid": "c1d5eca0-5687-40f3-a5d6-99f80878451b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350945, "uuid": "00f9c5e5-df7b-4eaa-93ee-d33882844125", "value": "\u0417\u0410\u041a\u0410\u0417 \u041d\u0410 \u041f\u041e\u041a\u0423\u041f\u041a\u0423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae95309-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408059, "uuid": "816acdb7-c85f-4c4e-b6f3-ef342ec84bb8", "comment": "Malware payload (RedLineStealer)", "value": "163816fafd3946cc9e0b0a56dbb544e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408059, "uuid": "bfd47148-d2a1-4994-97c2-bc4a246cd5f5", "comment": "Malware payload (RedLineStealer)", "value": "c29b675475cb8428efab71268c98263fcbf9de29cfb64f21bf49b0a28c5982fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408059, "uuid": "71c697f5-0ff3-46d9-b1a6-eecbd03c4aae", "comment": "Malware payload (RedLineStealer)", "value": "a9306aaebf9e16c1e6d97130dcf711017894c10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408059, "uuid": "2eb80dfb-43a9-449d-840a-8868b6405fb7", "comment": "Malware payload (RedLineStealer)", "value": "f20906c5323a166b8085bdfdf5f33928cd2a8c01ccafa65d51b81a5e737cebcb31bed03175f61babafbe3b75bebd3a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408059, "uuid": "ac40e04a-e030-4902-b00e-a9db03205842", "value": "T10E840103E6F99437D97657B008F606830F36BCA59C74926F3386984E4CB3690AA76736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408059, "uuid": "e99a20dd-ae7e-4ccc-9a4a-3779eb9fc90a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408059, "uuid": "4ae7acf5-e61e-48e8-80ba-ca59ed5cb35d", "value": "6144:KKy+bnr+kp0yN90QEU3oZDwSSJAvVcQlPRAbR4SHgUTyxrDumDiaobYNZTBCo9V9:2Mrcy90oe8Fk5ARkFrivbYrBCHPtEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408059, "uuid": "de9bc5bd-644e-4f0d-9124-319c0843ed21", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408059, "uuid": "c109962e-1feb-4551-99b3-57ccb09d5bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408059, "uuid": "a7ded3ff-ab67-4976-89ca-964239f60306", "value": "c29b675475cb8428efab71268c98263fcbf9de29cfb64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e05c251-2bf5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690404307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690404307, "uuid": "6cac94a5-70cc-4fab-9db3-7e797568cdb2", "comment": "Malware payload", "value": "91db61ceaa4d06e2d5a764cfce0c2660", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690404307, "uuid": "0b4cd290-7d2e-42ba-9dab-e76139760d4d", "comment": "Malware payload", "value": "c2a6f720a5be3c399c4dad85e997648eb29c199a5a5ee15f4ae6dc32597b64e3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690404307, "uuid": "e806b29f-2176-48d5-b2fd-aa7556e1a5fc", "comment": "Malware payload", "value": "c2103594d7fa8e14aedc74c9fca3531a6f660540", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690404307, "uuid": "56f48246-cd2a-4e25-a380-56f22c329eb0", "comment": "Malware payload", "value": "89f0756e441e91e7940f2fe177a847203861036a7f3d24e64d5c936b75eaa4e47e057d936d9769a055574880c37a514d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690404307, "uuid": "383ebbf9-79ad-46bf-8d8e-c2078c4f010b", "value": "T11FE42311BEFD4D5FDC0386785A7732D6425BBC257BAFF66B1025BA1A04B33B9A0221D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690404307, "uuid": "6ce9a6cf-891f-4c1d-b8ce-cd91be380970", "value": "12288:CZoLLqCoBC6uEkEqUu9VneOhBsS0fniIm7opg+g6huHAqltbrYJsenV:iw6sCu9VVnEs717AUJc1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690404307, "uuid": "7ff612eb-ccc4-4c36-ae02-6ab40ccf393f", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690404307, "uuid": "0fa4cccb-0431-4aea-9fd5-18000de0662f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690404307, "uuid": "2697da7c-5b48-463e-8cbb-bc9e9fed98fe", "value": "facturas y datos bancarios.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa21d6d6-2bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690403602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690403602, "uuid": "a7097a3a-b4bf-44f1-b05c-55228abbd465", "comment": "Malware payload", "value": "c02eecde0398c4d67fd0e76b0f0d2336", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690403602, "uuid": "83e581c8-183b-42a7-b762-7e65c1c85a6a", "comment": "Malware payload", "value": "c35d663837787dedd7dce4dc55fd98151cf4f7ac3fe1ad60f56644eb48b50f59", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690403602, "uuid": "402a8c3f-4c71-4ba2-974c-be9a334aadf7", "comment": "Malware payload", "value": "75de5d8188371b96f0b65ce77cd2e6c2174c71e6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690403602, "uuid": "7f532733-7ace-4ce4-9539-2e9d1e4a0a6f", "comment": "Malware payload", "value": "ed506a330bb9a54bab354f91b87383bc71cedc2f02d5265824ac4399404bb4338b893b7b133033551827c8d2dc39a265", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690403602, "uuid": "cd60f78b-26cc-4fe4-aa0e-7a65c34f2109", "value": "T14456D063B3BE68F2F8F582368E108372622A1D6802E7D5CE795576BC7C3A5DD42817C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690403602, "uuid": "01c1498b-9598-4b1c-b14b-23bd2f5d881a", "value": "24576:iDft1DrHlgVLpqGvTDvWNi9L/9FvT7/bTmU:UfHrHlgVLc0SQ9BFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690403602, "uuid": "bcb92847-aee5-48c8-8b35-3b436968908b", "value": 6376093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690403602, "uuid": "f35edf2c-01b1-4cb2-96ac-2ffea50efac5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690403602, "uuid": "c3165751-8fdf-41b6-98bb-6a263f29ad03", "value": "modbbcliente.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5686bfd-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356054, "uuid": "6c02a0e5-f24d-420e-99ec-d02032d55a7c", "comment": "Malware payload (RedLineStealer)", "value": "5e077dac0c830354dfe5feaacffb52b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356054, "uuid": "fe81b875-06cb-4bfb-b091-8276a2bcddb0", "comment": "Malware payload (RedLineStealer)", "value": "c4260bd2700f65715205db8d7e25378c10f4359a0d4af188b0cc6265634ab33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356054, "uuid": "c831f5ea-3122-461c-9f80-ee862b7e6a7c", "comment": "Malware payload (RedLineStealer)", "value": "64b975598f1d9f99fd7d07a919e12443c0db3fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356054, "uuid": "08b565da-ee26-4b7e-a5e4-c815786d0fcc", "comment": "Malware payload (RedLineStealer)", "value": "e75d11c2a77f1a483c5e6c63c2ea353e6cc866819d0e03ff1ee67e8d0dbdf41f60df4fb937a83a116fa9b6e147296fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356054, "uuid": "729ba62f-6d59-4f52-925e-a7f9a01c03db", "value": "T11A840113BAED5122DD76177058F706C30F36BDA29D74836B2389A98B0DB32D0A53572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356054, "uuid": "2c751ff3-8d98-4442-93bd-3f7c864c41c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356054, "uuid": "45031b5e-27e1-4f79-9cfc-4500b915d9d6", "value": "6144:K2y+bnr+mp0yN90QER26/XkbezVMgvY/ioq00nY3LuOnqMfnBmbrJt0IlNavKsZd:mMriy90+6S/+5nY3LuOnFQD06Iyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356054, "uuid": "d5f88f68-710a-4015-885b-b8db16c2b3bb", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356054, "uuid": "01d02f08-9f0b-42cc-b49b-7e18d3d5eb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356054, "uuid": "00a2b231-d65c-406e-9d74-92e31e2069aa", "value": "5e077dac0c830354dfe5feaacffb52b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b812a924-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690380003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380003, "uuid": "29dc6d14-daf4-4a28-8046-794a0430051f", "comment": "Malware payload (Mirai)", "value": "295e56ec1a0a41ab6fe4a890bffdf3e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380003, "uuid": "ac5a7d80-b302-46c4-bd6a-e05788b3a9ae", "comment": "Malware payload (Mirai)", "value": "c47279b20334b2dcafc8588af4830b4ba017082392b6f9a035c5295ce87372c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380003, "uuid": "91835168-97d0-464b-9bde-d8ad4944f606", "comment": "Malware payload (Mirai)", "value": "ca53e1730970957051bfdf396e96d9caff26fa2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380003, "uuid": "c6356517-014e-499c-8271-ef5baf50a515", "comment": "Malware payload (Mirai)", "value": "0c50ec6ea9e6ba547289b3080f142e0ccc07e8fae77cb583f0fb5f3906643abef0010df901c2d102d2a868e5466c8b23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380003, "uuid": "e667cd53-23a2-49e8-9187-cd38d30b69e4", "value": "T115634BDAF801DDBDF81BD77A4453090AB630F3D552830B366397B9A7BC721A81D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380003, "uuid": "e80577ee-1b33-47dc-a47e-1f8f04a86b01", "value": "1536:XYwtvv1wsJDYvXD8V5f41Mx0S3VdJH7S1fYq5Qtp:XYwvvm8EvXq41m0SV/1q54p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380003, "uuid": "d0076fa5-797b-4757-a6a0-aac58599664c", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380003, "uuid": "372836f8-07c6-4fa2-8db9-4cae207d0e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380003, "uuid": "370c08b4-0eea-437a-8904-0f0137d05f9f", "value": "295e56ec1a0a41ab6fe4a890bffdf3e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769b3761-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377746, "uuid": "f285b9b0-b1cb-472c-803c-989b46aa9742", "comment": "Malware payload (Mirai)", "value": "45a1b083fd879eee6305ca7f28dcdd9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377746, "uuid": "82315566-b160-4296-a199-ee315c7b5e76", "comment": "Malware payload (Mirai)", "value": "c517d1615c0bfd37dcb089bec05ef6a7d04e9a678131e9588fd3200386d9976d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377746, "uuid": "c9f63fa8-4e9b-4e95-8898-fdf07eea1b8e", "comment": "Malware payload (Mirai)", "value": "356c0679f04f85ff8bce2917bf978df3c7f2f8d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377746, "uuid": "e67d9bf0-9436-4f16-87ae-1a1866a70ffc", "comment": "Malware payload (Mirai)", "value": "a5b55ee379ce11b8788612e40e473c4b55da48fd94de55eb5f39638b5622fdd6ae79293fd19210bc37210d9608b2113d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377746, "uuid": "8cfc60ff-fa35-483c-bcc8-670880758ee1", "value": "T1A9730856B8814B12C5C5127AFA2E118E332357FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377746, "uuid": "615b62f4-9adb-4789-83b3-c32cead18ca9", "value": "1536:mln25xPBXk1wnnkL7+KE007kPVkyazN0bIqvikNnsvHTGsV5GYIWO:rxpXCMkM/4ja4NnsvHqsVERD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377746, "uuid": "54a3b973-0349-43e7-ab04-8c0250efeb1c", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377746, "uuid": "5d474157-7276-42e7-b7a5-9503c10c554c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377746, "uuid": "0130e5b3-ce5c-40b4-be84-86c618c0654f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c50083b-2bfb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690406827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406827, "uuid": "29bfc444-a2a9-48f1-969e-9a94736441f2", "comment": "Malware payload (RedLineStealer)", "value": "288c8e730620a0a27cbda2520184ed63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406827, "uuid": "8790ff8c-27f9-46b6-9cbc-b3ef0ae862e4", "comment": "Malware payload (RedLineStealer)", "value": "c591cdb45c7c078e16f8e98503101291cf3af3e8b8333830e3eb434832648636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406827, "uuid": "82ec4396-0fff-48fe-9b00-89645032baed", "comment": "Malware payload (RedLineStealer)", "value": "36a8cbd80bc31e6344dfcc651a566b0e4a321db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406827, "uuid": "4f42b8e7-4cd6-4740-b433-887734877b70", "comment": "Malware payload (RedLineStealer)", "value": "af11463b1161cb2ed71b2cdf7c0b8efb37ea94fb18ca3dd5aadd12997ba0bf05fbc2ba34508921f999adb34e2c755dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406827, "uuid": "96b66ac4-1ead-4dc1-9e8e-4f9ebc2e2a04", "value": "T149F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406827, "uuid": "6c49e0db-9311-4892-934c-2d67c1e8fd05", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690406827, "uuid": "96f97907-f510-47ce-a05c-71caba05dd20", "value": 36020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690406827, "uuid": "f2b5fe7a-8403-4e1f-a095-6cea4df71046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406827, "uuid": "27842be4-4675-41f5-b4a8-8cc5a00b08a3", "value": "288c8e730620a0a27cbda2520184ed63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcc42ed-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356045, "uuid": "471852dd-04a0-4e39-8a1b-31cfb30532a6", "comment": "Malware payload (Amadey)", "value": "4e7fadbf1569f95b4e21b3771f421d44", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356045, "uuid": "2963639d-8f20-4d76-96c8-eeff510af22d", "comment": "Malware payload (Amadey)", "value": "c6347db543e85823fe929a8c5fdb6a12a1783b3df44e38485e6e6a76609f8d7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356045, "uuid": "d9cac1ca-d994-4eed-b912-682614e23759", "comment": "Malware payload (Amadey)", "value": "02f38b8b376fa1edba8b960be1b615d963e87f3f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356045, "uuid": "eb665673-280c-44a1-99a9-a956b61168bf", "comment": "Malware payload (Amadey)", "value": "68e4adfeda9d1dc08b8975c9b69f84a03bf2b339035b60987a6047190f1130816277061d4ad20d13dcc7908c98a6fff9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356045, "uuid": "e6d6d520-13eb-41b5-ac63-a01d9ba2f64d", "value": "T1F2840257A7D98073D8B627B058F706930B36BCA09C74436B2745A86F5CB36C5A83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356045, "uuid": "6598a300-7726-4fe8-a68f-bd10d8e17abe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356045, "uuid": "67ad9ae4-6667-496f-8c1e-2ee644efb903", "value": "12288:XMrxy90ws7nFLUNhW0c0USmgBYCXRw0jVFQRr:qy8QTRv7lzm2VWRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356045, "uuid": "1588ffb2-4db0-401b-94a4-e11690ac5f6a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356045, "uuid": "40634377-0de3-4b0b-b6db-8dabf4c833ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356045, "uuid": "a5390237-434c-4a8e-a703-c4a820550935", "value": "4e7fadbf1569f95b4e21b3771f421d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd1245-2ba4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690369579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369579, "uuid": "989dc8df-b375-4925-babc-aaa202442e91", "comment": "Malware payload (RedLineStealer)", "value": "3e0e0e6d1b148a974f44ed81e76b4daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369579, "uuid": "ba89b741-e30d-4d24-b84c-f0b0156418d5", "comment": "Malware payload (RedLineStealer)", "value": "c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369579, "uuid": "b6ec28be-6fb4-483d-ac7f-660dae75747f", "comment": "Malware payload (RedLineStealer)", "value": "6e500bf32412d5f02b5994e016a1c3ee577a1f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369579, "uuid": "663f93e1-a3a9-43ca-8f8f-51de7e3e7a94", "comment": "Malware payload (RedLineStealer)", "value": "313862c045c02a990ff01953e77c84535c5a3013df79b22c6fb599b7e1b69705f6eb9a67fcb4fe9905273219342048c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369579, "uuid": "901b9566-b043-490f-8b57-c1ec20accfec", "value": "T1FC840112EBD88436D9F62B705CF212831F36BCA1DD78822B27969C5E0D73290A57573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369579, "uuid": "07b9260f-6345-402a-93a4-f5b9ed4c6f18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369579, "uuid": "f2c0b00c-988f-4b76-998c-78470e47f565", "value": "6144:KNy+bnr+Yp0yN90QEtdzHtFJ+5AnfcYNRAdFnD8AVDQ1NWXy//Sm7kk5nrKA/t:zMrAy90ZHLmGEFI3+y//sk5nrKAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369579, "uuid": "f2af85fd-c9e1-4853-97b3-460849ab6e09", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369579, "uuid": "2d8e2951-cfa8-4f99-8892-e1996f39218f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369579, "uuid": "31e19654-58e4-471b-a669-de3d64e28c7e", "value": "c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4085fa4c-2bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690373790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373790, "uuid": "0c2376dc-d18a-4e26-a485-c1ff5610c095", "comment": "Malware payload (RedLineStealer)", "value": "ea4c8fd3c2d26a95dad5562a25fdfddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373790, "uuid": "8d3ee762-12a9-48e3-8ca2-551794144e5c", "comment": "Malware payload (RedLineStealer)", "value": "c726b1e0ec6fea88dec580a790bb738a4976fe2f076a838067ec66bc403054ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373790, "uuid": "1a77c114-2353-4bea-9f56-ee5c60639744", "comment": "Malware payload (RedLineStealer)", "value": "9c667037c530458e8d1487d63264d48ee61468c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690373790, "uuid": "27812c20-a791-46f4-a509-6adcd6a2d8ee", "comment": "Malware payload (RedLineStealer)", "value": "c53ff215dd489e9792b7a0e5eb43386b25bdee4b7d02be127232d465c71b7eb3b8b3a3b90da0f9d612f0edc70a5622b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373790, "uuid": "92a7872f-deb7-44d0-995a-4d3f4322fdf4", "value": "T1C6840253EBE89132C8B527B01DF612C70F39BDA19CB8836B374A994A1CB25D0A571737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373790, "uuid": "6099dc46-1101-449e-8549-a0c65fa85f76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373790, "uuid": "c5f1e916-2c13-4885-b619-ed013d51b875", "value": "6144:KXy+bnr+Qp0yN90QEnqqTiS9Kz/8ZVyVgfrxGW5VY5p5xyCVQe5P5XxGnnmJ0bGe:BMrEy90HdfrxGW5zCVQI5XxGnBGy2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690373790, "uuid": "526ce133-ceb5-4b1a-b6ad-9903bdaf6f7c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690373790, "uuid": "8872acd2-598a-48ae-89b5-693e5fb8e664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690373790, "uuid": "1ba344d4-ca4c-4184-9101-62f9a9cf0de1", "value": "ea4c8fd3c2d26a95dad5562a25fdfddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ceedfe-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690365630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365630, "uuid": "9c68a325-beaf-476a-9c7c-4e5153a567a1", "comment": "Malware payload (RemcosRAT)", "value": "bb0effcf01ad576451d0a6c433a90190", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365630, "uuid": "436a790d-1489-488b-97e9-4f054472e116", "comment": "Malware payload (RemcosRAT)", "value": "c8168b5d5ccceb59cc2b1c8c65ef6fffe09cd323ecb46d12ba610b7485c6d864", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365630, "uuid": "b6f9bbd4-8a96-4ead-a5b6-462bbf6a60cb", "comment": "Malware payload (RemcosRAT)", "value": "b056fb142d1c0cf16a0e598d9e888470a7a48ff9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365630, "uuid": "b0d68fbc-c90d-41be-8694-4e2bd1a754a3", "comment": "Malware payload (RemcosRAT)", "value": "a10eaef1b00cc20edc35850e13496d541bddb931870caafd67ca3db3ca257b65d7b7cbca2022aea14051df84a774ba6e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365630, "uuid": "ec6f7360-9851-4b7e-9737-3c5b4b64fc8b", "value": "T10672A218599FD539864702E694428F34F7FEB0A6211100A9791DF66FF8D230CBAFE94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365630, "uuid": "067539da-8c44-4d16-adcf-8bae3a508c20", "value": "384:oJH1pzkI+shyHEanx/PAw4ozxK+6AjapM:iH1pIsYxP5ld9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365630, "uuid": "26f2383e-1f86-4458-be76-0456a351ce97", "value": 17260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365630, "uuid": "223c02d1-1090-4c1e-bdeb-ea37cde72f82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365630, "uuid": "3b6bfdb0-8911-48c8-ba12-46ede4259387", "value": "importe PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447f60c1-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690365636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365636, "uuid": "1fcd2442-37d3-4c6d-b44d-fe592cdbf92c", "comment": "Malware payload (AgentTesla)", "value": "5048c74a6e07f499a1fd6cf10024d66a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365636, "uuid": "e20d510b-f2a0-4270-b301-74c8bcecf376", "comment": "Malware payload (AgentTesla)", "value": "c85f8ecc55cdf0fa63602d5f9aade2c4385062b27e81c3073cea975994df5529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365636, "uuid": "2739108b-f32a-46c5-aa6b-3631e29e6514", "comment": "Malware payload (AgentTesla)", "value": "4f7901766225b1f0f5fe6eda7f96c2444af5b92f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365636, "uuid": "9163622e-2051-482a-bc78-3842167c012f", "comment": "Malware payload (AgentTesla)", "value": "116bd2319b05b769f1b060caa3f1efc60d8c3de4fb48fc23b0677ac014c6fc0702efb791b0ec87cba16933672a100ebb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365636, "uuid": "a74c5c7c-79f6-46ef-bc7b-cf365c226d69", "value": "T188D4D1123EDF500475B2BE9A07FD65A14B3B76211E39D52D304E06190BFBD84E8B1FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365636, "uuid": "2e7acec5-721c-4b96-9751-01cc0e922a5c", "value": "3072:c5XNsn1+7HLDVZsMxzakVTlnsYtB7C09RN5ssCRYSSYbdHznXmxLJIrCsS4CYuGz:Zn+wMxzakIYb7C09RN5ssCRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365636, "uuid": "c0b82ffc-fdd8-4c41-9b8d-c49415c7799d", "value": 637966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365636, "uuid": "0457916b-b7ea-47a3-acd3-c3f6af8abef4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365636, "uuid": "a537a66c-d1dd-41ba-9a9a-2cfc256df49f", "value": "49067-file.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d62d43e-2b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690367476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367476, "uuid": "2a9240cc-901f-472f-89d3-a103ec2ebe10", "comment": "Malware payload (Amadey)", "value": "7a68baa543b15e01793489357f97e22b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367476, "uuid": "9d1263c4-fb55-49a0-8d22-feb696a79a60", "comment": "Malware payload (Amadey)", "value": "c8d28a1e310bb3c0ef473bbaaf28ce705610ed07d48d03871d63fbe7a4702c3b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367476, "uuid": "472ec3af-ac87-41d5-80cb-201ce37eefc6", "comment": "Malware payload (Amadey)", "value": "6ed9cbeb5189501f55e24b4af9888631b240ee36", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367476, "uuid": "11691963-f181-4ba6-9e8c-fda9e6cf1152", "comment": "Malware payload (Amadey)", "value": "2fa8b2f05e5369f2ee97b30813ecb86c1c2d2e3084bb866c67d2de4f476dc2f9cd3c62a7686dc0dcf001dc4024deedb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367476, "uuid": "1117f331-f338-4360-b155-70adc7577d17", "value": "T11A840107A7D58432D9F517706CF603931B7ABDA08E78832B27969C5B0D736D0A532B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367476, "uuid": "04c14084-9f8e-442c-88a0-1c5f61040316", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367476, "uuid": "88931a07-3879-4279-b436-a50338cb5342", "value": "6144:KEy+bnr+Ip0yN90QEn0wj0yJ8PWG75mWBO+q4g7Rh6eYkMFJrwmPrPDSaJFGKIm:AMr0y90ZH8PFm7RN6pxjPmaJFGJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690367476, "uuid": "3263fa7d-a34a-4cde-b5e0-532586efd335", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690367476, "uuid": "08df7140-b611-413d-84ae-c4aecee2ed98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367476, "uuid": "12e05bdd-5856-4c15-9ce7-e482c938cd6f", "value": "7a68baa543b15e01793489357f97e22b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e856de-2b93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690362370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362370, "uuid": "c33bec12-cce6-4dcc-bdec-47360869133f", "comment": "Malware payload (RedLineStealer)", "value": "7ce7d4ea6d9692c73e5ea977b23e4780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362370, "uuid": "30b8f694-02d6-40b9-845f-c065fdc51db5", "comment": "Malware payload (RedLineStealer)", "value": "c9305a1cda60ca90aa4e9bce997f0a40734812a92c5b9e68c421af897caca065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362370, "uuid": "a5d3a2be-674a-479f-b130-3ce47374a161", "comment": "Malware payload (RedLineStealer)", "value": "e6662f399cad1d4634bd5aedb08069b0a49ca908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362370, "uuid": "414c1c94-cfa4-4607-bf57-5261a56da9e9", "comment": "Malware payload (RedLineStealer)", "value": "30766b7100c9b804fe57a5c5c10f4b9ad6a575689e02895dfb01137bd23e22a37091441a2d1049f488fd3cea29b839f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362370, "uuid": "73ac49c9-6748-41fa-8638-5ac480d0e0a6", "value": "T192840253E7E88573E8B22B7058F702931B357CB29D74822A27C5AC5A0D736C5A83176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362370, "uuid": "20a8c2e5-0386-4a39-a2c1-68583c5b8603", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362370, "uuid": "7274fc80-d213-4021-872c-9c20f953da48", "value": "6144:KFy+bnr+Ap0yN90QEugNHgxPV5+qoq/5CHDGAYveiFpBU22nZIqoPjeu6NkT4:XMrcy90Uf9VD8jGAsQ22Z7o56Nc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362370, "uuid": "58013dcb-0f8f-432f-beff-dedea73862fa", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362370, "uuid": "f23e4c4c-c17d-46eb-bc89-8099c3a70646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362370, "uuid": "ca7884ed-d2c3-4150-ba0a-b7fd4bace13a", "value": "7ce7d4ea6d9692c73e5ea977b23e4780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a460f0a-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690365592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "dd00d99f-3b95-4b84-b06c-3122820a9d5a", "comment": "Malware payload (DarkCloud)", "value": "30bf5cc67dfdab0d061e4a94e382c1d6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "331322ce-700f-481f-b6cc-06c80e72b47a", "comment": "Malware payload (DarkCloud)", "value": "c96d918fa251f8c7aa3a3ce7dcecc7ee9f2841254a32815812cefc6fe83e101f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "72951858-fe81-4ae5-a37c-d2f44f311f55", "comment": "Malware payload (DarkCloud)", "value": "60ba01b86a1df951d9ae1dac19493337b185176b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365592, "uuid": "3f3001fc-e092-4f27-8954-1b2baa8b89f0", "comment": "Malware payload (DarkCloud)", "value": "dd76cf88d75ae9805d5348950db6ee5aff185355ee371a829307671e4c542d042bfd9d37796484e4ce2297c9332ed4c3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "1e276257-d40c-4d95-9ba5-d628aa838322", "value": "T1E535165B71DE4177FE151EA01C2A4A28CFFDB01D610EB50B7C25CE8A1E7DA4CC1AA786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "0f13d348-643f-45b9-90b1-65aa48e01eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "36bb1e95-b53f-45ab-890d-d6e9bf93317e", "value": "24576:GrarisNNgjIzBApx/Wg1M88dF0h8tlBnE:Grarislax/Wg1MjF0qtl1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365592, "uuid": "251683fd-2046-4941-9f3d-8a35876f0cf1", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365592, "uuid": "dbcc3c2b-374e-4540-adf1-8174cc32296a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365592, "uuid": "059cf273-6b9b-446d-832c-0edcf8005889", "value": "HSBC-00923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e38b73-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377736, "uuid": "efef01c1-8ac1-46b3-b305-ac909ac2602f", "comment": "Malware payload (Mirai)", "value": "308e7ad299aae280a7144f7971398ace", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377736, "uuid": "d38b5a89-243e-4137-8396-615c90efe6ac", "comment": "Malware payload (Mirai)", "value": "c9b2680e7f4d7e1aa403a030617718a2812b7f6252e7dc0dc5838db54651b6ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377736, "uuid": "7d0c16b3-e7d3-484b-9864-21e413d8a082", "comment": "Malware payload (Mirai)", "value": "8876c5a31ea601956743e1122687a4b66fbaa58f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377736, "uuid": "580fe2c0-a054-4866-ac1a-4773cfafa39a", "comment": "Malware payload (Mirai)", "value": "0f0ab6c1231163323171a9ace8e5a4d5186f9e78c70037603731244562dfd4ee99cfd8698b431243289acff45b7518a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377736, "uuid": "9b2a4d48-eb26-47fa-bf86-28f149ef5ade", "value": "T1A483D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377736, "uuid": "a9c458cd-ef9b-46e0-9ddc-7faf9306593d", "value": "1536:iVLyu95K5skj752dCexuV/8UZlDwfkJ4MYfWD:iVLyMgnFezxu5VD1ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377736, "uuid": "3a7a4f00-ccc7-42e2-bdcc-1356b2c986f6", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377736, "uuid": "4944cf21-3014-48a8-a5c7-e1ff18f29c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377736, "uuid": "fa32c97f-cad9-4b74-9755-f08e6887a44a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fac6d7-2ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690368584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368584, "uuid": "e0ce0700-f303-470b-bc00-e6c7069a8a8e", "comment": "Malware payload (Mirai)", "value": "e7bf56d62a47207eb4536ab2169dcc03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368584, "uuid": "3c62005b-5cd2-48d1-a4dd-dcb7bc014527", "comment": "Malware payload (Mirai)", "value": "ca2e49f3dfd0fdf26500b06a25c71b8c5fc56a03edcb6adcd5bcb6105b83d34f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368584, "uuid": "57f5a318-b42c-42b1-ad70-23d2d191d690", "comment": "Malware payload (Mirai)", "value": "c725a87cb75aab147403436d6080562341c92955", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368584, "uuid": "4a79cc70-2700-4127-97d4-f58c41c90cda", "comment": "Malware payload (Mirai)", "value": "58554a5a64cd706ddf0213ddff710732127dc6c4f23dac61394adb1bfd18c39dfc86b1f1237a8c23c3a24751148dcd70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368584, "uuid": "feb462f6-f220-4d9b-89b0-9ed70eb77fe3", "value": "T137432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368584, "uuid": "b443d2b1-f66f-4e39-b0be-1ece8a8f5ea1", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw0:RqtmZPuutfbltZFBSJsBcfDSTFI+BE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368584, "uuid": "6efd506b-fb10-4fef-8e09-2f4ea531936f", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368584, "uuid": "a24579e2-4f60-4a4c-929d-f3e9d51c1038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368584, "uuid": "5aeb7cec-3736-4e8a-bc19-7696fa28aa98", "value": "e7bf56d62a47207eb4536ab2169dcc03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4988ed6-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356026, "uuid": "a3cc7c7d-30ec-4936-a3ef-95c5e47dc79c", "comment": "Malware payload (Amadey)", "value": "198b86b11f1df13acee3993587f0f34e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356026, "uuid": "9edf438c-58ae-4a45-ab74-ff5e365f2e68", "comment": "Malware payload (Amadey)", "value": "ca33989df1e19daa380e2b8eca0ca4020c48aece063bba014b9f0c0fbc2c4253", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356026, "uuid": "0789e377-601a-450f-8b0c-7e387f567d18", "comment": "Malware payload (Amadey)", "value": "466573a1ca2d43f4c297f62c51ef8266633109e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356026, "uuid": "c7d02841-5113-42e1-b3d8-97fb60d49e99", "comment": "Malware payload (Amadey)", "value": "22c386441a27ce0aeee3755354d9ce763aee7c9c515ecd4734d9435e175b9c5d0823d25a1e670b5b9df355e22f70de48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356026, "uuid": "0fa2ba4d-36bb-458a-9283-16e4a1ce58cb", "value": "T138840143B3ED4433E9B11BB068F706930A3ABC915D74476F2389599E0CB2691B87637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356026, "uuid": "3479f5b5-3807-4cdf-b02e-c6fffcce8cc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356026, "uuid": "b28ed30b-572f-4588-abab-e944f8a176b3", "value": "6144:KAy+bnr+Hp0yN90QEffkWcnZNrQgVCbOE0IikU1kgvWiY1994zWhdzRlHQMGYk9:UMrry90PbOE0IikgV+iY13jhpPHQZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356026, "uuid": "ba4775a5-a170-46bc-8dca-c7329dc463e4", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356026, "uuid": "40734fe2-73f1-4659-992c-991676f85195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356026, "uuid": "38ebd0f3-168b-466f-9de4-a5fd1c59204a", "value": "198b86b11f1df13acee3993587f0f34e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af2e12f-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690385726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385726, "uuid": "75441f79-9cda-4665-98f6-7c550c6e4ace", "comment": "Malware payload", "value": "1c88f016b6d72ca7ef779a70c24db73f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385726, "uuid": "3e749c96-7a57-42e5-9cc2-ef6ba895e705", "comment": "Malware payload", "value": "ca51d2aa595aa0d00df79e4618d8c51595b1ff839817220c266751f37e7bd37d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385726, "uuid": "bf54a3ad-f28c-44b4-9b22-899dcefb209c", "comment": "Malware payload", "value": "76dcf5135ff29c94885da4d8bacca520e8685fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385726, "uuid": "fca88c36-9392-4353-94cc-3537c253fec9", "comment": "Malware payload", "value": "2972d06e80a593587d33c1e6798c60d9b39b9a6ff8e6c2fed35f92b935f4c68174d39f0d99c101705da7db038705eff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385726, "uuid": "e46467d3-e9d6-413e-a0a5-c2dd56b3dc45", "value": "T169F533A316E517F7D6C32478E26662CF337712075AD7CD282E8C3D0115D2D63E1A4EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385726, "uuid": "9c7621b8-fc89-44bd-bef8-5a65708ee784", "value": "e5d16971e92a06f5e2ae459738b4c624", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385726, "uuid": "048a9974-0cae-4eee-988c-3811c8f62082", "value": "49152:lAhEmpgdFvlM27jPry6b4CJgGkN8iqXpHMxnTm5xKa8lPMqKWtPBccL8XPT:lcVGDSU66rGhNQXy0t8lPMq/8Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385726, "uuid": "e2432c9f-34cb-443a-8d26-08d530129796", "value": 3341312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385726, "uuid": "16cffc72-c360-41c9-b88e-d90939bae42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385726, "uuid": "4bb1f4dc-0194-43ea-84ab-2834f32f8b25", "value": "1c88f016b6d72ca7ef779a70c24db73f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eadddfa-2c06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690411663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411663, "uuid": "d031e9ae-e294-4775-89c6-d0998d5ad637", "comment": "Malware payload (RedLineStealer)", "value": "385774b453229d7cc66573bb756210b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411663, "uuid": "7bdf2e60-6876-4a5f-ab65-0eed1c439d7e", "comment": "Malware payload (RedLineStealer)", "value": "cab1077feef7951d2d2771c301437d8d94e1996227085287e5d9ebfd1beba33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411663, "uuid": "83f7dc97-3478-45ca-8d98-87ee1d71ca61", "comment": "Malware payload (RedLineStealer)", "value": "5ba919cc23c0b9ae65646bbda84ddba360d6b3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690411663, "uuid": "73e638c4-e402-4f28-baaf-81c51a07a029", "comment": "Malware payload (RedLineStealer)", "value": "3e68682ac7357ea9c506693a7143fa31e296344465afdaa70bb776425b73134a1b0d0ba362005e95863ecdb3cc6399a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411663, "uuid": "a66fccf7-50c4-4e88-891b-f27ad6e53b1a", "value": "T138840213B6F85132DD7513B018F603C30F36BCA65DA983AB278A591E0DB36D4A57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411663, "uuid": "0022d24f-8483-4309-ae02-4bcde8d34527", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411663, "uuid": "8baa8338-931c-43b5-9ecc-22fe8ac55550", "value": "6144:KPy+bnr+Gp0yN90QEcsiJVuKpq0gMLI9X1jWIYLfqsyhDymDx2YocT1Zbe+UZ:tMryy90qssPpl/LI1ZqLchecTLeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690411663, "uuid": "cf5ea0c5-8dff-45b1-a8a3-eed2be6ce031", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690411663, "uuid": "4cf3e1ae-dc5e-4917-aa42-2b30a58e2512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690411663, "uuid": "872542a7-e4a9-444d-aa47-88148d8b8940", "value": "385774b453229d7cc66573bb756210b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46a73a-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690365109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365109, "uuid": "acced5c1-b217-4cdb-bad0-7b30ba6cabd2", "comment": "Malware payload (AgentTesla)", "value": "de99a2e96ad8cb95691d45ee5cbd5a28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365109, "uuid": "50d52a24-d76e-4f18-8bad-bae3890a690d", "comment": "Malware payload (AgentTesla)", "value": "cb17b28d5f8292983c22a656970e6d94ddc0a86d490c8889433e3c6daa5097b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365109, "uuid": "f31242e1-5429-4619-a4ab-a07e02a39bb0", "comment": "Malware payload (AgentTesla)", "value": "af658f56e0558b936b830261601db40ee7f002fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365109, "uuid": "ea940faf-6706-4613-80d1-a092e6face4c", "comment": "Malware payload (AgentTesla)", "value": "41e849549712dae19fca90e2ba5d5c8fc744a1899fa5628513a3afd05a97a1f19ed7980bec5aa79e775c42c6531fe378", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365109, "uuid": "38e4612c-3e24-4035-bc99-1e093415a7b8", "value": "T138E401487A9C4BAEF5BBAFF0158655206BF1DD5B9571D3830E8210EA892FF0306A1D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365109, "uuid": "fd8b3a7b-44bf-4a52-a865-5290d32f2489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365109, "uuid": "977b5410-4df0-45ec-8527-bf4dcf025d35", "value": "12288:PJmefaynhBA/p0L0XtTiSqWLQ3JqoiwjqKU9/w9HhuYb3mtxEOVpNnjh22bbOLi:IeCQqv5cMQ/iwjDUV6uYQ7h28O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365109, "uuid": "a692ead9-e97d-4a8a-977c-9ada7f7e7d54", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365109, "uuid": "bed565d5-d42f-42ef-8f12-95d0774a431f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365109, "uuid": "57bbb5e7-7ac0-4bfb-8dbc-1111ac01565a", "value": "EDMzGboWJXHFraQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab03f54-2b97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690364009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364009, "uuid": "8309bd44-19de-4496-85cc-d0c2b9f59b5f", "comment": "Malware payload (DarkCloud)", "value": "8d941856eda9ed2762940348ac7cde1e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364009, "uuid": "df74be58-3c80-4285-9476-9628ccba4888", "comment": "Malware payload (DarkCloud)", "value": "cc73f108b12aeba27a3b77b3c8a8e0df2889659ec79c71fae944fa04d2870b0d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364009, "uuid": "b1e45217-4532-4fa3-9bb1-d4bec1da6c8a", "comment": "Malware payload (DarkCloud)", "value": "7a333af072204d26768e8facadad276a1e6bf40f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690364009, "uuid": "26f4c8f0-a13d-49ab-b351-5585bd3d1f57", "comment": "Malware payload (DarkCloud)", "value": "4ceb59e453c4c240dcd327650a90a1265ad8b484542f599b5d4c2128c6b404bf3b31358489a64c7ee359841c9bfe2d07", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364009, "uuid": "b7b257f7-55b0-4cc0-9fbc-36281a000a95", "value": "T1C3051204F35CAF9ADE39A3F20957744427F5E95B5926E3992EC260D3E222F110AB0E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364009, "uuid": "bc8aad74-9bc2-48be-980a-fd14c5b98eec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364009, "uuid": "090fadfe-0d69-4fba-b373-8e20dbbad347", "value": "12288:lJmefaynhcB5DZ4EslUTKFoGy3Qd3xEpwjHGZpxBxORkWMnK+/ATZn/6:KeCQcB5l12KGy3wOpwjHU7BxOCn3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690364009, "uuid": "eeb6bae9-07f5-4098-bc8d-eafd851566c6", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690364009, "uuid": "10ea0bde-e613-43c3-aea3-f8ea339e5ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690364009, "uuid": "65d2c028-0880-4df2-9bd8-9e7b56e6c41a", "value": "SecuriteInfo.com.Win32.MalwareX-gen.17835.14090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f778e5-2bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690372891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372891, "uuid": "831e8bb0-425e-429a-a137-5f4f2a8bb9a4", "comment": "Malware payload (Amadey)", "value": "a1a4eff3529a7970611018af87b4211c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372891, "uuid": "4ad644dd-c631-4e45-8601-7b29bba3df62", "comment": "Malware payload (Amadey)", "value": "cc77f877f5a69c1d71edc24df8af8fdee5a2c97d4b6f9174906d1263e2194c47", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372891, "uuid": "309d2d74-dc31-49f5-b048-2ee573986afb", "comment": "Malware payload (Amadey)", "value": "9a1f0f58f55dccc8f1dbf1629ce6710982d1caad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372891, "uuid": "5570ea4e-0012-4374-973b-69d6c25c25c2", "comment": "Malware payload (Amadey)", "value": "f7e828b9a92c50e4d8e94fd6e3a67dcfcc726baf3aa3f90b7893360ba211fa932768e51016ebb2d683fc7b7309d3a3fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372891, "uuid": "91ef118c-70ad-4e7b-8455-cfa98477175a", "value": "T1B5840103A3E85032DDF5177048F713930A357DA669B8836B3789681B1DB36D8A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372891, "uuid": "f2bd4e6f-0b40-4263-81d7-fdef92874ab7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372891, "uuid": "baceed4b-85fb-4c22-9745-3ab6a7dc709b", "value": "6144:Kzy+bnr+Vp0yN90QE+Yr2hFYDD1ZgzDOHB6yJh5/08NgBZ+t4pDXfDTNdp1koF0:tMrJy90p+YP1+uhHXNgBYCpLnp1koG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690372891, "uuid": "60488c0a-8411-4df6-b622-e915c8112612", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690372891, "uuid": "137382fe-08b9-459c-a03c-51c7a5c140c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372891, "uuid": "2f036866-03fd-4711-878b-1b77fd561844", "value": "cc77f877f5a69c1d71edc24df8af8fdee5a2c97d4b6f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60be2a8f-2bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690386729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386729, "uuid": "f6907430-3604-45dd-aa20-e817a0af5f80", "comment": "Malware payload (RedLineStealer)", "value": "6a0feb970b0232737d1ed6729e4f0f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386729, "uuid": "cecdd037-aab9-4fa0-b07b-72661f89f0f2", "comment": "Malware payload (RedLineStealer)", "value": "cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386729, "uuid": "e4c592c2-f67b-48e8-a0c4-0507faa8421c", "comment": "Malware payload (RedLineStealer)", "value": "82a778375910a0c96a19c6b455a0b11cb23a99ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690386729, "uuid": "c688dc14-e1a1-44ad-8660-ece9a186d62c", "comment": "Malware payload (RedLineStealer)", "value": "018ab1ad6bfe17ffb9e0cb09903efbc63f3b7d02a8ea38025f1ac7dec1e0aec594ca30a029cfe02eea83b9921d58287b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386729, "uuid": "e4fce3cb-bee0-4523-9aa7-41951d6f8f6a", "value": "T1D6840202B7E84577DDB52B7058FB06830B37BDA09A7883573786A9265CB26C0E57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386729, "uuid": "c72222a4-fb20-4cdd-832f-f44ecc7a4805", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386729, "uuid": "01b9f35a-dade-45f0-a8f7-cfe0710f66ce", "value": "6144:Kxy+bnr+7p0yN90QE1Jy1+Jta10DfACoB1OrkI1wxvaf+1bX+Kx3n9:TMrXy90m+JtYYYdDskpxKQ1x39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690386729, "uuid": "6c5adf08-4432-472d-834a-5900ed5e67a5", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690386729, "uuid": "45f17164-a121-41e8-9c61-5bcc2dcde351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690386729, "uuid": "1b459444-dd71-4d1a-9cb8-c47b6ed1bba7", "value": "6a0feb970b0232737d1ed6729e4f0f46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ef71f3-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690365558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365558, "uuid": "95eb14fd-e3cc-4ad3-8223-417b0e74269b", "comment": "Malware payload (Formbook)", "value": "e5a202adbb07b34e36fca0c4bf5da156", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365558, "uuid": "63152ba5-b122-4c6d-8429-8ca24498b97b", "comment": "Malware payload (Formbook)", "value": "ce1ed6c75e5261ea509a09cf2cbb4eca2a28f9ac4bd40d0ede711608233546da", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365558, "uuid": "fb63bae8-dfec-4ae8-86b9-7ae3e2f51bb4", "comment": "Malware payload (Formbook)", "value": "1a10c84b47a80b111e9f0d446b3945c9e10d3eb3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365558, "uuid": "1ce7dcf9-c74f-4ae0-89ec-da9ed3ef2919", "comment": "Malware payload (Formbook)", "value": "f603cae2b83c10ea863b3f5ad0298c51859d4f6d1b3fae9a0378616794a9fdcef3e4dc301774324dbf9801b571e23bea", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365558, "uuid": "b9001bdb-e66e-4bc6-a242-8e83ea71721e", "value": "T15A441218A7E1C8B7F4F3177009B507295FB6E13222709A9B0780BE9C7972296F50E736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365558, "uuid": "9819a8db-5fca-4762-9277-35a819150289", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365558, "uuid": "99dcb37f-8283-49e2-a5c3-c7ad7424e83e", "value": "6144:/Ya6bSv/MafR6CI9+YuYQBnsa0EAz0i1e+y:/YpSvEg6V9ilZlAzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365558, "uuid": "599e2183-7074-4d9d-9663-4456c8deadd1", "value": 268075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365558, "uuid": "dcd565d0-d052-47ff-a903-3cc3592df6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365558, "uuid": "2c0a95ca-30d1-428e-b622-919ca7dc842d", "value": "DHL SHIPMENT DOC BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b45ad1b-2ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690371687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371687, "uuid": "fed00ee2-a991-4b17-9488-f8cb3113c3f8", "comment": "Malware payload (RedLineStealer)", "value": "5495c50b7d6df8f51cea9f6516cfd039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371687, "uuid": "181a5748-678a-48e9-a9ad-0fb98eac694d", "comment": "Malware payload (RedLineStealer)", "value": "ce257dabd4c7e23930d02af8f76c3dafa717c04f08a25429394c90e3c43ea410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371687, "uuid": "535e69d5-e7ad-4c41-9ee9-19f0d349f7fa", "comment": "Malware payload (RedLineStealer)", "value": "73a2a1212ef46240fb8f0379f527e79e87033cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371687, "uuid": "6dbb7faf-d19c-4377-a665-bdbbd0b3066c", "comment": "Malware payload (RedLineStealer)", "value": "24cab66e5f7b692ef503331992bcaf0aece9fa0e2189162cce5f7c4fcf4bf100f10993e4a7df69e82ed9910b113c2be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371687, "uuid": "0fa4df72-b0f3-4082-b9bc-2e6f95670279", "value": "T197840252E7D48033DDB1177058F603831E32BCA55E7C825B2785AD8A0CB3AD5AA3677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371687, "uuid": "84cb4297-5121-4a93-90a7-6b6a67ce5166", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371687, "uuid": "55d75c54-b994-4f3c-a043-e729aa84bb8b", "value": "6144:KKy+bnr+pp0yN90QExVfB3vKj9X0UVz0C/sRxR/hRILwKb5m/H1gM9utVRjYpBy:KMrhy90fV53iw/HILwoE1c9jay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371687, "uuid": "fb56313d-e56d-4bfb-b7f3-882f3b606ce2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371687, "uuid": "be0cb8c2-c7eb-402a-92b0-8f73efaa08b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371687, "uuid": "a59dec18-e0ab-4aa6-8bdd-571d80ced4c2", "value": "ce257dabd4c7e23930d02af8f76c3dafa717c04f08a25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d915a560-2b8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690359443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359443, "uuid": "e2587a74-24c9-4705-bc9a-59b6620f1385", "comment": "Malware payload", "value": "7a9983d071e5e6f0ad0128a2e2d8b50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359443, "uuid": "7914ae61-a4cd-418b-80b6-fabd2d1b6739", "comment": "Malware payload", "value": "ce28a55316503e649b423720f756482500d324ca2d8c7b4a1556e8faa4459b85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359443, "uuid": "754355ab-59ec-49f1-9983-ea3bb9910d16", "comment": "Malware payload", "value": "e6f1365a2305ddc21a2ee7f8059c0d0aeb397704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690359443, "uuid": "a35d6a94-00ad-4c3f-a9b6-2849bcd451e3", "comment": "Malware payload", "value": "968f270707af54aec36c4a0f2af85fef11421f3d90c77ec1d471d1cacc3655a67a3110d2597652ec98b47a80233cbebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359443, "uuid": "4fa3b8c9-6d26-420d-963b-224068238f0d", "value": "T19F15C25B71DE4167FF155EA01C2A4A28CFFDB01D600EB50B7C25CE8A1E7EA4CC1AA746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359443, "uuid": "8f83edd2-e20d-4d14-b501-51d12fab16f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359443, "uuid": "5852bf8d-7abf-4ccc-9543-b03d544dd790", "value": "6144:Q6u1KZdoeU8OnFiKPBbpTo8g6fj6KZdoeU8OnFiKPBbpTo8g6fjJtsEudi6YzUmj:Q6mrarJtIi6SUOa7VuEigNSgSFJFcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690359443, "uuid": "f1a8e4a4-a41f-47a8-a1ed-2dcfed6ef18f", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690359443, "uuid": "a2458b93-bef4-47f1-9580-e10fb2e53011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690359443, "uuid": "c8d3acb5-b18a-4ebc-a026-850adb3091fd", "value": "NEW ORDER 0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d321c69-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690361463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361463, "uuid": "05cd48e1-db86-40d1-a316-9cd9f84085e0", "comment": "Malware payload (RedLineStealer)", "value": "9d1c0ece85aeb9bc9b3c2ce85f8dbeea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361463, "uuid": "8dd7fb95-b5ea-40bc-8b60-cdc2180a5c35", "comment": "Malware payload (RedLineStealer)", "value": "ce6833b5ce3a9a32412c31b1e89d814f1e1d10e2988990a33ff8c0734776e56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361463, "uuid": "48952e19-e371-42a7-82b0-ef5ca6ea4791", "comment": "Malware payload (RedLineStealer)", "value": "6e4fc8e57415bb0926e5d93a4de09e4916048a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361463, "uuid": "7bdcebbb-3f33-402a-8639-244744f4fa62", "comment": "Malware payload (RedLineStealer)", "value": "5dd722490816507cc46200a1a513e05701ed22fdeedcd836c6fd7241e82ca17c39990065ad3952c358f1578626cc1351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361463, "uuid": "c0026d98-f669-411b-9417-a93c3132fd62", "value": "T1E684F202F7D98032D9B5777058F612D31B3ABCE19978936A2349A90F1DB27D0EA31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361463, "uuid": "83a7d22f-18ef-4b0d-b2bf-5b17ede98e42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361463, "uuid": "8ae625eb-9211-4c77-92fb-9b7fc8185eda", "value": "6144:K+y+bnr+yp0yN90QEoUA6aw4Cx/QM2ragQZEmsXPPX4uR9mreY54pbEOSUQxTI:aMrCy90u6awX0lSIPX4eW+pb1S50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361463, "uuid": "0795a31c-e215-4a55-b0c8-97ddc4907c1d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361463, "uuid": "21eb22d8-bf9c-47ab-b411-d88ebed592f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361463, "uuid": "ac8d25e4-14df-449d-b605-eee45c0eb4d7", "value": "ce6833b5ce3a9a32412c31b1e89d814f1e1d10e298899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56766546-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407757, "uuid": "37c286ac-55c1-426b-b72d-45e1858b0f68", "comment": "Malware payload (Amadey)", "value": "ac4ef0a8163aa70cb3fb5a2c03402872", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407757, "uuid": "089d8c69-c822-441e-bf7c-077f229b6aa9", "comment": "Malware payload (Amadey)", "value": "cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407757, "uuid": "efde8f90-50d7-4b70-bd2a-bc7e035db89f", "comment": "Malware payload (Amadey)", "value": "1f1ce96331c7c08e874f90e466a2617aa1295cfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407757, "uuid": "0b343177-edb1-4310-9671-8ef8d79674b5", "comment": "Malware payload (Amadey)", "value": "d05e2dd59f610cc2459a600fe16b5de2e2f53e535e361ded64ba538245737bbd7ca13a7a74f9822cb895a5c369673bc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407757, "uuid": "bda24900-6fd2-447a-84dd-e4b9bc1e153f", "value": "T13E840217EAE89036DCB4277068F603D31A367DA19D38576F2346AD4A0C726C0A97277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407757, "uuid": "094b1476-98bf-4211-9d1d-4da5ad08815f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407757, "uuid": "924d50e4-faf7-47f0-bc5f-1e44b5eebd59", "value": "6144:KYy+bnr+Vp0yN90QEjJh/9hdzrnZ9YgDCV4ZfWb33aY3sJ41IwTSU3VqAtGay:8Mr9y90RblfzPtDCV4tyHsJh5AtGay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407757, "uuid": "f8f59673-1216-440f-9b19-0c515b30119f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407757, "uuid": "6547355d-1094-464f-8161-ac43b2226f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407757, "uuid": "8a083419-d7d5-4575-81aa-0307f35ea601", "value": "ac4ef0a8163aa70cb3fb5a2c03402872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4a47da-2b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361465, "uuid": "e5eabf48-04ea-4649-8c4a-3d3a109b46d2", "comment": "Malware payload (Amadey)", "value": "aa67c8b6ef266e87d15fd135bdc772b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361465, "uuid": "82ef0614-aa07-407d-843f-062c960eb8c7", "comment": "Malware payload (Amadey)", "value": "d0ab1c59017ac38ca4c1af4c67387dfb025cbb3c4a10d61eff0fa533d069abe1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361465, "uuid": "ad09a63e-3941-4a1b-a8bf-45727d14033f", "comment": "Malware payload (Amadey)", "value": "149b43b9aa4e5836eddcfa4d9cca8a2ff0992aae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361465, "uuid": "7f40b061-3b3c-4c2f-a337-824fc1ee5444", "comment": "Malware payload (Amadey)", "value": "b407f03ff2ae3e2fdbbedc4e0cfb13b1e8b8efbd8e509e4348491e88820be9e6c0095a338008cc80c37852c50170a4f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361465, "uuid": "5dea3e07-846a-498c-9b44-2e37c0c3e777", "value": "T1CC840153BAEC9022DCB52B7058FB02930A3ABCA15D78935B1681AD9E5CF36D4943137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361465, "uuid": "1caf9f25-6fc4-4854-83bc-fccc4cfedd0a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361465, "uuid": "5ed916bc-b9f0-45a5-b396-af8998ae81a4", "value": "6144:K/y+bnr+Bp0yN90QE6Wef49btLWKgQ234YAsPmMj6g0cKJPzYc+lsH2VoHKfhRhU:lMrRy90Kfo9CopsPm11LnLWVN6o6/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361465, "uuid": "3af98b66-02dc-430b-bfe5-975f6afb47ba", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361465, "uuid": "c4f30de4-a2a3-4702-b179-7b2f8a03070b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361465, "uuid": "fd8c41a9-b2af-4477-a7b1-12aa364ae668", "value": "aa67c8b6ef266e87d15fd135bdc772b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbec029-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356978, "uuid": "b26fcc98-cf4c-4744-a6ab-8eeafa34088e", "comment": "Malware payload (Amadey)", "value": "f76d668011b33d03f67bc9fa23c81bde", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356978, "uuid": "3a2b6765-11ab-492c-b593-5b9bfdbbf825", "comment": "Malware payload (Amadey)", "value": "d0b3b8a62e1723d68aa8310272cc13b5a895a72c437a807947ce86ed4868e108", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356978, "uuid": "2e340d3e-1fb6-4467-a4e4-96a8c707ae20", "comment": "Malware payload (Amadey)", "value": "c28072c0d260e08974d19af9049c4e7eb47f6048", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356978, "uuid": "2d125239-8085-4cfa-be4e-e7d5c248d9c1", "comment": "Malware payload (Amadey)", "value": "7bbf39286265453bb4b1ff159b4a5e4c56ac45ca9fd583592cf185341bb50143604113d8a26b7792c51347755188a77f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356978, "uuid": "a99bd695-6101-49d0-987a-9148586253f8", "value": "T159840203BAD89073D9746BB058F60693063A7D715D38936F3B86A95F5CB22C4A43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356978, "uuid": "9c527ae6-fef1-43f7-b664-8f5a14b35393", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356978, "uuid": "eb0b421e-83d3-4542-9838-20b232cb6751", "value": "12288:IMr2y90Cb4ZDpSn6A/J84wbcFgBYCxJWXY:uyrboKB8cezOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356978, "uuid": "3567513f-179b-47d8-9031-411b76d2cc0c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356978, "uuid": "e21c923a-5d0e-41e0-a573-7a2454faeef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356978, "uuid": "f6db815a-2230-4d40-a75e-b65c0d883076", "value": "d0b3b8a62e1723d68aa8310272cc13b5a895a72c437a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3cbad5-2bbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690380705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380705, "uuid": "9df2f587-5588-4dbf-af11-71884cb78f46", "comment": "Malware payload", "value": "e4d6e682160687bc58554b3c7adb03c3", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380705, "uuid": "ba5847d3-2109-498d-b257-b60895cb3624", "comment": "Malware payload", "value": "d0f7eeb50c79e177f9fa768db2a16cf58b607a78b9a4d00c973545504536153a", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380705, "uuid": "93f86a33-cc2a-40ec-939d-5a74ea2de0ed", "comment": "Malware payload", "value": "056ea7b70b3294071c2b3490167f163f5ada698c", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380705, "uuid": "4ffa367c-3fdf-41af-b03e-9e118a0d1bbd", "comment": "Malware payload", "value": "d787c787de6e57264bf94c5009d87b4ff269a4d84063372dec12faccba43c883357f2bde6e02aa632bdbc7e32ba030af", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380705, "uuid": "03d3434d-20a4-4cd1-acc7-90ad9d322d20", "value": "T152F44BF476D07BD70F75290DB3CF41B23D64B857F0EDAD8622890D1E5284298C9BAEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380705, "uuid": "db07ef38-d3bd-4a53-a1db-af838012a0db", "value": "12288:CCbxItjm+UBsOg8hhUofPrMNDbcepn8qZitVZGn/4xw+wPzwjMwl:Wm+CguNfP4nfn8qZfbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380705, "uuid": "f90c7d91-472c-475b-ba7c-29078006a6ff", "value": 780298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380705, "uuid": "2f69de4d-cd54-4551-aac7-ee4cf9b60d57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380705, "uuid": "6ba3f15d-2676-4cf4-b46b-4ec18be2e9ae", "value": "kekimphmsxvbckjkgfvermutxsgscsqeqxvispicyftqwthdte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f521c1-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407736, "uuid": "530270c2-7e7f-4cb8-a6be-8d02deecd8c2", "comment": "Malware payload (Amadey)", "value": "28fa1a8e0edb5d92b5511205f92d03fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407736, "uuid": "f374b539-e122-4801-8683-e5bd54d80aac", "comment": "Malware payload (Amadey)", "value": "d1705dfaf9b91b0197b75bee063ca0640e552efc202a3c0b7ea44168c6785711", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407736, "uuid": "aabfe61d-ac6a-4f4c-b6f4-57d6355bae55", "comment": "Malware payload (Amadey)", "value": "8a431ac10847010db1c9ad6f9b52717e7bac9f7f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407736, "uuid": "0c7bc8f9-cea9-46b8-90c9-f9882b502bb1", "comment": "Malware payload (Amadey)", "value": "c857deb8063e0f42da90c9a4cdde8e3ef97276f20bbe8f976f0fef05544acd374a58877442bf197fbe2a1e6f27001346", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407736, "uuid": "73501aab-50d0-4dae-ad38-7c1f1b02e51a", "value": "T150840253FAD44073D9F15BB0A8FA06830A36BC615C79C36B2740A96B0CB36D4B97536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407736, "uuid": "2a058255-b94e-4bf5-9ae9-233eb264b7ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407736, "uuid": "95b3efd5-2b12-4419-b59d-cd81f39ff7f5", "value": "6144:K1y+bnr+7p0yN90QE8XxNicwnGlX3EFcpE0fVVhs5T2qKZ97py+GpgBZ+t4xDUak:7Mrvy90KXIGl0HHKZ/y1pgBYCxJwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407736, "uuid": "467d4226-fca8-4869-9b7e-3c8f25624f34", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407736, "uuid": "a3866921-f4a9-4a5d-95a9-195ddec6d8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407736, "uuid": "14e50586-9e94-4970-97ae-61cbeb908af4", "value": "28fa1a8e0edb5d92b5511205f92d03fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b215ce-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690361771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361771, "uuid": "e453b4f2-6750-460c-855b-d99205372229", "comment": "Malware payload (Amadey)", "value": "4b0e9deb67993f426193ae4600e009e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361771, "uuid": "c2d947fd-326a-4e1f-b263-1a1a16fc633e", "comment": "Malware payload (Amadey)", "value": "d20f56e7fae7227d79ccb2c6bc7a458f12ed5cf61bd4482196f2bb167827b959", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361771, "uuid": "06fd2b7e-1de0-40a7-a44a-458538098cbb", "comment": "Malware payload (Amadey)", "value": "4d9e39e07077761256634cc39d1b1de40ce54189", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361771, "uuid": "348d4ba4-951e-40a2-b070-d0cf098438cc", "comment": "Malware payload (Amadey)", "value": "ca401115ba2ca707654e18e53821f3ebe5b548f8bbaadf9c34223a7cf149261ff4fecd20ccd96d52f6acd751e404de3c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361771, "uuid": "99227997-904e-4b8d-b090-2d96855161b6", "value": "T12B840103A7D99433D9F51BB098FA03D31A387CD29D78832B2385A95E4DB3694A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361771, "uuid": "fa2694b6-464a-40d6-b87d-d4693aeafde4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361771, "uuid": "7186288c-c579-4e21-bc1d-fbef67baf113", "value": "6144:Kiy+bnr+6p0yN90QEJ0Jy2hvYJ9YD6Dfr0rg+IgBZ+t4yDJEYv0GmQzy2:aMrOy908y2eYmDforKgBYCy+Y8GmQzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361771, "uuid": "280046f4-0432-4690-aa14-13fa5720e8e6", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361771, "uuid": "c0f0d04d-c91e-42b9-9d6a-a322c360f6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361771, "uuid": "629864cf-6f05-4a13-92da-0adbcc7bf0ec", "value": "4b0e9deb67993f426193ae4600e009e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f764a-2bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690379974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379974, "uuid": "433ca677-3f93-43d9-9c22-8f4feb791293", "comment": "Malware payload", "value": "691a54b032d616e5f9303557ffd49add", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379974, "uuid": "0223d0ed-ed78-496a-89cb-aaba10f40063", "comment": "Malware payload", "value": "d24cac5596825fe9f802f9aa40201452c16f40fea1b4c46b5a23423c13d7f180", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379974, "uuid": "b3346155-35b7-4dc4-af13-39fd305f319a", "comment": "Malware payload", "value": "f1361a480c7171adc2c0e370e0c31b3c7758d18f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379974, "uuid": "f00b300f-9039-4d51-90b0-2ac64b66805c", "comment": "Malware payload", "value": "8705e9520ba2a7cbc502a5e47c68bb12f36b90d68f436a3dd7acda00f65395a1e7be4ad40b35a16091b1f3335211b57d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379974, "uuid": "48f9eb5e-e793-44cd-88d1-ed6a6387fb12", "value": "T17FF39D0A63E520A6E4BA57B499F202839A31BCB15B7592FF12C5D57E0E336C0B532F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379974, "uuid": "012897cb-9313-4fb6-9d70-72bac0020389", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379974, "uuid": "c6e4734d-9a6f-4c8d-8345-f04d6d8ed32d", "value": "3072:sahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEk1bQiu0T:sahODp0yN90QEKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379974, "uuid": "6b0c0794-7ed1-4810-92b1-3ff28def4384", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379974, "uuid": "749435a4-8492-4643-8b31-059fd18ce798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379974, "uuid": "651db27e-d786-4064-9c47-b52694378552", "value": "691a54b032d616e5f9303557ffd49add", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b9b119-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356330, "uuid": "05260a3a-709d-4259-ac81-17ea51c82c75", "comment": "Malware payload (Amadey)", "value": "5a602696169cb3fd1e4976bab75ac718", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356330, "uuid": "e9cd546a-2356-45d9-9b18-503f12dade62", "comment": "Malware payload (Amadey)", "value": "d392541e196f274ad3434900283af23481a728632051e91f498b800b66e9c4f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356330, "uuid": "c3b56eb4-a994-4857-8135-5099bdcb32cc", "comment": "Malware payload (Amadey)", "value": "3771407eab1e57d9632539fddd1aa14676b164ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356330, "uuid": "48920b48-0f19-4a41-8188-a478e4bfbef9", "comment": "Malware payload (Amadey)", "value": "5097ffbd78c15f8a658231921e1c9545b0673c76d89f5eb77a39e971825911947538b25c0424948d98dae2dbbe13ccd6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356330, "uuid": "9b19b815-8ff0-4a85-88a0-eb9e502ec405", "value": "T1BF840103ABED8532E9B5277058F707C30A35BDA19EB4876B27856D5F0CB2680A43573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356330, "uuid": "cd98bc7d-3c7d-4de6-9f61-48079dd176ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356330, "uuid": "5cf88ea1-82bf-4db0-9e3e-37df49ee24b9", "value": "6144:KYy+bnr+zp0yN90QERfAsrQNe4RUuL5dvlExBI+GopV2eIxWrl0rdHqsmy:AMrry90sRvL6xNDCeIxWrl05HqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356330, "uuid": "6db73610-2772-492c-88aa-b1921845186e", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356330, "uuid": "c5d9c5dd-e33c-4567-9564-7af7555fcc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356330, "uuid": "489890e8-ad33-4c09-a56e-d76f2ca0342e", "value": "5a602696169cb3fd1e4976bab75ac718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abe9132-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351017, "uuid": "929ff00e-b4de-445e-8b34-5fec4743d2c5", "comment": "Malware payload (AgentTesla)", "value": "add80054c24b732da5650d1380bc7cfa", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351017, "uuid": "85a329ec-19f1-4182-94fd-a8666d34bf08", "comment": "Malware payload (AgentTesla)", "value": "d454b8b5c1609c9179e3ea40540729834ce8bbcc3345af7dd10af790f1222f75", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351017, "uuid": "181e293f-bbae-408e-b0e9-5c055d2ae420", "comment": "Malware payload (AgentTesla)", "value": "1be428e8a0213c68d4dce2e37ff259c9f641af5e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351017, "uuid": "3fdeb99d-8a5a-4371-804f-7fa0376256c3", "comment": "Malware payload (AgentTesla)", "value": "d136e7386fc30c86b08039df2955380b65e19c565975dfcc5563817398f1c35313cccb0ed292f0d984fd8441a2526e55", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351017, "uuid": "ee8045a2-a71e-4ed0-a719-97090267058b", "value": "T129C42362722DCCBA95C18C78D01B87A817FC5D0ADF46277B941B66B4B3EA5E89C013C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351017, "uuid": "d6770c28-aaae-4ec6-a491-4f94a516f400", "value": "12288:iIyqDRIeSAwdxSnYi3jWdAVPMv6X1vMZrp9mo7Zh:iI3KDAaAnD3jWSEE1UZrP9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351017, "uuid": "a4765104-62bc-48b5-a900-05f9a76fb23c", "value": 573752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351017, "uuid": "061b3e6b-9f2e-4e75-8f67-924bfd2bb2be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351017, "uuid": "81c2c84e-36e6-446c-a880-eba9f95dcf4b", "value": "purchase order pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaf487e-2bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690374943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374943, "uuid": "9438f599-3973-4b9e-aebf-3e4e20e350bc", "comment": "Malware payload (GuLoader)", "value": "aeef384ff0a9b5c94e84348d8a6fdc79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374943, "uuid": "7fca8f90-c706-4a48-a621-68c22326f8ac", "comment": "Malware payload (GuLoader)", "value": "d4c65b87adae3913a730961c55284473afd9522648dab49cbb44eb716918ea0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374943, "uuid": "fe8fd9ea-dc5d-4744-9a6e-45b0c8d4ba8c", "comment": "Malware payload (GuLoader)", "value": "8ec6ece663904a9bd5062c8a7d58156f3ed6d31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374943, "uuid": "2721d1e2-3234-4738-883d-0744965784b8", "comment": "Malware payload (GuLoader)", "value": "445aa9101dfeca76de02603c95bdbbf21e68ffaed7f48d9b0711f482b03ccd6b1e1a8bb9077ad509bf282854fcd7bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374943, "uuid": "6be5c287-f97b-4a8c-8ea8-e1d6c0625066", "value": "T1A4059E763A80C7FACFB1BDB2792B48787B56AD7F5058545B338033C907F65A29832606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374943, "uuid": "11217dae-9357-47fd-9b8c-3ee2e3374bd2", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374943, "uuid": "6dbc89d7-cc6f-4ad8-a735-4910641369a1", "value": "12288:pIkdkz6kw3kfkVxkUxkekKkpkRqkwk+kTkZkJkDkqkzkAkkYkk/ck7kAkkPkkjko:pg3MRT3FSf4hANnoVIqtmc0QjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374943, "uuid": "cfb0f432-6828-498c-9c73-14a89bfdeca2", "value": 862440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374943, "uuid": "9c9258ed-efe8-47f4-9f0a-d33491729eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374943, "uuid": "3cdcdb00-146d-45aa-862f-cf2edf57c949", "value": "IAENMAIL.-A4-230726-0830-0002632.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744885df-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1690361851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361851, "uuid": "63aa7984-886a-4491-bed2-a24664f294b1", "comment": "Malware payload (Phonk)", "value": "32400931e8041f412855c528c508750f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361851, "uuid": "9cbb9d4e-68e0-413d-9191-701b3977ec37", "comment": "Malware payload (Phonk)", "value": "d50f991aa16a5a8c47c7766c69417096f40f0efc5541cb4c1fd9c0f1f2bb448b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361851, "uuid": "e07d8609-fcc1-43b0-bf84-364c68217f15", "comment": "Malware payload (Phonk)", "value": "d21224e0b164e6e617008398bfce951d942cf319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690361851, "uuid": "cc7d50d4-2d94-40a8-8421-3b0f9da99544", "comment": "Malware payload (Phonk)", "value": "16fcf28b41c79217e5bb5764366a482501fedae5559b3224a2c550ae325058ae304bcbfff3ba126d0d9cdfec695bb38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361851, "uuid": "53375e87-81d6-42c1-b39e-fe31546eeaa4", "value": "T192A5390B37450D52CDFE23F5E6F78E085BA1D8035728D69E2581A3D9AB5EBC3990D283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361851, "uuid": "90bf5fa0-e25f-4e9d-920a-40d1d3ce8cd3", "value": "24576:CpyltMyPNXmgL4qJafIHlDTd8m657w6ZBLmkitKqBCjC0PDgM5A2szxqeKMSudVX:9l3NXmmnaSRVV1BCjBaYeKdudV4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690361851, "uuid": "a67bd57b-19bb-4af5-924e-2cc8b79ec04d", "value": 2150072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690361851, "uuid": "dc532ecb-93fe-47e8-ae96-56e4915973bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690361851, "uuid": "298624fa-c108-44a7-b3ca-5d8f93d7be2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af945fc-2b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690347098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347098, "uuid": "c53b4fb8-dff5-4859-ab15-129e14e96ab4", "comment": "Malware payload (AgentTesla)", "value": "4973639fdafc5f4c42e6fe6e502e822f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347098, "uuid": "0583d21c-f7cf-4b10-81b7-fb02589c7cee", "comment": "Malware payload (AgentTesla)", "value": "d63f001d996d530575f01103662b84d1daf8fecd37cc36fc5990458b2954b567", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347098, "uuid": "f8a20d90-9d59-4c38-b4fb-eedddec7039b", "comment": "Malware payload (AgentTesla)", "value": "fbbdaa1921d0562ca7dddb2c40591fb0544d98ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347098, "uuid": "e2241825-4182-4c8d-b6e1-51cf99abaf54", "comment": "Malware payload (AgentTesla)", "value": "631c68661a70f8a8bd4bc561fe6eba188f9843a26b4c818294bfe3e188530a1a56ab6e10a7545908df98de9c052bb078", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347098, "uuid": "e2dcc91d-c12b-44d7-a60a-52422e9e141e", "value": "T17FD4236BB35E04A6E240547B447B16C22407FC523C1BB6CA72E48EB5E2D773B96406FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347098, "uuid": "affa6697-6296-42ab-8ff2-18b8697142f4", "value": "12288:bwmeyTbOh5EsxryYQTCEsiglDUP/qwWmNAISKeY5EeN5ESLzLK4kWRc:bwmeGOX7rylglQD7AdKeZevXzvkYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347098, "uuid": "b7d85943-9bb0-4af5-af43-91e5c1e0a5ef", "value": 612723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347098, "uuid": "22f07347-a81f-4c47-9d5f-2be7f2f171f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347098, "uuid": "9405a3fe-716c-4487-842b-95dc0d4c160b", "value": "PLT20230402-0332.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7816b2ad-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690351120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351120, "uuid": "9829d53a-28fa-4a48-91b3-22cb444809d6", "comment": "Malware payload (Loki)", "value": "000529bc71ac9735e2415e87dc05feb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351120, "uuid": "465ef582-65a5-49e6-a253-21b5eea3c294", "comment": "Malware payload (Loki)", "value": "d6465d186fbbf86e7a977a123572c69c79b95f9fb23c8370582593d3875df61f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351120, "uuid": "ad7469a5-64e1-4941-96f0-45eda2220593", "comment": "Malware payload (Loki)", "value": "5f8a6540ff331cba9eb37ae09acacc2ad3f5cbfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351120, "uuid": "a908f93f-aec7-4741-8cf7-06bc20b0a73f", "comment": "Malware payload (Loki)", "value": "98fe90d577841f0e45c831df2df1b51f37f1ea5c7dfea3948d9fb0e9a3c70656c94026c817991a1093fa0aae0adfd652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351120, "uuid": "4209d1ca-95d9-410b-b999-aaabb4b111f3", "value": "T198B4125671BD6F35CA7593F02690C90047F6A5AF7073E2192EC922EB8633B2016E1F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351120, "uuid": "34a51a7b-b3cb-44f5-a3ef-73faa1167fbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351120, "uuid": "9a00c6fa-7a66-4a9a-82dc-d667321d3e56", "value": "12288:Pf2iN2GULIdewrKNwiwglaV2ULEf7iBb:Pf1xUL8viBla4ULEziB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351120, "uuid": "579d72b0-76c6-43d2-af11-37e22d1d7556", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351120, "uuid": "398480e6-c908-4c66-b344-36626bb48df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351120, "uuid": "c59c818f-3f60-4218-bfda-5d691ab3ea95", "value": "PO#130460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c787a9f2-2bf9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690406228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406228, "uuid": "f1645cbb-de18-4c06-86b4-5f51200ecc15", "comment": "Malware payload (Amadey)", "value": "1c2abdcc881f4bff6162de485791a3fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406228, "uuid": "ec93d77a-6386-4c87-aaf7-1bedc1c44133", "comment": "Malware payload (Amadey)", "value": "d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406228, "uuid": "edb951c6-b7a6-4bb1-9224-6faa9ad82187", "comment": "Malware payload (Amadey)", "value": "7cbe151af7d6a24026efee50a585397cb0d9c516", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690406228, "uuid": "6ad32e9f-9dd6-4ff7-8667-45d5c8ca6863", "comment": "Malware payload (Amadey)", "value": "fc2378e3d26da5e6f86abde6f7750c1f24b912a58121ef0f283ac67e95261d293e5cf88125d1627367401e9b40272d34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406228, "uuid": "57ae7e25-78d5-4e0a-b462-44195830bc70", "value": "T160740102E7E98032EAB52B705CFA12C30B35BDA6AE79831B33559C094C73794A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406228, "uuid": "603935fc-7c7f-4eee-becd-05334a66d977", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406228, "uuid": "04ea14f7-e3f3-4e59-bcfe-a6011e0023f3", "value": "6144:K+y+bnr+qp0yN90QEAQegx/CUYC7Fhec0EfAAYXwwLo9/cItKNR/WU1Q90b6f:mMrCy90hljYWhEjA3/ztKNNxL6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690406228, "uuid": "45873f64-a396-44a4-9450-570d18392e1e", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690406228, "uuid": "6b6ba686-20a2-436e-8f59-24b1eb253b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690406228, "uuid": "e6497844-e6fc-4e29-81ed-a72409224a16", "value": "1c2abdcc881f4bff6162de485791a3fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f4b268-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356062, "uuid": "cdf3a1ee-589c-4cee-ab7a-c4a2daa6fd2c", "comment": "Malware payload (RedLineStealer)", "value": "464730722d645fee3f09aaa2958611c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356062, "uuid": "d9ec57a1-c164-4b71-bd9d-32b2babf5f50", "comment": "Malware payload (RedLineStealer)", "value": "d7de9ab7506bc6aaf75999c6d0d09ffc0d6a00808f5d0794ed546857e54f2815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356062, "uuid": "ce5d57eb-e9a1-4409-9af5-2f0c515b19dc", "comment": "Malware payload (RedLineStealer)", "value": "010e809286961028e5b7489f2132431bbfd3d3e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356062, "uuid": "e9ed132b-4f59-4f8a-aa5f-fd85b9403515", "comment": "Malware payload (RedLineStealer)", "value": "c9bfeb1a2175680411ff42e02bc74f4646e624aa9d4e3ef5d6f4db8b0dec49243dc5c8140ecca25351f8245742183a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356062, "uuid": "2a0a169a-02b8-47ae-a0de-7d0937bc6596", "value": "T132B41217B7E94473C9F12B705CF603D30B397CA2A978873B27995A4B0C726806971B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356062, "uuid": "33058328-732c-49ac-810b-d0ed9b2f50ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356062, "uuid": "1de40859-e5f8-4dd5-abde-c5df55cac6f3", "value": "6144:K5y+bnr+7p0yN90QESm0LZdmBOasDEfSm4rxUzJ889U9wlw8ZjAx3xJXX1fqKxHM:TMr7y904krag4Vu882OdZcfq2ZI4zU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356062, "uuid": "745b3b11-150a-42ad-9137-0a2012f48848", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356062, "uuid": "7f4c181e-6e75-4834-98fa-99fba7f8eb3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356062, "uuid": "3dacaa4c-6a82-4c9f-9962-b36583dca988", "value": "464730722d645fee3f09aaa2958611c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118e9ecf-2bb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690374999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374999, "uuid": "c1065cff-b0d9-4b70-b9dd-946bf4f02142", "comment": "Malware payload (RedLineStealer)", "value": "3f3731b20e07aace092a7996d4da3da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374999, "uuid": "d6fbde53-8385-4ee7-ab7b-d08f0a6b19c2", "comment": "Malware payload (RedLineStealer)", "value": "d9ae8d474fc3bdbd9fcbf73c5a8bc7f6dfcb02afb92407f2c76b237a567a69a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374999, "uuid": "3e5a7687-0cba-48c3-b0b8-084729c41d16", "comment": "Malware payload (RedLineStealer)", "value": "ddf7bd508918f207c61f39025ae4104e8dad8c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690374999, "uuid": "c45bb14b-5080-4d5e-bb99-dcafbb0391b6", "comment": "Malware payload (RedLineStealer)", "value": "0896877f39c852dd498716782807e2af9357b4d8e663aaff1efc2d6d78d095acf50d46ffcc25cb93f6f9c2ac43e2c477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374999, "uuid": "b72b8090-43eb-4c53-8d9a-038ac190f0bb", "value": "T1E3F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374999, "uuid": "b6a6a7b6-eece-4992-a529-f1395d57520f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690374999, "uuid": "4f1bc2a8-d432-40ec-b2fe-f5668ee7cf03", "value": 34334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690374999, "uuid": "342778f3-6542-4020-92d0-b8b9cc6b1e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690374999, "uuid": "7da50bb6-7647-40a1-842b-fbe6fe04ba3b", "value": "3f3731b20e07aace092a7996d4da3da6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e3d1db-2bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690383135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383135, "uuid": "eb60f691-369a-4753-a83b-cea589719743", "comment": "Malware payload", "value": "708845c87ffabe9b8c59501511640be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383135, "uuid": "7cb974f0-9acd-43b7-bc66-d6a3441ea6cc", "comment": "Malware payload", "value": "d9bf9211b0f25e94387aefe0dcb6a982b8df57abeb485df14e01752c7d340bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383135, "uuid": "38312765-e0ab-43ed-9f65-7322a1889033", "comment": "Malware payload", "value": "a72747b1d9b00a2a33085ad49d25976c1ecc2311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383135, "uuid": "3bee048c-11bf-4bac-8361-0c183392278a", "comment": "Malware payload", "value": "74d3bf13590a07c788bd4429c51a518f5c6b494efab0a1edc0559b5491429b5d287a80f92a1edb884f7049527339189f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383135, "uuid": "ae8c225c-9761-42ce-bd04-50a129c0a1ea", "value": "T130B58F469D49D8F0F181077698A7954904B422BACB1FB8CB228DD44F53EFAD9CA333D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383135, "uuid": "7109106c-1794-4c1c-bb26-97ab44abdf53", "value": "8ee936e4a28d2502f7a03a785a34c988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383135, "uuid": "8b41f42a-d9bd-4b5a-8c1d-d30ea6528b94", "value": "49152:huxIPf1+yc55pMLPTVcTI4lMzoBq/lFQjYSgOUGhbIzhirApV5:oUf655a6TLeoBq/lFQjYSgOUGhbIzhiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383135, "uuid": "77e8a265-8061-4abc-bd2e-9db948ec13a4", "value": 2491392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383135, "uuid": "e217794a-8ea8-4fd8-ae01-54d0afa4ba92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383135, "uuid": "4726eb2b-de29-451a-9f80-a32b8d7fcab4", "value": "lllll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84683c13-2b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690347704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347704, "uuid": "a5596598-d213-43ef-bb6f-64bbcd2fae0a", "comment": "Malware payload (AgentTesla)", "value": "6bfbc0e4749eb4b49392dbe1c1bb86ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347704, "uuid": "d5ef2d27-04ed-41b9-9e1e-1d196c5c8021", "comment": "Malware payload (AgentTesla)", "value": "da0f4abf966401585d93c76714deaed1852f117fc059f5df4a84b7b6515ef822", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347704, "uuid": "564c6eff-8b9c-4ff4-8a48-f44b57966779", "comment": "Malware payload (AgentTesla)", "value": "795593d0c7078b3831630f696946a1212e70d935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690347704, "uuid": "8e4e6118-628d-4179-b634-d042de3894da", "comment": "Malware payload (AgentTesla)", "value": "8413bb11983b17adcda13fc1ba25a6c263d215b2269dfa4c69300ab6fc07a48e2673ae5dfb8206fcc139cd958d87394e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347704, "uuid": "4dbe260e-fffa-40d4-8c2e-71a852c70c07", "value": "T13FD4233789AFFD603A596689CC5D1932208C65640664E3B307B6250AF78F2E63F2DBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347704, "uuid": "909f0791-941f-42f3-a97e-d99ebb94aef3", "value": "12288:r7pD+9i43+ZzO3fOfTUvB+NmpDyHAug098avUd0fBDKE7uthL3WEkx:rtZqPZvBaIegugo8aK0fBWIuXux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690347704, "uuid": "4538e0a5-4ba1-4f59-b1b6-5d1e89e3b46a", "value": 610732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690347704, "uuid": "bb1c8362-76f6-4abd-b2bb-959eae376501", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690347704, "uuid": "ea2830b4-d5cc-417e-a809-672e90350f6f", "value": "ORDER PO.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aca56c-2ba5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690369881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369881, "uuid": "5193be38-c451-410f-8a11-96d9608e5780", "comment": "Malware payload (Amadey)", "value": "3bad8667bec7ca3979f7fa74667e1adb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369881, "uuid": "a38ff08f-4b64-433f-9f0d-ecf9193a25ec", "comment": "Malware payload (Amadey)", "value": "da89efffb12d7f890040c77a5698e1b2f529ffb5c897b96216977c212b11f66c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369881, "uuid": "dc080c15-742e-4368-8b2f-602f6b169559", "comment": "Malware payload (Amadey)", "value": "715879cb642c8cc63e5fcc05253b3d4cb3e8bf62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369881, "uuid": "eef588f9-fdc5-49e6-afb2-dfcbbab84ac9", "comment": "Malware payload (Amadey)", "value": "448d7ac1e8b79f4042be0399f8079da8e97ef655eb3da5dbef92d477fff87ea8556827c19e5b4b2c96942664e9c26e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369881, "uuid": "6b1b942f-487c-4f78-80e0-2bd192b4c113", "value": "T1B7F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369881, "uuid": "bf433a90-17ca-4d43-9180-afda20d0e584", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369881, "uuid": "ee15f24e-3ebe-48c1-97fe-c3c81fdd6a75", "value": 34774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369881, "uuid": "397093f6-6a7e-4355-b087-f2db1426c8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369881, "uuid": "d90dcefe-1fca-4d3f-8797-beaa0671525e", "value": "3bad8667bec7ca3979f7fa74667e1adb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35afb598-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1690385797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385797, "uuid": "56e0ecca-56bb-4e65-b9cc-fb1da2057b6d", "comment": "Malware payload (Rhadamanthys)", "value": "fdf0676d2a43e4fc8576f60c34f81bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385797, "uuid": "ce965366-28b7-4a31-bb91-0506dbc121f3", "comment": "Malware payload (Rhadamanthys)", "value": "dad6626f880fa91d5ff97eb4cdecb43bb660222a90f7dab9b331f8c2f36cde1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385797, "uuid": "b5764194-4f15-4a52-9ef8-2945bc672772", "comment": "Malware payload (Rhadamanthys)", "value": "e0bb13eb014f573f77cede189a9e03538af89c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385797, "uuid": "aad4f7b0-48dd-40d2-8392-f117ae11a269", "comment": "Malware payload (Rhadamanthys)", "value": "22220cb1df93232097b7f1f4bfc5483fdb19ce4e05aa421c385db526c1d672e0b88416e5a8506fb32fa2bc0789bc12ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385797, "uuid": "625cd148-92ce-44b1-ba91-00e46db5d4db", "value": "T17104AD5A63E420A6E4BA577498F203979A327CB15B7582FF12C4D57E0E33AC0A532F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385797, "uuid": "f8068407-a045-4250-bdab-7878728dd780", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385797, "uuid": "b632df87-dfbf-4075-bb32-bc41cbb4f2fe", "value": "3072:1ahKyd2n31M5GWp1icKAArDZz4N9GhbkrNEk1dkJFT:1ahOop0yN90QEYMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385797, "uuid": "4143c28d-9799-4f4e-8423-7a884acaaeda", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385797, "uuid": "8202e457-0b49-4684-9ead-02ea2b6cf542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385797, "uuid": "bc93e062-7c4b-41fe-a104-b9995cd4f954", "value": "fdf0676d2a43e4fc8576f60c34f81bc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebc339e-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690407771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407771, "uuid": "e2d6febc-41da-4c92-8c78-2f6f0fc374cd", "comment": "Malware payload (Stealc)", "value": "7edad52d4dada52d7b7f9646a50f5b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407771, "uuid": "ed5bb7ca-48e0-4d4c-8440-88c5671497af", "comment": "Malware payload (Stealc)", "value": "dad7e37e790b7fe49cb37bbd4947d5feac52fcf2240490b36f52ef97dc84bc4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407771, "uuid": "1213955b-2700-4e22-8576-a281a6a3d899", "comment": "Malware payload (Stealc)", "value": "06910f4c080137e7140ae16ac88af0a8605ace8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407771, "uuid": "2e9994c2-e679-4d8d-b83b-1ac0c09e71d6", "comment": "Malware payload (Stealc)", "value": "5dd08656dee2e7ab5bec920d25209045035c0cecde9e25bad2b0f467a32943c698feace71978cb3310bc753a6bf16ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407771, "uuid": "46835333-81cd-4395-8a50-cdeae5baace2", "value": "T1D274B64383E1BD44E9258B729F2FCAE8760DF6508F4D7B66A1A89F1F04B51B2E173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407771, "uuid": "f94ffb55-cde2-4f81-b05c-7b825bed40fa", "value": "a9a61375e97ff1bb9ae776c90b197580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407771, "uuid": "ac0ea23e-54f5-4892-bd93-5b6843bc5264", "value": "3072:hX95FmUzLJW8I8VdyDMq62APc6zjYeCh5kBPXwlGvPGT1hM:L5gUzLJW8ZVWZAwenpjv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407771, "uuid": "e25583f0-823b-4bca-b6f1-661c61e45aec", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407771, "uuid": "9d0f89cd-d936-45db-95f7-fae62d760e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407771, "uuid": "c8ab8cc3-f242-46a2-96cf-aa26d5b60ea5", "value": "7edad52d4dada52d7b7f9646a50f5b98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d986d640-2ba5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690370181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370181, "uuid": "c2972aa2-ae05-45ad-b898-d6a96eccf56b", "comment": "Malware payload (Amadey)", "value": "90a0e2ea1d50ec36a2d10e59b259994e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370181, "uuid": "ae6625dd-f797-49d2-b279-c398d0719437", "comment": "Malware payload (Amadey)", "value": "daf8e21137d19b7a10cfaafdfa6f0c2551995dcded5dd96fdd2ad28647945a21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370181, "uuid": "d345d08e-498d-48c0-9b23-35bb776f2b85", "comment": "Malware payload (Amadey)", "value": "7b348b2ce25713d0eb8440aa0b6132773ade96e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370181, "uuid": "fd9b3625-1be4-4197-9b7b-49cfe44a22b9", "comment": "Malware payload (Amadey)", "value": "42aec3d883ca368f6c62de1875838d233ac4fc1c1001b6be089dc862353bb0c1e4da2d680689c870058e5ba11c85d94f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370181, "uuid": "01ff1cea-445c-4f87-87cc-7fd9dc0b08a5", "value": "T19C84F143BBD95072D4B017B02DF217931A36BDA19D7C932B3391A94E0CB3AC4A93577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370181, "uuid": "64e9dc62-eae9-4e04-a054-69a2bd68ef49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370181, "uuid": "b2e69758-64d6-4cc6-bb60-cc45c96dde11", "value": "6144:K4y+bnr+7p0yN90QE89SRU7Bs9YmJ1WmqSQahYzMQhOM3hDy05yjMEav+y8Px:IMrHy90egOCYg1WmRTYoAF2fay5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370181, "uuid": "edf178d4-05f0-4ef2-9c23-bc781df91c68", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370181, "uuid": "8fb2557c-a46e-48ec-aa5b-50a4058a59cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370181, "uuid": "ca426115-4b32-4ceb-a5d0-3712f3e42b32", "value": "90a0e2ea1d50ec36a2d10e59b259994e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4f0d1e-2bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690376061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376061, "uuid": "46582c7d-6bfe-4666-9d14-0fa1cf636f14", "comment": "Malware payload (RedLineStealer)", "value": "f43227140f352d38f6f104c92e8407df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376061, "uuid": "c3c8dc37-dc35-4cd9-a62d-042464cc3fbd", "comment": "Malware payload (RedLineStealer)", "value": "db40827d851730dff5a1019430f6364fa76cec8fecad2bf76d2d78ab2102f672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376061, "uuid": "81c040ff-5c74-485a-b359-559ed9507890", "comment": "Malware payload (RedLineStealer)", "value": "954d0bf3796123385c0b6a4a27055f58cdbcfd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376061, "uuid": "91f80c68-7434-4992-8826-45f68baecb63", "comment": "Malware payload (RedLineStealer)", "value": "451cfd92c146f19d5bc69d4a36db3b0d91c3d362d0c65e77238fc2fbb63fcfef5c1c8f03d80cc70b8a96f38f441974ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376061, "uuid": "95b594bd-092d-41c1-9fe6-283702550347", "value": "T1EA940A4383E1BD44E9258B729E2FCAE8760DF6508F4D7766A228AF1F04B51B6D373610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376061, "uuid": "a21bb85c-bc84-47a6-aeba-c950fb151865", "value": "2e397c9834ec7dd7b9e9265900df8753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376061, "uuid": "9cf65167-1f98-44d0-b077-749fc912dd3e", "value": "6144:mrZ0rLK+Tdg89OUnvq7Kj9y24cjvHa7hz2Fjv+HT:4Z0r++Zg89OCy0IcjC7QFjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376061, "uuid": "8658497f-423f-46a2-babf-bdaeb935fc9a", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376061, "uuid": "1fc4fc28-e3bc-43c6-963a-4d28d2c4c65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376061, "uuid": "7ddc00b6-8671-4051-9afd-0c90a98f3db9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b9d58b-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377743, "uuid": "35c1dc48-518e-4f6d-979d-6a8c020c1e0d", "comment": "Malware payload (Mirai)", "value": "64d32ee5bf5cb8c91846d0f98980d37c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377743, "uuid": "52971a5c-9f2e-4b33-accb-496860e19c7c", "comment": "Malware payload (Mirai)", "value": "dbcd9547ed55f3f9387d2828af9abed62731cbad968e2d22a6d0947de3d63ffa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377743, "uuid": "0d902fd4-b94d-485d-95ec-395eb09a5409", "comment": "Malware payload (Mirai)", "value": "c5e3af83ea6f53602b526ac7689a0aeb103e1db1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377743, "uuid": "b29d51c3-5c1a-4a83-859d-c6c513e31c49", "comment": "Malware payload (Mirai)", "value": "5a8391627bc341229e58e4ffa79ff99877ca604e44c38aa46aa2496ecda8cff9d63128da7aa90079a93e7981a9b0550a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377743, "uuid": "1c447a01-3fa5-4fcb-a9e5-5a29b3e66b25", "value": "T1A283A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377743, "uuid": "251a53fa-c4b7-4bd1-8ddf-b5d7d9d4f65e", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTJ7ZDYovZ73x/nL8y8QG:Rakdn2Eo3ePu5GTJRYo99Be037Wz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377743, "uuid": "4a04cd14-07a3-4235-8463-95898932f943", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377743, "uuid": "01946dc4-5c07-4a4c-b182-9c5f986dd89c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377743, "uuid": "4c8af54f-53ca-4dad-8444-37973c8afcbf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ea26be-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690385628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385628, "uuid": "a250d00d-7dee-44a2-a394-4d793e87e23f", "comment": "Malware payload (RedLineStealer)", "value": "8cf44f48c76e0e9a1b9fa54e32fb2bbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385628, "uuid": "84941b5f-ad3a-4aed-95ab-db2f85e28bb0", "comment": "Malware payload (RedLineStealer)", "value": "de37637dcfb819c8cb8c0dab794c43b98c0658fc18ea31ab94e4521d6ec85a11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385628, "uuid": "0ff176ab-78c0-4898-b09d-3974c66b0839", "comment": "Malware payload (RedLineStealer)", "value": "5e5e5b9a747fce47feb7e605dfbfbf1d2bbfc6b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385628, "uuid": "58b59c4e-5ed9-450f-90df-ecf158146188", "comment": "Malware payload (RedLineStealer)", "value": "9eaca0726a74031cc4dba968080ba022ca2584a6e2347a0d11713b56a1c9cdedd9b71c3a6c1a24b3666aea540ba55cad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385628, "uuid": "035708c3-2c3a-4d8f-98d0-cc4a7e617c36", "value": "T1D4B4021296E84433F9B5377468F606930F3ABDD3487487AB2395A84E0E72AD0B536377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385628, "uuid": "5810dc8e-4dd6-4724-83a7-a8f70a437fe0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385628, "uuid": "94070043-7567-4579-bf30-01e1d80c5418", "value": "6144:Kby+bnr+9p0yN90QElv/qkW4jZNLBRgooMVcZMd6eJ7707oS2cRoh8KkA7ikaX8s:JMrJy90vvJRg8jPSUhXiki811Cv829/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385628, "uuid": "075610f1-7b52-45c7-8b0b-c9491f50b00b", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385628, "uuid": "5718efe1-a478-4194-9ee4-386667f78f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385628, "uuid": "ca40b54e-4141-44c4-ad50-e29d10fbe036", "value": "8cf44f48c76e0e9a1b9fa54e32fb2bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d0b806-2bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690376745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376745, "uuid": "c09aa2ce-f453-44be-8511-ee4b06282477", "comment": "Malware payload (Loki)", "value": "9e7c983f5a0d5a1f2ff0c34d23193e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376745, "uuid": "c2f2f1ac-9124-4652-bedd-f7fc449d0abf", "comment": "Malware payload (Loki)", "value": "de57a6cd3f2dfb6b6de94dc37869f25974279719c50998ae11cb067606e1e04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376745, "uuid": "5925fb3a-b38e-463b-92bf-a2d76b26b8be", "comment": "Malware payload (Loki)", "value": "007c53db07800a9d11a4d48e6f8df743b632117b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690376745, "uuid": "6d1f4b51-e6a5-4da9-a3b5-fd5fab666796", "comment": "Malware payload (Loki)", "value": "a0237873aa55107052168c9c40c90eb3d5fef1dccdbb33281e1606b9b57330d62926604986cc190be1735f340206320d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376745, "uuid": "ea361d44-36ca-461f-9596-3ef7331e6215", "value": "T190E3023C53F0D4A7E4B686312DBE57A62FE9E80A10B9A70B13106F5CBDA3253D54E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376745, "uuid": "fcdf5e04-2909-4bf7-99a1-470705256fd9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376745, "uuid": "d74ca7b7-2f6c-43ed-9ab3-0f4039d65107", "value": "3072:HfY/TU9fE9PEtubbCWAJJRBJcKX89reKWc2QBwL1Pm:/Ya6FCJJJRByKM9BhAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690376745, "uuid": "11e6c6fb-7adf-418c-8c7a-57383cf28c06", "value": 152393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690376745, "uuid": "1cd86fe5-4e31-4ac1-9ea3-f74516b0937b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690376745, "uuid": "aba8205f-b977-4be1-8842-7869c8dad9f5", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60abbc41-2bbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690380716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380716, "uuid": "60c55fab-10e6-4f13-85bf-2ac1a3e40c09", "comment": "Malware payload (StrelaStealer)", "value": "b2b10cf752305c38476de3e58967367f", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380716, "uuid": "51b92d42-6b38-458d-8c32-ff0ae73e05a0", "comment": "Malware payload (StrelaStealer)", "value": "debc6403cc3eaf6795af2c80ee90284240896b298f113b8cad61810d0a1574ea", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380716, "uuid": "a801c8da-8a85-472d-9d9b-7af7142198a2", "comment": "Malware payload (StrelaStealer)", "value": "2d4a612355e46e02de39167fa5216b40bb6031e5", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380716, "uuid": "e14a1664-f896-47d0-a414-5e7b3466b914", "comment": "Malware payload (StrelaStealer)", "value": "5dae8fbb99eae8e3b033bb92dfbe1c86a2b2a01346f977fd55e28c951651fd22d07340c6f6ba4a55dc6d48b0c18051ea", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380716, "uuid": "c4052212-d885-43d2-bf43-551af58c552a", "value": "T10CC41BBD64EB650AFE629C306FFCBBA1D77724A9C657C7F044E9A03025204A7DC12927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380716, "uuid": "4b07bb02-b827-4d2f-bfb1-46fce62576e2", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380716, "uuid": "85ce0f39-fe2f-41a0-8244-3da057744600", "value": "6144:KE5LvpHyAqT+6K3flmN/TJQzbF3t7KqpP8poO7iZoEuhcNjcITKhk:KE5lHy3+6d/t4n7h0kNjKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380716, "uuid": "1d1f2754-ad1c-4280-a4a2-f67d077d1dfb", "value": 577205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380716, "uuid": "653858e5-c18e-4f98-8f70-2db3557e2bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380716, "uuid": "cf3c30fe-8259-43f4-ba53-725033cd7443", "value": "jliplhywyfgtrkmyevljhjolazkaurvtepojaniciosmajxvci.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f44482-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690365632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365632, "uuid": "db3f78ed-61a5-4d86-ac83-e423c4dc2740", "comment": "Malware payload (RemcosRAT)", "value": "30aaddefe53253563b912c46f0e95336", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365632, "uuid": "a3bd8849-8d1f-457d-b82a-52038dae0363", "comment": "Malware payload (RemcosRAT)", "value": "e052c410c17c36d4b275252533b3f388a216aea10d67f1c2244b766b30a6bcab", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365632, "uuid": "495d1505-2932-4731-a056-07391d0d2b8e", "comment": "Malware payload (RemcosRAT)", "value": "b6592599305f77c1c43c9f3921fb5b4fb7c78c47", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365632, "uuid": "67e8d7a3-d15e-4d9d-97e9-3163791a149b", "comment": "Malware payload (RemcosRAT)", "value": "6d234dd11a157e1ca4dea8c0f4370702d091dd9331ced6fd580a3717aff0908a1c14d143b4fd36612e90738f647a9f85", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365632, "uuid": "c85f5417-456d-45d2-8f62-8cc9a6a3c3c6", "value": "T1DD7280E89FCE14350F4646E790468C7DF7E740A6251030A9B81FF6A51836F48EA7E9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365632, "uuid": "76d91a73-bdb6-4d40-ae22-3493ac330389", "value": "384:IJKYdzkPy5trQfHbSUfK9S4RakLt6xWfK+yb:CKFQcfHb1GJRJo5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365632, "uuid": "b3f21adc-0708-4a8e-be7a-817347bb5086", "value": 17528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365632, "uuid": "dba14675-abd1-43f6-a2f3-931a85b8d87a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365632, "uuid": "62578844-3a49-4597-a1d7-9fa4f43e4588", "value": "Draft_BL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d5ac5f-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690382736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382736, "uuid": "d3d37902-5207-4f46-9823-7db2f6cae3b0", "comment": "Malware payload (Amadey)", "value": "155a7a69481749ac854ff8b381aa7b7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382736, "uuid": "f14e0062-39e8-4517-b371-57df7c764d93", "comment": "Malware payload (Amadey)", "value": "e0f0f61d940e0b3e152021f178db06691f92847f2578e1cf694191c195b543f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382736, "uuid": "0cfb7aa9-35d4-4580-9458-baf5700fcad1", "comment": "Malware payload (Amadey)", "value": "6b08c54174d452bc3d2f7a451462f03e9f9c5fd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382736, "uuid": "43df423f-fa3e-4d92-998a-39c858ef5e54", "comment": "Malware payload (Amadey)", "value": "a3b7ac9f67ae570d6e271533dc187bf2a05488d32f39df2314bd3be9473766814d19e8d3573a3c7478685fec4f388271", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382736, "uuid": "7cef7653-cdd0-473b-a31f-7bb779e730ef", "value": "T1D4840143A7D84073D9B92B7028FB43D30F3A7CB15D75C66B2746A8591CB2A90A83536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382736, "uuid": "60b4bd22-47e5-4e79-9e84-b14e572871b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382736, "uuid": "d0010195-d04d-47ee-aae9-c59019af43fb", "value": "12288:9Mrdy903mTqSBnfEAdxMSPCejaJY7F906N5n:UyYuRaesYB9FN5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382736, "uuid": "ce8c3a8a-fb66-431f-9429-c60adf600887", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382736, "uuid": "b568ec6f-fb7f-43c8-beda-b1f83ce91909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382736, "uuid": "2495c2a1-1153-48ee-a2f6-7f001faea68b", "value": "155a7a69481749ac854ff8b381aa7b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7709ccf2-2b88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690357560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357560, "uuid": "7ccf13fa-f7f9-438f-9753-486b4b3e8d29", "comment": "Malware payload (Amadey)", "value": "7bd62b86b08a75e1e332b308977e09f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357560, "uuid": "805e765c-cf50-41ef-bce9-36d7d42a45cb", "comment": "Malware payload (Amadey)", "value": "e1273e3206706433c006ba2d99b986bb74823a4a26b20ea4d6b92383766abaed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357560, "uuid": "9863d9c8-d922-4938-82d5-fba5fd7fbac9", "comment": "Malware payload (Amadey)", "value": "56657ab18c0917c9fc55e723c6a61e4ac7fd1030", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357560, "uuid": "a510ef24-574f-4730-a53e-4d3ab9ad297c", "comment": "Malware payload (Amadey)", "value": "badaf89d89886d47c2c8124812b331aa38c557382d56002dc6385f4f948240673b3d6d9cbdf9a9938638dd7cae40db56", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357560, "uuid": "32ddde71-13bf-4130-a1d9-30213149c516", "value": "T1CC840143F3E88432D9B51B305CF713830A36BC619E78926B3685995E18B3A84F97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357560, "uuid": "a205f3a4-3344-4158-a6fd-d656a3e010c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357560, "uuid": "747d336c-b126-419b-9f1d-9b174be6cf55", "value": "6144:Kmy+bnr+/p0yN90QE215OYzYVS/B0YOcIN01D/h/PKKEvaV0ZpAm:2MrDy9041zY4/+lzNmD/9KKLV1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357560, "uuid": "45a259ae-d014-49b9-87f2-3da36c496733", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357560, "uuid": "df7b2530-8333-4aa9-8c59-153d3415dd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357560, "uuid": "234ae1d3-f538-4a02-b70a-169a2fcf3abe", "value": "7bd62b86b08a75e1e332b308977e09f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44888df-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385205, "uuid": "28cd9359-6ffe-4a8f-b1c4-b262a9a7ea25", "comment": "Malware payload (Formbook)", "value": "58dbb433735b8336ed775772563cfee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385205, "uuid": "e727b1ea-656b-494b-a5e0-c510605a615e", "comment": "Malware payload (Formbook)", "value": "e205d9c4dd9d23e24942ad2d1439821f4fef2b7743e60a9731af35198a95eb5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385205, "uuid": "bde63c99-3a3a-4722-8207-ed9921cb1191", "comment": "Malware payload (Formbook)", "value": "2a89fd0fb10f9538b85683054e60381008431c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385205, "uuid": "ebb59bc5-61e0-4ecb-b7c2-e64c31e6cc26", "comment": "Malware payload (Formbook)", "value": "d757fc09928eef14f99c5f6439c74a8b97ea46bf3b9978ab7c864198a9955979f26164102a0c199004e22463b82c2872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385205, "uuid": "68182fb7-9db6-4b27-aecb-0ac862d006b0", "value": "T13D3412186370E7B7F99309365A7A93212EF8742750E08B0717A05E1D7E361D1BB1E7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385205, "uuid": "ded19b2b-5bcf-43d9-ae03-bfc8ecc8f197", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385205, "uuid": "155a1b7f-39cb-46bf-a6de-4067a573b5fa", "value": "6144:/Ya6ITCqG4JLrBb6/rnoPwdpOpTCAjOcgGrtpQea:/YeTNG4J3mPepZjOxGru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385205, "uuid": "8cadfed3-0b3d-4f42-b5a6-1f966755e113", "value": 243509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385205, "uuid": "9bab4dcd-0e21-4193-8bf0-207095b74eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385205, "uuid": "9d34aa1e-8de6-40f7-ada6-10f274881344", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e11fb8a-2bbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690380711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380711, "uuid": "6c0ddbd2-446c-4cdf-891a-4b58f530060e", "comment": "Malware payload", "value": "7833b697ca7a95d57a2bfa2019ac3290", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380711, "uuid": "064d7acb-1387-410d-8b54-b939f1eb85b2", "comment": "Malware payload", "value": "e21036cfa8570b8f913a842d98c46b9ae9de658821ade0268e30d2450d27f5e9", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380711, "uuid": "38f4251a-53d4-4cab-8d13-5a32068272ad", "comment": "Malware payload", "value": "f725ff8f5d50026ad2e4e7759544ad457d583f59", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380711, "uuid": "9e3b4fbb-7ba3-4277-8384-4a43ee436de0", "comment": "Malware payload", "value": "20cb82f101f1c032c3173d39bae2799a57c8f739b62aa89d0895d4b010224657224ab92153ed87a403f09df072632353", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380711, "uuid": "cc79808d-64d3-430a-b1c1-c06e8038f550", "value": "T162F44BF476D07BD70F75290DB7CF40B23D64B857F0EDAD86268D0D1E928029899BADA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380711, "uuid": "fb66169f-8148-4d28-94d9-07d23dec3368", "value": "12288:XOvKGioiWZbFHoEWIW0u9qs81yMHKXL74hGZQ871nFRVTMeUoIizi:XOyIZbFHo3IWp9bCRKXL74h4b3I2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380711, "uuid": "b94bfb51-ba05-4fb7-ada4-ffaa180b71ac", "value": 765236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380711, "uuid": "e7010e32-0bf3-4995-8586-ec1d068e704c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380711, "uuid": "67215dc6-b2eb-40e9-be04-cccef992ee3a", "value": "ttfohrxiblfipplqolxphkpkixezpcdiopkmhzyegfiqtambuy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0ebea4-2bb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690375181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375181, "uuid": "0790f721-b865-4336-baf4-d045177c40ff", "comment": "Malware payload (Formbook)", "value": "7e3f03854b37a8c8a0f8291717f55528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375181, "uuid": "e2ac7127-3cdf-4891-9e64-97b59dc3d5cf", "comment": "Malware payload (Formbook)", "value": "e3643d141c0e87b3304f3b015f1e8dbbbe273e9a8bb93906991fe61a3073f891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375181, "uuid": "c48f35fd-cf74-43a9-8474-0b12410af2ea", "comment": "Malware payload (Formbook)", "value": "5bea46617d5c5dfaaee20e0674e16277fb63f53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690375181, "uuid": "72e24678-95bc-4abb-853b-267b7c847e43", "comment": "Malware payload (Formbook)", "value": "6b78f7b52b898bf14381597cfd5d0a938f23233ec455bb6ccce3838b92a412450eb731a404565057b531cd77232b5d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375181, "uuid": "f3b79163-c167-407c-a3db-028eb7fc9b32", "value": "T1BED4125572B85B27CAAA87F626C9CC0047F2ED1E9175F3592DC821DE8E23B0563A1F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375181, "uuid": "98ae6c77-a480-4f0e-881c-68fe5b984e9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375181, "uuid": "81ec10b1-272d-46a7-90cc-2bd8a7bafe0b", "value": "12288:kf2iN2GUL9kGtaF1oN2moBcyi0ziRmrRETUhK6Lb:kf1xUL9kmSGwmoLifTUQ6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690375181, "uuid": "736ef9bd-36a8-4802-ad1a-4e91d175c2e3", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690375181, "uuid": "300e0037-0f55-420c-8577-2d9c8772515f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690375181, "uuid": "a762f32b-e1d0-468c-972a-3e2e9ceca316", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032275b1-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365097, "uuid": "2862610c-aadf-43ad-a5b8-64ce20be1d9a", "comment": "Malware payload (Mirai)", "value": "052fcebb0b44556e760d0f1dc3c4990f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365097, "uuid": "f3f56fca-53a0-4303-bf8e-65affcd3b643", "comment": "Malware payload (Mirai)", "value": "e4222a3c79420ee9c4ad6787cb1c91f8282971c5d1be5954041420eac91cdcd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365097, "uuid": "f00eec7d-b7f5-4165-9e45-8a029b8d7311", "comment": "Malware payload (Mirai)", "value": "30f08d4ccd21728a6e4c00873ab66b9eed3568b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365097, "uuid": "fb495330-30a0-41e4-a65d-2c7a6b259525", "comment": "Malware payload (Mirai)", "value": "f16747d8a62cc1ebedd42e7e57e5ef1d5245ec613571b54edf73c851ee8998998047e82be16c7fb27e996d334d1d49cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365097, "uuid": "0866cadf-18d1-470c-b25b-aa990070765a", "value": "T16F82CF3061AB74E9CBE10431EAEECEC697160BB8D0FC36D316596B78894210661F92D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365097, "uuid": "080db788-0221-4c59-a9d1-002cc4dab717", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMamGhymdGUop5h5l/:2dV0P6+kom0tVAoNvm+to15s3Uoznl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365097, "uuid": "e6111aee-f383-436b-aaa1-81b407d46fc2", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365097, "uuid": "d7929901-3e20-4ffb-8548-6e3588968448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365097, "uuid": "189721f6-3399-41ac-89e9-b31f8a839bb6", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19ba6a4-2b77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350438, "uuid": "81b462a4-2a5a-4e53-abfe-891f33375cf0", "comment": "Malware payload (AgentTesla)", "value": "3e9fd801bdc0f951483ca9ff215c7eee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350438, "uuid": "16c1d8c1-58d7-4958-82bf-0cb2cca2c79c", "comment": "Malware payload (AgentTesla)", "value": "e501d14e904214d3bd94574c80ea8a1f18f8853425a2a375fa71a7e6933fb196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350438, "uuid": "84307b5b-328a-4b62-9bc1-7339e5b561ab", "comment": "Malware payload (AgentTesla)", "value": "f6a2468f9043c6d0bab7f79bada57d8958fb13ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350438, "uuid": "a0b6729d-91dd-417f-809e-1a6ccb3d262b", "comment": "Malware payload (AgentTesla)", "value": "64cf75e2b186e5d206323ea04f12e9c88d8bb12ea72a38ef5041f4e22e4d4fda73bba0d15ee34257f02cc934483398d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350438, "uuid": "4ae2b1ad-7488-4ea0-b474-43a380141f11", "value": "T197E4221572BA8B16CE7663F425A0984043F6E95FA336D2182EC970EB4A2373413E1F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350438, "uuid": "2554e186-e81d-4bd0-894c-203ae82dc737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350438, "uuid": "53ac7cd1-a66c-4a1e-b4f5-3d957de7932c", "value": "12288:rf2iN2GUL/nhL1oU68JlNlXilDQ0qCQ8LcIYLlB0NB9xsEAhX06aj8nIkqns:rf1xUL/nhL1oUfNlXXCQ+64DHp688nTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350438, "uuid": "ff5b176f-1b8a-4824-a967-d3d92edf025b", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350438, "uuid": "4a8be753-a27c-4b05-8217-7200817743ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350438, "uuid": "2eff7493-0a8e-4978-a88f-33625ad521c4", "value": "DHL Invoice_UTJU1GkTKE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11434bb1-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385307, "uuid": "89dfe107-9849-4ded-be95-5c010e60985f", "comment": "Malware payload (Formbook)", "value": "397590280295ba7897435eb5d8df4105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385307, "uuid": "e66697be-378c-4d5d-b6f2-0d637f350908", "comment": "Malware payload (Formbook)", "value": "e5c688287e91c8220cbcd7bb2e222c6003afead3c9f5ab1f2ae168bcd77c2800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385307, "uuid": "76d0e9d6-9904-41bc-a05c-210f43baa6b2", "comment": "Malware payload (Formbook)", "value": "ff469c926c1e5598fe804b8d9acb3c6cc6befad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385307, "uuid": "99a67bd0-e5f9-444e-a341-d1814b35f767", "comment": "Malware payload (Formbook)", "value": "313cec385756b5eef4f597e3ad4e31e3fba648e8874ed34fb22d8b7c265eca1fbba6eafd49678625bebc154feae04d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385307, "uuid": "35d691f3-9104-43f5-9c4b-bcfe566e2b92", "value": "T1E3E42365B788C95BD66307F51E2077F5226EAFD63000D2461CA7F18ED9E6F6C8AB0212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385307, "uuid": "73a482ff-6b0c-49a3-aca1-75f21085835a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385307, "uuid": "46b1cc96-eb44-4b53-a0d9-074a0791d010", "value": "12288:lYiIoFwIrG3XCCa9TTvW75XljmGpFmo6YrnyLxBZyKP/TzcbXxVocudRRq/uF226:lHIcTrGCdHu7zPpixB8KPs3ocesFP6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385307, "uuid": "4ba29812-d2fb-419f-bc54-7278f4d795e6", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385307, "uuid": "bf09c92e-ef86-432a-b0e6-269c9f28f871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385307, "uuid": "323d1e10-e379-4de2-85ae-3af6cb499732", "value": "RFQ #02022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84ceed2-2bb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690377400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377400, "uuid": "813d6c72-eb14-4dbb-ba11-e7893939a62a", "comment": "Malware payload (RedLineStealer)", "value": "5411d613b2419a7f9aa942f13020abdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377400, "uuid": "f16cf3ca-9b3b-4311-a028-edef20c39bb8", "comment": "Malware payload (RedLineStealer)", "value": "e6403b3973587f870b05ba9e8196f0cbe9a19728028a166e65f931dce39e6b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377400, "uuid": "3e5dafd8-4642-4a77-9f35-8ef0c2e5cb75", "comment": "Malware payload (RedLineStealer)", "value": "29332e62b0d7902bbe13cdcbbfb6496ffadda310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377400, "uuid": "20129117-8ba2-463e-a9ed-7d98fae792ea", "comment": "Malware payload (RedLineStealer)", "value": "2b2b55133060ac3a0c3c2d544ca7d81d99d8747e579ea8ce65b38edc33abdaeb947ac931f584098a7d71fc6adb717ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377400, "uuid": "e75b513e-905e-4772-b999-46caebc39e03", "value": "T144840257B6E99437EAB1177018F213C30F36BCA26DB9D26A2346691F0DB22C0957173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377400, "uuid": "79afce52-7293-4737-bdcc-2f8d95e564fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377400, "uuid": "b0dc907c-9f5c-4622-8bdf-8ce2e6eaca85", "value": "6144:Kcy+bnr+tp0yN90QEURlrz7DkXzEJaTnOiyRAnbP8gfx0L0cA0pRWm4cZ3SmV6u:sMrJy90uCDEWdogb520d0pxZ3S2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377400, "uuid": "114fb85b-b296-4513-be92-d589a4df9381", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377400, "uuid": "bf7055ec-169b-4d15-9685-c822c0991472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377400, "uuid": "9e3a2d57-784c-4352-a9da-6c0a0ca7c0bb", "value": "5411d613b2419a7f9aa942f13020abdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722b3c92-2bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690393630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393630, "uuid": "308e26ff-a25d-46d1-8c62-5a4dc72d24d2", "comment": "Malware payload (Amadey)", "value": "0ec71ceddb66074fed726d8fbc7e50f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393630, "uuid": "4eeb824d-74e2-46e0-aa3f-45480bb13990", "comment": "Malware payload (Amadey)", "value": "e684f1bcca2a54c96e7f987efb188f6987b484201434288f94134034bb9735d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393630, "uuid": "c69be8d3-41ca-44fb-8962-4ecd0376ad1c", "comment": "Malware payload (Amadey)", "value": "74e0b520db12de183b7de755bff934308f70c0b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690393630, "uuid": "dc758c50-b0ac-4114-a846-019cfcdafc5d", "comment": "Malware payload (Amadey)", "value": "a9c7c04bd7667409723b730003b6b155b05a8391566d0b439dd43f2c5241ab1713a948cfe16b2a37f3b1f86185fa260d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393630, "uuid": "43640521-6614-4aa7-8ec1-d790daf96a38", "value": "T1CFF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393630, "uuid": "1c0775ae-17b6-4e9a-aada-982ecfdc68f1", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690393630, "uuid": "a3a71eb8-95f9-49e6-ad4f-6b681de219c3", "value": 35587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690393630, "uuid": "0074e14e-64c7-4f78-a38d-c73360422aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690393630, "uuid": "509ebb07-b936-4b96-8b54-4e3079b27d0e", "value": "0ec71ceddb66074fed726d8fbc7e50f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac32fe04-2bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690383419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383419, "uuid": "7c1fdd46-13a8-4ea2-9a07-d46fb0be674d", "comment": "Malware payload (RedLineStealer)", "value": "f980b5994cec2788348718d65580c1ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383419, "uuid": "4866eec7-c65a-4b37-87d8-893cdfa999c6", "comment": "Malware payload (RedLineStealer)", "value": "e748fa2eb7bcd7cdf35f7fc1ef90ab4dc83e946443d4b2d66e8769c43dd08de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383419, "uuid": "d894c72f-ca9a-4908-bc35-23a1fc57e0d6", "comment": "Malware payload (RedLineStealer)", "value": "613dba4cc7b63d94252163e06adf9d6277c911a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690383419, "uuid": "6ac8c44f-e86f-4582-b8db-350a27cba46d", "comment": "Malware payload (RedLineStealer)", "value": "12a68c551c1eb55577180756be99f6a1692a48f8d95a09a45e987b5d2ef4dc497f5fdedab857750c5be9d8987cd512d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383419, "uuid": "f6b81974-2113-412d-927c-7b9b526e3d56", "value": "T19E840243E7EC9033D9B52BB058F703830A357D915D78C72B228A996A0CB3AD4953573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383419, "uuid": "03374036-baba-40c5-b4dd-9e355569e3a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383419, "uuid": "349686fd-73c9-4ccb-aba0-a947c1e25907", "value": "12288:FMrby907LboYI/TefYjgBYC3vKxcnoZDLU:SyQwYwTKYczyxZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690383419, "uuid": "790aaff4-a2a8-42fc-b622-d2a0db9470cb", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690383419, "uuid": "aaa411bd-02b9-4671-8ff0-c7a00f12d0ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690383419, "uuid": "7a23f68b-f4c6-42d5-ad66-a8b67eca4973", "value": "e748fa2eb7bcd7cdf35f7fc1ef90ab4dc83e946443d4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6f2b3c-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356039, "uuid": "168bbed7-9104-4086-9469-78ef6151cca4", "comment": "Malware payload (RedLineStealer)", "value": "2cca40e17d911769a22717bc557ccb9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356039, "uuid": "4fcaf255-8385-4650-910c-e5457625edb8", "comment": "Malware payload (RedLineStealer)", "value": "e8e7eff921ad96be1d433b0be2ca6447b50466168e5e95e53db0aa0c70d9720a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356039, "uuid": "7a6ccabf-cfb9-4cd8-a5f0-a79676296843", "comment": "Malware payload (RedLineStealer)", "value": "0c246b015efd008cdba0acfecc2293736177e978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356039, "uuid": "0c930792-5b2a-4be9-8198-37002ad89fa2", "comment": "Malware payload (RedLineStealer)", "value": "26cd9887801567b65596937f6a753ffe3ba84b4b75dae5d1aa31caa62b51d37376ba8925784ec79ba2839ff9d68fc07b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356039, "uuid": "6db89cab-ced3-4148-a0fd-9478891380c7", "value": "T124B41202A7D89472E8F01B701CFA07D31A35BDA29E79D72B6790D85B0D726D0A53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356039, "uuid": "1a37b387-0ce9-4948-9a87-7854315fa431", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356039, "uuid": "6af8d875-435f-494f-9182-c3a5b5519598", "value": "12288:PMrBy90lcKo5En3GJ4CPHePOJdBFUbCWi0U:eyyhcM3PEePmFxfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356039, "uuid": "550f5986-6dab-4a75-9ade-2d67333c1fb5", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356039, "uuid": "80bda82c-2354-4ff6-a7b9-86ec80e0c8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356039, "uuid": "cc4c307b-57ff-44af-b936-aaf08f24d1ca", "value": "2cca40e17d911769a22717bc557ccb9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf0669c-2baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690371985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371985, "uuid": "8f829aea-fe4c-4d44-9328-dfbead58cf74", "comment": "Malware payload (RedLineStealer)", "value": "a2e3fc40b1bad1ba1649f2b6c672998f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371985, "uuid": "8a261654-28b0-4d5b-81e8-430855eceb6a", "comment": "Malware payload (RedLineStealer)", "value": "e8ff7df6739ad1140cc75db76d790e3d23623a8aa4d858ca9b28cd688516e69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371985, "uuid": "e44daf44-e573-464d-8223-7a966ec2b8b3", "comment": "Malware payload (RedLineStealer)", "value": "094d7224fee5bf87ff6f4b2738456457ffec3b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690371985, "uuid": "a190c100-51ad-4754-8eb5-778b6d6a87b0", "comment": "Malware payload (RedLineStealer)", "value": "5d072291d97dfb8130560492dc077fd29ae2ef86718444b9c1f4020d7a4a6a44e2bc654e8e640096cb0f3798824540c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371985, "uuid": "eb45e108-bd73-4d8f-a615-5789a9da0976", "value": "T112840102B7E88133E9B51B7058F603C30A36BDA16DB4936B3785AA5E0DB37C4A475727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371985, "uuid": "89d14135-b990-4a1a-8727-a644cd773adc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371985, "uuid": "60f207a3-8d17-4450-a9ff-02fb91230629", "value": "6144:Kqy+bnr+yp0yN90QE9GaVBtw9jF5eZdDsjWPcq2mIimKXwp78OZXbex:mMrGy90ya5pEjWkP8OZSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690371985, "uuid": "5ac79b12-201b-496b-93f3-ef5f314daaa2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690371985, "uuid": "5208c8e4-6b7e-4f01-b806-c74c8517ae8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690371985, "uuid": "cac6307a-e8e3-4ffb-8547-bdd0263c2534", "value": "e8ff7df6739ad1140cc75db76d790e3d23623a8aa4d85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaa20d2-2b9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690367176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367176, "uuid": "192ecc41-15b4-46bd-9cb1-a346ac606cd8", "comment": "Malware payload (njrat)", "value": "39e85dba19984dd886154a007776384a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367176, "uuid": "a775ca2c-b14d-4f8d-902f-6fdc0079bd7b", "comment": "Malware payload (njrat)", "value": "e9e5d4e657af5c443e39e5d9d71ee0f938847939b9c00f7d3848caaa50b7d612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367176, "uuid": "059c3f17-2a32-466c-a747-92bfb0bc49c4", "comment": "Malware payload (njrat)", "value": "fbb99a9e7e6d9296886b2270c6a0a8459e0056e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690367176, "uuid": "9d4b5ac7-5b40-4926-bf61-d4efbefda93e", "comment": "Malware payload (njrat)", "value": "5e4f716b6e13c638a0396628b100fab1b64718bed4dd08941d86d842f18203d36c1a34feb2f2715ee1c5f8a239d5e17c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367176, "uuid": "b2e005ae-ee35-4a96-b7fc-5393f5734f90", "value": "T17CB22A0E3FA98866D47C16B48AA59A5003B091470423EF2FCDD554CBAFB37D92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367176, "uuid": "4d8713fc-17fe-4b1a-9a07-4d2e877edf69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367176, "uuid": "ded3c5a1-c666-4057-b6e6-c9ab25881e38", "value": "384:GYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXN1mRvR6JZlbw8hqIusZzZjL:JwWkti/aiRpcnuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690367176, "uuid": "ea82ca65-a6e4-4c30-9665-e87ffa17f3df", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690367176, "uuid": "33c1dc21-dae1-431f-bfe0-255dcf644a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690367176, "uuid": "a17c3f27-d55f-4998-a675-00475c34c86d", "value": "39e85dba19984dd886154a007776384a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2615d2cc-2bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690385771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385771, "uuid": "82954dd4-d5d1-44de-9323-f40087d3cebb", "comment": "Malware payload (Stealc)", "value": "363d431816a3d0805a41eb85d0fc7ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385771, "uuid": "dd7c903e-1bcb-4b46-b153-bb5985aef0f2", "comment": "Malware payload (Stealc)", "value": "ea73f0c424fb7780689b5d0b88bcef9af3b80ed701250ebf8c794b89aea182a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385771, "uuid": "13543ca7-0a04-4119-9515-64946470a45e", "comment": "Malware payload (Stealc)", "value": "0cadb14df9ac6833f9a59dc7188c5c3ad465792a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385771, "uuid": "b88f0208-c8c0-482e-aeeb-2f40d527e753", "comment": "Malware payload (Stealc)", "value": "f92b38dccb98e3cbbde65beac4ca9a653ecaab42297a10ae65356c379882bf708042615a47cd7ceff0184045310f0403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385771, "uuid": "38f34c94-a30d-4970-811e-d6aa363fa5dc", "value": "T19B74B54383A1BD40E9258B72DE2FCAF8768DF6518F4D7B66A128AF1F04B51B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385771, "uuid": "b07b909f-4a29-4021-9c67-a7d6d1871cd9", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385771, "uuid": "51ba7d07-ae31-4248-a7c6-4ed7a2d3abb5", "value": "3072:KOBMfVXLkMk3Dg/3Tl0VMemH55+s15fg+wlGvPGT1lTsZxO:3oVXLkMkTg/DvVHf+Qg+jv+HTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385771, "uuid": "819bb5c1-b62b-4ea8-8d93-a6f04ec4a0ed", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385771, "uuid": "c35a854c-b8a5-4d06-9ff7-f7f380900b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385771, "uuid": "a929b7fb-f683-414e-bfd5-258a52d944ea", "value": "363d431816a3d0805a41eb85d0fc7ff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cd78fa-2bb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690377750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377750, "uuid": "83176331-62bf-4a22-9bbf-f17029744962", "comment": "Malware payload (Mirai)", "value": "105218792602b8d0c423713335d792a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377750, "uuid": "d3e927ed-9857-4d47-ad48-c06f158d6cc4", "comment": "Malware payload (Mirai)", "value": "ea7b258ef80b43bee05642cf7aa285672151d45600b77ee96fdc006eccfa5f99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377750, "uuid": "5a38d017-5773-4048-9a10-54dfd0637ece", "comment": "Malware payload (Mirai)", "value": "75a760a986ec9489aba3fa1d51d5308efadc8609", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377750, "uuid": "5745b24e-fcd9-46b2-9cb4-b0a21d75c8a2", "comment": "Malware payload (Mirai)", "value": "2ff537e21ee755c7ef5a68aed6c16bd828134c76fadf9e222b6ed4b2b4c687987754e19dbe7792128b85d48399e91b3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377750, "uuid": "a5f6d959-f4ed-45af-a706-f4356ed368e5", "value": "T1F6E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377750, "uuid": "10a5e50e-09e7-4890-81b7-439d14e44332", "value": "3072:yJTc2PBSpmi7Oabvzj4dlRsh8ZQIldAMXkkTM/9zY:yJTcGOOabvzj4dLsh8/AMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377750, "uuid": "bac12b37-eaf9-457f-8044-645c262c0a32", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377750, "uuid": "5771d5f3-df79-4af8-8565-63a2cb2d1a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377750, "uuid": "549e47f8-deb8-40f2-8f49-50ef9883d535", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172b7bb2-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356970, "uuid": "e7391afa-c9a7-4702-a9f0-0307289f95da", "comment": "Malware payload (Amadey)", "value": "27061ff496eaed9e51dc9758e9e6bbff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356970, "uuid": "dee416bc-adf6-4d7d-a4b7-7da5bd35f891", "comment": "Malware payload (Amadey)", "value": "ea93be3ccb2d935fd5f2c31ce5d1a849e26be91428e6eef0238fcfae281bf3b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356970, "uuid": "be6c9e24-bd25-4c5c-a565-98052675cc4a", "comment": "Malware payload (Amadey)", "value": "281aabdc40ad8937f5940a2c6e031de22046b321", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356970, "uuid": "14543a52-3903-46fb-b74b-b2c267161f56", "comment": "Malware payload (Amadey)", "value": "5e289efbd13b8d0406d659152504357cdf4b033c5b2265c6e97b6a234cc958d83b392cd47807efc5cc037daa9c1e9d8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356970, "uuid": "0f5960b3-f5b9-4979-aa9a-b45e25e56f09", "value": "T1FB840103BAE84032D9B5277069F612831736BDA15C38936B3706E96F5CB36C4A87177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356970, "uuid": "4b553ea5-75fb-41ea-ab0c-8898e1b313c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356970, "uuid": "f07b4de8-02cd-45f4-80e2-f571655e3931", "value": "12288:xMrwry90crLH8iMgp5hgqgBYC/dmh/1+qmj:HryhsiMgp5OZzymj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356970, "uuid": "7152d3fd-70ea-4660-9e6e-d0d3e0454a9f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356970, "uuid": "293b9c85-522c-4481-a567-80357b952974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356970, "uuid": "d591294e-6c38-4a33-9b52-10441b3c14bb", "value": "ea93be3ccb2d935fd5f2c31ce5d1a849e26be91428e6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feec56bd-2b92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690362083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362083, "uuid": "971c4a56-d65f-4fc8-93d4-7b7bbabb07f6", "comment": "Malware payload (Mirai)", "value": "6c20618405d5b96eeaa093aa3ab86d0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362083, "uuid": "c394b4f5-82ce-4c4c-95c7-7108e6a9e215", "comment": "Malware payload (Mirai)", "value": "ead2e0c4e3fc08011e14151571079f7e83afac6b0727878ce193940ba19a286d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362083, "uuid": "bb9d343e-b79d-4cd4-a59b-9f296e6f9591", "comment": "Malware payload (Mirai)", "value": "104ee27671a47dcc93ef9e1df02743747a62ea3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362083, "uuid": "615b1069-bc9f-4505-b12a-97b459c4c66a", "comment": "Malware payload (Mirai)", "value": "ad2d4d09d098916f936e5523637b75382894af0a1c22a1e94545004e53bf1ca12cd7f012fe6f2728f55c5ae1ec8aadcc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362083, "uuid": "8d8d231d-aa9a-4150-9812-c21575fc88e3", "value": "T139731956B9815B11D5C112BEFA1E418E7313177CE3DE73229E24AF20738B96B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362083, "uuid": "6a07d34c-7aa6-4eaa-8acf-fc821ae6711a", "value": "1536:denV9iIrj0lhoyPY26zvNaC+/pPxMBivdi3jo8J7Yu5wQ9:s9Xrj03TizvNaC8i3jo8Jku2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362083, "uuid": "ccfd5e24-2549-4ca4-98d3-40a02fd7539c", "value": 75728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362083, "uuid": "4795fd85-2bbd-425c-8b23-8f4864676ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362083, "uuid": "0ed15c1f-415f-4b3d-a2ab-a0c0b6fa88f4", "value": "arm6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c985c6ce-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351256, "uuid": "963ffc67-86a8-470b-833d-9de96aaf8dbf", "comment": "Malware payload (AgentTesla)", "value": "9e22f38e572d57a02968ddb2af1bb9fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351256, "uuid": "716cfa51-502f-4293-b851-f99420565f11", "comment": "Malware payload (AgentTesla)", "value": "eb0c998058096e77dbc0e210e2b45d58ffe0e8d1d46b2f4f34545747fb787698", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351256, "uuid": "a17d8c6a-82ba-45cb-9602-7cf69ca09c25", "comment": "Malware payload (AgentTesla)", "value": "45cbd3cb7d34dbd6ddfcf62dec2548237749581f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351256, "uuid": "0e71aec5-2a1b-4a00-ac38-d54fbccc5f9a", "comment": "Malware payload (AgentTesla)", "value": "1bf1da9b17ecd291ec7ecd08758328d6ed8e73f5e1a09026b947534e6b9635842484e80aa92f039c3add90f2114b5028", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351256, "uuid": "4201e82f-5dc9-4aa3-a278-c73778a1221f", "value": "T1AFB4233DD6D9226F82522620C95D71ECD32E38527CD5E504F66C48E2B64FF2B6BBD802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351256, "uuid": "7cf6577e-348f-4761-932b-79ac13d73725", "value": "12288:B3ZOOyWjbQwr0S1e0lJnuqE1eOOcUu2Ls0L+:BpOmbdtG7AWl06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351256, "uuid": "5e9fa15e-a4da-4795-9f98-df9fc3dd2073", "value": 536296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351256, "uuid": "c47aca68-93c3-4749-ab98-eb5663aca4a1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351256, "uuid": "7cb22f17-fb55-4b71-bfbd-e496915a40a8", "value": "00472790000252-SwiftAdvice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e257deee-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356022, "uuid": "7e891f09-e638-4caf-9602-9dc50ba06921", "comment": "Malware payload (RedLineStealer)", "value": "1b98e7d12a27d2f79058b4c50c70ae63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356022, "uuid": "6b68c206-b19f-4e2d-be93-2b790e0a59b4", "comment": "Malware payload (RedLineStealer)", "value": "eb49534b8eadb45da7f9e7ea8fef8cc5e1bb8e918514a46210e0b6bf417f8d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356022, "uuid": "e51678fd-ca00-428f-90fb-138561f85abb", "comment": "Malware payload (RedLineStealer)", "value": "972ca631bb8881c0aec50b675c9dbb9a8cdfe139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356022, "uuid": "aa4aec51-2a5d-4bdd-96a8-6afcab123b25", "comment": "Malware payload (RedLineStealer)", "value": "f2b12875a8edc4871cb42867bbbb8ad63ac5bb97abaccecabad142119e3b96111950d0d3cea5824a40a4a457ceb14fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356022, "uuid": "fa562fea-a1fa-4d4a-9dcd-1e6f4c319f4d", "value": "T11B840213A7E98133DDB95BB118F602C30B3A7DA29974826B2349E54F1CB36D0A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356022, "uuid": "f6c5a74c-b4a0-4f14-b91f-69cc560a72c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356022, "uuid": "34dace3b-4c38-43ec-a925-64d8875b358b", "value": "6144:Kgy+bnr+0p0yN90QEzSG+KoUTtEZPH8n1uSUVSBmC00lhz6HSB:AMrEy90RAK/TtEdH1SUcIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356022, "uuid": "a2fb91ff-ed72-4e41-b1ab-d5bd1c06b34e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356022, "uuid": "09bcda54-3a99-4dcf-a499-4dd4729297e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356022, "uuid": "00517035-83d4-4c26-8cf0-33e23bf85b49", "value": "1b98e7d12a27d2f79058b4c50c70ae63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8a55aa-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351023, "uuid": "6641d010-2eec-4564-94b9-95c9ff149c64", "comment": "Malware payload (AgentTesla)", "value": "708b752a6a3d2e87b432991f804280b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351023, "uuid": "86463b90-2263-4a21-919b-a9b60b5d2c61", "comment": "Malware payload (AgentTesla)", "value": "eb6f1b196a3219983daba95acb50f91db90a9d66165246d41aab2c314f6fc7bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351023, "uuid": "d3fc61ab-5d3f-45f0-a8e9-b754fbd1c60c", "comment": "Malware payload (AgentTesla)", "value": "081b7f8a587c77aa1642e33b5e4b921e0c26d8bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351023, "uuid": "f4a97446-c3c6-4111-9345-f4417382f46b", "comment": "Malware payload (AgentTesla)", "value": "26e896d73a5838b7d8a7edfb3d5aae3a583cc3961336d8641fc600bd4790bb1fd82154a75b42b577354e2693893ddc34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351023, "uuid": "08d681da-1e3e-4e96-9faa-c9b91209c959", "value": "T100D40283B4982B0DF9AA43F76AD94D1043E6A94B1163D3012DE63ED67F22B4153C1FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351023, "uuid": "c75ccb59-f9bb-45e5-ab9a-ecc8420a41a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351023, "uuid": "ee289c31-3fe0-4fda-be55-6f83537012ce", "value": "12288:af2iN2GULb3t7fppRAk46DmKBG3+T/+Y2RVrcmKc0ZumNlPkqXwozTrT:af1xULb9tpr46DmK43+T/+YkrzKTZumj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351023, "uuid": "e78cfbc1-52a1-4b96-8ba0-121de3906174", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351023, "uuid": "b9c2b064-ead3-4125-ba69-ed37d7ac82d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351023, "uuid": "98f2416c-a604-43e7-8543-172287122cf0", "value": "purchase order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a98df88-2c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690414662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414662, "uuid": "a143083c-0452-4924-8a3b-f8713d41b26c", "comment": "Malware payload (Amadey)", "value": "b206543ad0a404d0986c8e188f9e1d36", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414662, "uuid": "0fc52c3e-beb1-4c5c-a1ff-d075db7d15e2", "comment": "Malware payload (Amadey)", "value": "ebca0b38bd2c68ec1dd9031abb7f90a2ff515c61b5e0c074e69acf7583a31d9d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414662, "uuid": "b1c42d88-50d1-46bc-abb2-b8e550327a3c", "comment": "Malware payload (Amadey)", "value": "746b8371086b1ae3c0491e428429eab7ea48b5c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690414662, "uuid": "59db9825-8699-4f66-bb69-7486d7f05f32", "comment": "Malware payload (Amadey)", "value": "ee3b176c1dc55c638ff6e591c0fbe9196ce2532e033a859f8373f546701016d285537cbb30f7651ec282fbcf70861a05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414662, "uuid": "abb4d7ae-591d-4253-b686-df91111c49e7", "value": "T1DE840213A7D85073DDB6177058F742C30A367CA2AD7982672B82954B0DB36D4B872B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414662, "uuid": "0f43f031-87f8-4d5a-8901-77c532b0b0f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414662, "uuid": "0aca86c0-3af1-4ace-9719-4a0f996472d4", "value": "6144:K+y+bnr+Rp0yN90QEpyaZZjmXHL+5MuuPKB6glAm4cgBZ+t44Dqt2l:uMrty90/ymjm3LyuPADlx4cgBYC4mte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690414662, "uuid": "75f8396a-1f6f-4759-8653-78ca3126c879", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690414662, "uuid": "f8eccef9-fb0f-4ce1-ba19-b7ac141f7872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690414662, "uuid": "01419956-2864-48aa-9606-417c3b545df4", "value": "ebca0b38bd2c68ec1dd9031abb7f90a2ff515c61b5e0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ff296e-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690357257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357257, "uuid": "a28ec6d8-e12e-4e9d-b2c7-961771473d25", "comment": "Malware payload (Amadey)", "value": "91990158a5f6f29bdf028cee65162cd5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357257, "uuid": "5fd272b3-1b57-4c1d-be11-82c94b50f980", "comment": "Malware payload (Amadey)", "value": "ec06e746986739a3edbb16ff4773e105eb053515b1250208400625d26820232d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357257, "uuid": "32d46849-fe67-44cf-8eef-86a6916ff584", "comment": "Malware payload (Amadey)", "value": "47684a8d2f60211868409c44c110b4563812376c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357257, "uuid": "5dbe6c81-d1d9-4aba-9c13-18d976c6d3c7", "comment": "Malware payload (Amadey)", "value": "c339643bfff7ddbf8d15d83e9413069b459bedbc7670972d00ac45b9aa946e5aa0bb1c301b90fcb0d01ad9a0828f1430", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357257, "uuid": "5a9c6749-15d1-4534-916d-f18e38698ca7", "value": "T11A840143A7D84433D9F42BB159FB03930B39BDA28D78429B37466A5E1CB25D4A03637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357257, "uuid": "e21662bf-9c88-4c45-be54-4b786cd13931", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357257, "uuid": "4569f218-19fd-44d1-9fcb-a8e8368c4819", "value": "6144:Kby+bnr+Rp0yN90QEByLFjSdIgxH2lrxWd8RfYcs4TGsCYIcdbhGMO:lMrhy902Z+xH2lr4SiEGsVIJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357257, "uuid": "a3079228-5a2f-430f-87d8-4f5112f8d112", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357257, "uuid": "767f64ed-145f-4f70-bc47-835200f070ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357257, "uuid": "bdfda7b9-7d31-40fe-acbe-69cca7e59cd6", "value": "91990158a5f6f29bdf028cee65162cd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0864eee-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356341, "uuid": "5969c465-7339-41e9-b9c3-18a2e9e24c04", "comment": "Malware payload (RedLineStealer)", "value": "9ae4031a35d725125e527971ced70f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356341, "uuid": "f09466bf-a9f7-4ac1-b3d4-c85e66514637", "comment": "Malware payload (RedLineStealer)", "value": "ec137c56ce1fbf300d20e4da977f3df9d82ab43a1479afec5ab0ec5997823ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356341, "uuid": "f218aacc-6b53-43c3-8d4d-f8da63cf3b63", "comment": "Malware payload (RedLineStealer)", "value": "01ad3121106b1019411c67a0b9282b1bdc1af6ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356341, "uuid": "0e4e11d0-86fe-4368-9f01-973064fe3a5f", "comment": "Malware payload (RedLineStealer)", "value": "88b079cda046885c9fb0cc2cce63b9b62d6bae24242fc19de279819846b262adc89c86b5fabb819b2d941c2ba394667b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356341, "uuid": "43c096d7-6a0a-4e64-9ec4-35191fffe9e8", "value": "T1E284F10676E8D132D9B52BB014F70283063A7DB69D78937B2796A91F5CB32D0A43137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356341, "uuid": "2048f8bd-de46-4780-9065-9500b97a1424", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356341, "uuid": "20ea5d5f-9000-41e3-bb05-02d5d9c16159", "value": "12288:FMr2y90NnXqmZ0dsfT5BjlgBYCMdbv+Q6:LyMN5d+zj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356341, "uuid": "9224e979-b381-44d1-a3c4-a96280a12e0f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356341, "uuid": "3fdf450b-4278-4e79-ba2a-ec153ba4c5cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356341, "uuid": "cb917756-d206-49fd-b9c8-16a901b771aa", "value": "9ae4031a35d725125e527971ced70f4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e2d492-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350839, "uuid": "14930faa-b265-4e6e-9d92-33b67136c195", "comment": "Malware payload (AgentTesla)", "value": "0fabffff1114a122cd918ad42e58bef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350839, "uuid": "756c12d8-4ece-492a-8847-c33ee34543e9", "comment": "Malware payload (AgentTesla)", "value": "ed9b32173b779e331be0019ed97ce6a3ed4e651c4660e1825605043d18addbc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350839, "uuid": "b9d5090d-c9c9-46bb-b470-399847b23537", "comment": "Malware payload (AgentTesla)", "value": "ed23960fdc3586a60dd8c22b8562aa1f25898f93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350839, "uuid": "512682c4-e5ea-403f-a49a-d823eee2c636", "comment": "Malware payload (AgentTesla)", "value": "4d556e20562399d51b979ec19edba07bdbf6a3dbf07a858a0a4aa0b50df6e115df594ca9ad7eb556f9b4fb4d37174be0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350839, "uuid": "c4b63602-49f9-4eb4-88e1-c67e0762a258", "value": "T1A4D49E22A344AF6FF17E9374A6255D4583F5E71B3621EACA3FD200CB14E9F80C761A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350839, "uuid": "3cf8b306-67b1-4dc7-b51a-1215ddc553f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350839, "uuid": "bbcdf19a-423c-43d7-82ef-496f4c321d51", "value": "12288:noCyfgSL3G73eSFZijt0TsswLd2zOi79zXLTx/082poKI+GAW4rF5ELE:nsgSL3GUuwLli797B5bKI+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350839, "uuid": "1a3632d7-27bf-4c4d-af4b-f887a8f250ea", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350839, "uuid": "6c2f2f9f-4194-4190-aebd-8f0003115707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350839, "uuid": "f2af1b62-b227-4087-9926-51acc40fcabf", "value": "tBflbf5VvYPGGej.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160eb9c9-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356968, "uuid": "10ee7f95-6405-498f-9624-27b6b0e4e07a", "comment": "Malware payload (Amadey)", "value": "04df080cf484e32e7743c75270228e82", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356968, "uuid": "8a3027f8-5c6f-4c79-a4e6-6736260b476e", "comment": "Malware payload (Amadey)", "value": "ee533beb76c1b57400860d938f7aec30a308a7de28e0438882720e9994fc063d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356968, "uuid": "6c506a9f-fb3a-47fd-9311-38efa4d8b3b0", "comment": "Malware payload (Amadey)", "value": "729e55f5afce2a31de0163eafecf42797a1fcf2a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356968, "uuid": "b50cf217-b642-4ba9-a1a2-43e0be7b5ae8", "comment": "Malware payload (Amadey)", "value": "fb0f3a22e42bf7b6e4e431ef502213227b64c799c3d5569040051535594d478044e0e6e1fac4c566caad11969ba151b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356968, "uuid": "a759f65d-3e72-46b1-a84b-cff9706a16dc", "value": "T14C840116F7E88133DDB51BB05CF902870F36BC629978836A3755A94A0C736D5A87233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356968, "uuid": "fd375d9c-1e76-46d2-b781-033b85e6cc51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356968, "uuid": "f5ce266e-8e11-481d-b3cb-1b82c9a0ecc2", "value": "6144:K+y+bnr+Up0yN90QEA6juzzvrgwKt5tSmp/f2lCyfHejkGTRLkmU8IH3QenO:+MrUy907avvUwKtZelvfYfTnIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356968, "uuid": "60a13993-85d4-42ac-8a3a-b27cfc6e247c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356968, "uuid": "da0ee1f0-a4a3-4d0b-9091-55d4ae947935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356968, "uuid": "a93ad0ab-76f6-4201-8823-93ae0632b640", "value": "ee533beb76c1b57400860d938f7aec30a308a7de28e04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bf465d-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408058, "uuid": "47b44e4c-d946-461a-b46c-f548c786c001", "comment": "Malware payload (RedLineStealer)", "value": "dcebb3927b851c0857313e4bac406463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408058, "uuid": "b636e4eb-283f-49a3-a7be-ba181c8c04b5", "comment": "Malware payload (RedLineStealer)", "value": "ee583ca121b0264e151de47db9cb208a79ba7723010d1ef7666a5b779035b520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408058, "uuid": "0c4c3ad5-79c3-43da-9adb-644e5bae53cd", "comment": "Malware payload (RedLineStealer)", "value": "beadcff5da692aa60e3f93e1234adcedd9c323fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408058, "uuid": "aaa34599-ca47-4f8b-8009-37b1bd9add3c", "comment": "Malware payload (RedLineStealer)", "value": "31ed5c196325c5670c46660f5aee82fc55c872a10dbf134eeb1fdb02675a96673b9174a3223bb5119eaef870b1660b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408058, "uuid": "7c2d09b5-fc6d-4111-9ce3-6f558eb77328", "value": "T1EDB41211A2EC9436D4B1177058F602E31E37BCA19D7A83AF3745A89B1CB2BD0A472767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408058, "uuid": "81efde9d-a90d-4acc-8e6a-71d5c2ac9d07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408058, "uuid": "7f5cc7c7-e5a3-4602-b2ad-b5dbeb93e229", "value": "12288:eMrVy90ffXfWQhUaJZXhujw6wskjZKO5+SztJ+d:byg1uIZsjwv3Fo0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408058, "uuid": "216153c2-f447-4de0-85db-ef05a590ccc3", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408058, "uuid": "5c005d0f-91b0-4f68-bc4e-a49d0b36db49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408058, "uuid": "78ba73cb-4af7-4588-a109-3e69177b7a0b", "value": "dcebb3927b851c0857313e4bac406463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4a593f-2b51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690334136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334136, "uuid": "82eebe85-e343-462a-8828-d1c1b75b1623", "comment": "Malware payload (RedLineStealer)", "value": "2f15badba6517410d55efa1738f8af01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334136, "uuid": "502263f7-5563-4158-83b5-179bc73d75b2", "comment": "Malware payload (RedLineStealer)", "value": "f0411dadb92a7778d5e59d3226cef80bdab49e4796b524bbe13340826d30eb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334136, "uuid": "669d55bc-4a09-4261-bb62-49a181a2f3e0", "comment": "Malware payload (RedLineStealer)", "value": "93259c2a88beb2efd789d2e175bb80550e73d3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690334136, "uuid": "9338e2a2-e994-4dcc-928a-a124cb4823c4", "comment": "Malware payload (RedLineStealer)", "value": "9c19029f62c4159a90a3fe9b4d7ffbb5df42a3e5c720687438237b033fdf3fd44c05c9fb8fa215452f21077e8d5df1e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334136, "uuid": "038229cd-cdc7-4dae-ac50-fdd7d96996b0", "value": "T1ECE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334136, "uuid": "15dd0151-d2de-4459-8317-21e84c43d78d", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690334136, "uuid": "e5199713-ee61-432f-b78b-b3715cebcbf6", "value": 32259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690334136, "uuid": "c78ea55e-1f8e-4673-bbc4-5a452011609e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690334136, "uuid": "70dea136-4bd4-426a-ad8a-bf4b4eea7e5b", "value": "2f15badba6517410d55efa1738f8af01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9fa677-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690365680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365680, "uuid": "62fd8577-f8dd-4584-8646-7234e75235d2", "comment": "Malware payload (Amadey)", "value": "f176761e583fb0c114da56bcaea8631f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365680, "uuid": "3689f308-5021-4218-ab4a-c6ef9dfaa955", "comment": "Malware payload (Amadey)", "value": "f0b126d0f99290218d754006683776901ca143ed020d68cbb3e07b08ace41b14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365680, "uuid": "91fc25d0-da7c-4044-b60a-320c118630f2", "comment": "Malware payload (Amadey)", "value": "73419ee05957913a53a07cc2cac95dea3918136d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365680, "uuid": "059dfab4-b499-4567-a55b-7632c1c0611c", "comment": "Malware payload (Amadey)", "value": "85675cca405586dde8d8b2b14a0f778582d9b6c0965b274a441f57e2a69308e60a757d2ce5168b0d875ec18a5e1cab14", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365680, "uuid": "f8b0b08d-39df-4f98-a6c0-6d5e983eb57f", "value": "T1A6B40246FADC1563E8B55BB088F607831B367CA18D34976F2785DE5E0C73A84793072A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365680, "uuid": "a07d905a-9f2b-4254-af3d-b7035f657cd6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365680, "uuid": "fe5a99a0-94b5-43b0-b3fb-55ed9e61bbb4", "value": "12288:OMrTy90fPFKF2yHBw/mx+6Jd0OMqW2T0famuLOgj:FyWFKTyCp0OMj2T0fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365680, "uuid": "567737fc-e3e5-4f30-a37f-e63a04fe0797", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365680, "uuid": "2b7580b3-f5f9-4338-8847-26b42c805747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365680, "uuid": "9b623a88-5b04-4e3b-bf0b-58f9c9a7f593", "value": "f176761e583fb0c114da56bcaea8631f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bf5829-2ba5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690369883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369883, "uuid": "06a46adc-d9c7-437b-ab19-6aaafd8c240d", "comment": "Malware payload (RedLineStealer)", "value": "e2f90170a93d92e2d4724bf792f5cb55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369883, "uuid": "fbbeec3f-7ce5-446c-a2dc-92be2790fe80", "comment": "Malware payload (RedLineStealer)", "value": "f0b6c21e759cf709e1586c56297d1222e854e4925a2bb0839b5914322bbbecb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369883, "uuid": "f0ddf18a-6334-499b-8079-56a26f46fc03", "comment": "Malware payload (RedLineStealer)", "value": "1eccaa6928dd668bee2e781fdc16938515ec1482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690369883, "uuid": "9057ab90-870a-468b-adff-f9438d2e2991", "comment": "Malware payload (RedLineStealer)", "value": "b771f0db4eb83b39204e7eab61fd92bc06db56eb8ab10dd901c41d44e5376cbd8f864a7ec68b4938f0b5ff8782b71d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369883, "uuid": "cf64365b-00ac-45b8-8a7f-80306ade6200", "value": "T1A3840252A7E98532EEB927705CF612830B35BCD19C78836B3745A94E0D73280E87537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369883, "uuid": "52363eac-375a-4f40-a9ce-c5e3d90645fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369883, "uuid": "2c02d989-d48a-4015-9362-25765024364f", "value": "6144:Kvy+bnr+Vp0yN90QECghq0L3kWGjZNKTSJCBxCDGJSZyfAdqWmeeHuoFi:lMrhy90sGq0/zB5SZEAdqju+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690369883, "uuid": "92f52620-a540-41ad-b7ce-ca23c429592f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690369883, "uuid": "abe00857-cfd8-4048-aa99-e5f4e6b06d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690369883, "uuid": "cff89865-4c39-4021-9191-ff40ea7e1112", "value": "f0b6c21e759cf709e1586c56297d1222e854e4925a2bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e461328d-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690350872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350872, "uuid": "ac1da006-5977-4dc6-9df9-7ad67beb003b", "comment": "Malware payload", "value": "562dad8865fb593d858dbbb4bbaf3dce", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350872, "uuid": "63ab0774-a21f-48e3-80fb-135d612731c5", "comment": "Malware payload", "value": "f159c587107ae028a90f4b5f740b9afecaaadd422276fb570e0f00c26f75f3bb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350872, "uuid": "8af2ffb9-73b9-49d5-8afa-ee3c2e421f3a", "comment": "Malware payload", "value": "c31209046c39faf693d642199dbe69a0dbc8f20e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350872, "uuid": "54c448f5-651c-481a-a1ab-2c8f66948dcf", "comment": "Malware payload", "value": "48bc2ef59912dbe07bbadd5d2ffef53f8ef901d78c932e2b74eb43754ee287a36f401fc35c83f4fe9fdfbcfac3c7ade9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350872, "uuid": "93068ae9-7bc0-4aa8-b1c2-9dd8f7c174df", "value": "T18065BFB875047DE6267F536BDA96ACDC13B62A639ACBA4CC40A477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350872, "uuid": "7cbf04f4-0eeb-4244-b6bd-763b7efc2ade", "value": "24576:04v1mbFqCv6jza/+i0wv6x4ZrNXgLMjnw+HqnDZM6HLgeF2sUA3nfD6MAzWGBEjV:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350872, "uuid": "9a54873a-5f56-449f-9abd-5bf5a595d332", "value": 1541251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350872, "uuid": "4bb9f78f-c81c-4a4e-ae60-5feb868e360a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350872, "uuid": "2da5b27a-fad6-4cfd-a22a-0fcc0108ce09", "value": "RFQ-MANGUSTA-CUSTOMER099-purchaseorder.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5693687f-2b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690356217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356217, "uuid": "9617998e-9be5-463a-9678-592f45c95509", "comment": "Malware payload (RemcosRAT)", "value": "bb0ffc7deb7415da9a88ba3325c0f7f0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356217, "uuid": "6b37dc0e-2679-41dd-82c1-20ca0abe657c", "comment": "Malware payload (RemcosRAT)", "value": "f1efdace5d1171a1599ec3cdae2f3a508360d6e1c21cfb151749135ceeedc779", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356217, "uuid": "68d60eeb-c117-42f3-8175-6d55ba50270d", "comment": "Malware payload (RemcosRAT)", "value": "d98a9e2fb2e1a803d9d5088c689efff9cf04e173", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356217, "uuid": "d5d8a138-edb8-4ae7-ad69-f8fb2b8ab018", "comment": "Malware payload (RemcosRAT)", "value": "4a2a1b9091c6a044c3335fa035c3dd2a89eca097254c07458413f3844e9b5dd15d57626d5565d0178cfa8d5045570a5b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356217, "uuid": "f88f76e8-b4cc-4118-a34b-ee9bab27ce96", "value": "T1E7641211CA54B02FEA5B473068F2B3BBEBB7F65C54106E1393206E497E23A13652B647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356217, "uuid": "2c483c12-cfaf-4864-9f4f-317722e35721", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356217, "uuid": "85eb273e-cac1-43af-a209-bcd5afea7d0a", "value": "6144:gpkXchFfMd+NzFWZ5Sfvt1P8YsTcSjdeY6bIFEb9GKgJEwc+IxXzcg+Zw4fToJ:16Udu+5avtyHISIp9OJLPmDLiwO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356217, "uuid": "f1fa67f4-cd6b-4b68-b57c-5981609906af", "value": 322032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356217, "uuid": "be0ed2b0-3c5b-4715-bed1-0c04f1297cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356217, "uuid": "dfcaa249-b27a-4b20-bdb1-5bdaee8dccaa", "value": "DHL Tax Invoice 00199188819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530e91e7-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356641, "uuid": "d7412dad-b19c-40b2-a6c4-15f11b053847", "comment": "Malware payload (Amadey)", "value": "a48a7d72794070d31511b8b31d5a64aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356641, "uuid": "4800138b-4284-4f20-aeb8-4df3bbb2e086", "comment": "Malware payload (Amadey)", "value": "f210ec7f3f786772b0274d11ded8dfa168a4c68fbbe8aa56cced1f50c73e91fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356641, "uuid": "04305cb1-2882-4b11-ae6f-f11f7caae600", "comment": "Malware payload (Amadey)", "value": "33f1c4accf65125550958f5b1159a18c5c38366a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356641, "uuid": "3908d905-5ad1-49af-8722-752df3261396", "comment": "Malware payload (Amadey)", "value": "072eed822565d93141d067faf3f65ec95c3a51af9d14c9cbbdbcf2a973106924778c0c16026937370282fd3b8ef7a305", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356641, "uuid": "b73897e2-3d17-4ede-bb7e-2ff38170d615", "value": "T17DB40253A7D89073EDB52B7058F602E30F39BDA15978836F2245691F0CB2AD5A43237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356641, "uuid": "09be5ff8-4972-45ea-9ade-83cd8506edbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356641, "uuid": "fe1c6a8e-6f55-48c2-b5a3-7e6572e49493", "value": "12288:2Mrny909ZZsFDklhurWgN2F9m2/kCmtAugtaWpV:Jyg+gCrWrw2dQANtaWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356641, "uuid": "ca0ce256-377e-49d2-9f92-670699772342", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356641, "uuid": "080ed76e-029a-4eae-9938-6378fe5f81bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356641, "uuid": "1c7c714b-6a96-4d59-845b-46f71cb064b2", "value": "a48a7d72794070d31511b8b31d5a64aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c311ade-2ba7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690370937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370937, "uuid": "a0f50537-2ccb-4ec2-93d6-bbdb35ae453e", "comment": "Malware payload (RedLineStealer)", "value": "6bdd9920eb48020a3da2e5296648233a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370937, "uuid": "7355ffb6-3fca-465e-ade4-ca093acaccf0", "comment": "Malware payload (RedLineStealer)", "value": "f24b3812d45263f6998aa5e2edfd61f5919d81a6916c52e7d4d0d1c53a050afe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370937, "uuid": "1833b189-bd3c-44e0-8ebd-c01e607a0645", "comment": "Malware payload (RedLineStealer)", "value": "4ba98966e670a0149111e69f5bdee493d333e001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370937, "uuid": "a70acb50-20ab-420a-816f-7f464a370214", "comment": "Malware payload (RedLineStealer)", "value": "d15133f8d7f18c47f24186e6dd5cbdd50a3f28d72a8d30c009ba674b41e7fa7509f523d3d004c8810781c299001d8fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370937, "uuid": "46554d94-7d9b-4a45-ac69-adc2fe16741f", "value": "T1C394E7C393E1BD44E9258B73DE2FCEE8760DF6508E4D7B66A128AE1B00B51F6D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370937, "uuid": "f024e72e-7af4-46f6-ab00-a8b000a26eeb", "value": "28e47df11fcc31ecc5eec0c4cd0746c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370937, "uuid": "71c4c7e7-69e7-4b64-bcc8-0a093f2ab68b", "value": "6144:peU0KL1lNJBFUcefsLkf7hG1Ot2WXWmWj2ta+7SDuW7Bmjv+HT:gU0KhlbBFSfckf8OFXWmH9SDLsjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370937, "uuid": "43f52a6c-4883-44b7-bdc5-ac5f742e3377", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370937, "uuid": "2ad4f2c1-c7c0-4fd2-9391-f1fd7e130ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370937, "uuid": "dcfb9155-7ac0-4a28-9494-b2821ddfa980", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c26c6e1-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690365112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365112, "uuid": "7b64119b-6770-4e59-bea6-69a4414cfcd2", "comment": "Malware payload (SnakeKeylogger)", "value": "8a2c3586f1d9740de3dbaca37c24d0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365112, "uuid": "2d3a9106-d765-4758-9223-759b7999dbf1", "comment": "Malware payload (SnakeKeylogger)", "value": "f24e3849f3a32d5053a249c5435336ea11c542393e98ba70f6725d4b34176158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365112, "uuid": "6ae0d841-266b-4eba-bdf4-2d6e301bae5d", "comment": "Malware payload (SnakeKeylogger)", "value": "402e4baf77a014d331c0f1b8dc2c04ddb2081b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365112, "uuid": "a690a47f-e24e-4dcd-bc2b-ce0a45caef14", "comment": "Malware payload (SnakeKeylogger)", "value": "36ee016b5cfa3b57dfd5c9872685e148701f5310298fd4f456598d95acac146fab1a1ecdd790770ff95761dc1091b4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365112, "uuid": "8e24ab28-a41b-453d-a9e7-19d084b456cd", "value": "T12DF207309768E132DA953A7A9AA6670433389E419CC3CF27794C2F1F9D613549A333ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365112, "uuid": "f533d48a-3f4d-4139-81b8-dc8be792d11a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365112, "uuid": "e1dc1548-9a6b-41be-8e5d-fd31611f1045", "value": "768:wHos0HdawiSguWps4nMWp/DI4XuMI/c6nOa6Tvk:wHordaDsLao1c6Oaik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365112, "uuid": "c92cecda-e61f-48aa-b9ae-b0fedec004ad", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365112, "uuid": "2af617e5-461e-4142-bc07-29bc09f1fadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365112, "uuid": "b357b1d4-5a1c-4bb2-b4f2-a5e1dbef3ce7", "value": "Jotnlah.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46baca47-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690365640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365640, "uuid": "0d452f87-0058-41db-8a33-770793f1152c", "comment": "Malware payload (Formbook)", "value": "4463a7e42710fcb268d160ea8544a60a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365640, "uuid": "ba5cb675-4870-4b20-a26e-bb75b999c564", "comment": "Malware payload (Formbook)", "value": "f2674b3bee2f8ae1a08576a04c6d301e58f33a5c6456d32e09bde8e7997479a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365640, "uuid": "90b88f36-824a-43f0-8edb-df2719bc231e", "comment": "Malware payload (Formbook)", "value": "07f5ef2fa08ad8f8ca4a7d146c57bf30c359801c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365640, "uuid": "6d1a86fc-cf32-4d1d-9bfb-40b7083b38a2", "comment": "Malware payload (Formbook)", "value": "836104f128e8c99e2fdf9f5e499e0636fe7213334be0c2f5ee4ea3f4304fdc949e4166277e4e801f885fe1e0c63561f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365640, "uuid": "7f167e31-e32b-4097-96a3-82060e7c3f48", "value": "T1C0D4121473ACAF17C8769BF5025A544517F0CA77602AE3462FC3A0EA9EA3F145760F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365640, "uuid": "cc8411b4-c15e-437d-bde5-f10af3935a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365640, "uuid": "94261616-7669-4e6d-9264-6589f181c6ac", "value": "12288:tJmefaynhPRWiy4u0ZPHgjMeQmRf8kYbMFZJEnvS6:ieCQJWiZB3eRf8kaoZKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365640, "uuid": "a402185a-b466-47d5-8cba-e37283ce1369", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365640, "uuid": "5265b0a4-3716-4057-aae7-12f326456079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365640, "uuid": "1bea8ccd-2eef-40ae-99a2-4fee0054d3a6", "value": "shipping documents_FEDEX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf91547-2bbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690380411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380411, "uuid": "93ca76b3-8488-4fa3-bc97-c7a95d0e0c26", "comment": "Malware payload (RedLineStealer)", "value": "e043cfc896b747c9da76b626d8a91785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380411, "uuid": "c7154420-88f1-49fb-be49-af25c570a2de", "comment": "Malware payload (RedLineStealer)", "value": "f287baad5f4bc61757f1d71beab9f5484db7ad909b0d5bf5dec0ec154a1728b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380411, "uuid": "fbd67064-3639-4222-80e8-e8cda7f928ab", "comment": "Malware payload (RedLineStealer)", "value": "0dfdeb5c2e5898028eedcd664840096b59c6ee65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380411, "uuid": "f28c44ae-4c69-4f6d-90c3-e985dc16b155", "comment": "Malware payload (RedLineStealer)", "value": "a8fbae0bb33086ec127aa83d64de81622efbcc9f5bcb62223ddb0f923f84b87af1900a38646b1124a737ab59c5c2e56d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380411, "uuid": "c405dc74-31f6-4f85-94ae-dfc9b8316c9c", "value": "T165840202BBE85433E8B513705CFA13C30A3BBD525D79936B1756A85E1CB2AD1A83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380411, "uuid": "f06cf697-48f3-4f6b-9723-c9d3a16103e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380411, "uuid": "027745c1-266f-4238-8736-c594d7a06870", "value": "12288:VMr0y90B01REW9+fbdMetRB2grwmmdY7Y:ByM08FTtrTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380411, "uuid": "1191cd90-1d89-4145-a553-a89257448569", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380411, "uuid": "575c2c34-2ad2-4f8e-b6b4-deb3dccd0597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380411, "uuid": "250abc0c-4f7d-420c-9b17-6e4a06bf8984", "value": "e043cfc896b747c9da76b626d8a91785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7445d47f-2bab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690372588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372588, "uuid": "e705abfa-f29e-48d8-9a5a-791b550376ba", "comment": "Malware payload (Amadey)", "value": "626bfead74626581e2d277fb008025e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372588, "uuid": "ee4e23f2-641e-4b18-9243-d7c6c571b175", "comment": "Malware payload (Amadey)", "value": "f2edb13b2d4c67b6c297b57f722eba7629c83ce574d07f51c2454404d91a9c56", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372588, "uuid": "12649ebb-593a-42c4-87d4-15d836a3c1cc", "comment": "Malware payload (Amadey)", "value": "24cea48e7bd497e7ba35bec567ff54968c7ccd0e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372588, "uuid": "08ec2466-2d54-455a-abae-9f94fd1d4996", "comment": "Malware payload (Amadey)", "value": "a29e4750d5ab2ddd05449405cee7eaff4497cbb6a0c9d3d650e76c4ff81400767b537000e801200c92140beb92735854", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372588, "uuid": "70e29e7b-b375-4723-bbdc-a8701caa1932", "value": "T158840212B7E99173DDF61BB048F602930A3ABC604D78836B3359694A1C736D4E43676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372588, "uuid": "6ff8e8b9-ff1f-4cde-8ac7-b5f191bc67e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372588, "uuid": "c7318364-0cdc-4155-b43f-97cad78f4644", "value": "6144:KVy+bnr+Hp0yN90QE+W+fSkW8nZNXnkT6hokhkqOJSKEfd/BOmkBKHgAW+O9cq:fMrXy90Y7kTzeWSKSd/BFfy9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690372588, "uuid": "e8ceb86c-7d64-4c47-b263-be975fb081b6", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690372588, "uuid": "78f107a2-be14-430b-8468-38099b71f4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372588, "uuid": "b9aa2b43-ae7b-4b80-9a2e-3bc87aeb7372", "value": "f2edb13b2d4c67b6c297b57f722eba7629c83ce574d07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44d548a-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356052, "uuid": "55a012e8-c872-4259-a930-584ff4e356a6", "comment": "Malware payload (RedLineStealer)", "value": "4abfd9b7a6f89c832a9eaed2c7bfbd14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356052, "uuid": "d789942f-69f8-414c-b680-5c48502f90ca", "comment": "Malware payload (RedLineStealer)", "value": "f32b2bda7fa745e473a8cb6e3fd762f154601936de72b7b203aa2c64cca25169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356052, "uuid": "3978545f-763e-48b0-8c3a-4582e93cd666", "comment": "Malware payload (RedLineStealer)", "value": "86e785144588535399be34bae7b00ed523b8a536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356052, "uuid": "276ed1af-afa1-47d2-8a7a-574a9987d227", "comment": "Malware payload (RedLineStealer)", "value": "839c5360c618c5d7f66728e67f4d4ea7393e62304f88d6a0a8d931ded20a37be2fe861275e01c1be4ce0e46752168ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356052, "uuid": "036d2788-f677-457b-9441-674c42d15589", "value": "T13884010376D88473D8F61B7018FA07931B36BCA26D78436A3785A85F5CB22D4A57237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356052, "uuid": "ce23e94a-b2fc-4ab5-ba61-1149ee765650", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356052, "uuid": "3739b1ce-8c66-4e2f-80e0-4b153254b0ce", "value": "12288:9Mrty90WiJkjYqncX78rivgBYCM4h+xcbc:gydDFcQeIzNh+2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356052, "uuid": "1db684b7-7114-45f2-8d85-7eb139c6d71e", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356052, "uuid": "3d9cdf52-c639-415e-98ef-039436200827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356052, "uuid": "d299a75c-17f0-4708-b835-4728502834fa", "value": "4abfd9b7a6f89c832a9eaed2c7bfbd14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ddf2f1-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365093, "uuid": "d9219066-69dc-4010-9bbb-8e5a2420593c", "comment": "Malware payload (Mirai)", "value": "7e38871015673ff622bfd3ffcad54e6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365093, "uuid": "10b557c6-88e6-40a3-b561-523384c972ed", "comment": "Malware payload (Mirai)", "value": "f3408d89e567a9d481b08392c34917578362fe7fedefba344d37979e599e1ec3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365093, "uuid": "77ccf8d2-1f59-4ca7-bcdd-da40a5d3470d", "comment": "Malware payload (Mirai)", "value": "97c5a1e93667f3057a9d48a98923edd6fac8bfcf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365093, "uuid": "5ab16fb4-40ee-4e34-a947-607afa6ce952", "comment": "Malware payload (Mirai)", "value": "805828faf30c7cbe9b13b06c11bb9d61cdc0722f078af100ac0a72f2eece93e41d04b904b2fc2f76148704f5ba9edbba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365093, "uuid": "bf4e384e-890c-4909-a79d-12f33dcd3813", "value": "T1AFA2E014BF18868FC832693455D9EAD61292FC72F2EDCD592A40C16FB0B33E92474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365093, "uuid": "4b412494-d4fe-4e8c-a231-95a1e968ab70", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKG:M98o08kxofBE+ZkXaqGbp2F2TWul0c5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365093, "uuid": "d6544efc-ce84-445f-af13-153370fd62e6", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365093, "uuid": "37d7cac3-0c79-45d6-b257-9a4bdf950b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365093, "uuid": "0fd594d3-c288-48ca-9c61-5c2461784e4a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f9829d-2c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690409694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409694, "uuid": "20bd224d-be9e-448c-b3a2-ff59d49166eb", "comment": "Malware payload", "value": "cd572980c714c98bc2abc973e8ce4bc5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409694, "uuid": "df8bd339-97ff-4af2-8e2c-813dab9691ad", "comment": "Malware payload", "value": "f433f0b1f418cc13cdf385d81ee26bd998c61573ce2fc91375e58729f090b21b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409694, "uuid": "ed176df1-cf4c-403e-a5cd-064ab9e8be57", "comment": "Malware payload", "value": "7adc5d36c7b8f30e097700672711b9de29e9af51", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690409694, "uuid": "c9d05c1c-6242-4655-81a1-fb9fd6693e71", "comment": "Malware payload", "value": "1cf03f7e22e841b0571ae1653d2540b7f559c53df89cc68e0c5b8b94241e4076d9ffb2f4deede4a3abce815bc3edfe3f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409694, "uuid": "9383ffd5-e11b-40f2-9a69-2ea6204f36dd", "value": "T150A51253F625A95BD8F6C33321784B3651774D28CB03BB8A294973BE28F79E84B851D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409694, "uuid": "7c7d24e7-0089-4810-9c98-a5bb9bbafd92", "value": "49152:r/0MorXZnSzGTV/W7ux1YZjsN5iwdt+T3foz9yX4A1:z0xbE2oe1jNMsKvozwIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690409694, "uuid": "40b88de5-e64c-4271-ad77-011b7ee894d4", "value": 2183978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690409694, "uuid": "201c41a6-6953-47f7-9e4d-b9cf965e7f84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690409694, "uuid": "f86031d2-53e3-41e3-89f0-c440f0d68c75", "value": "eblagh.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7450f61-2be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690396296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396296, "uuid": "ae6d8c2d-cd82-4512-9943-7d8f4d73bb5d", "comment": "Malware payload", "value": "e83798fc59168e5378e54557e7593e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396296, "uuid": "105bee64-4966-4293-b86e-afab69c7db44", "comment": "Malware payload", "value": "f48f25e9897d49c375533f317304227ff8e417e8086665eb8b814f34ac2f3689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396296, "uuid": "44482e66-e399-4186-838e-b40ff1fb7769", "comment": "Malware payload", "value": "3a0db3a5f917ff848ac7d3057cc8a8bcf5199014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690396296, "uuid": "dfe0eecf-0671-4e41-a08a-07680e19c4ad", "comment": "Malware payload", "value": "efcc3163e841c2bb9e8e478e14c2ecbf7ae82998191dbfd26a15493e55020ded2afb84b669536e5a4898443a26075e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396296, "uuid": "8b3fc6a4-fa83-4ba3-bac8-4eadc3d35d5d", "value": "T1D7047B1275E0C0B1D573423649F8EB215A7EFD724E669A4FB3D84B4E0EB41C0A726B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396296, "uuid": "512f16e0-cb93-465b-a3c5-a8334ed2f00e", "value": "2bcb92ce41cb36d7369a6acfcddcf8f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396296, "uuid": "4c98ccdc-677b-440c-8df6-79c05d1ee379", "value": "3072:AsabrAdsVqHj83p9lYUoS98/n/+hQJrHr0bXj7JmF:AskrUsyj837dK/RIbXjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690396296, "uuid": "ad3f09ab-3ebb-423e-9b40-ae125bf16b5e", "value": 179720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690396296, "uuid": "4a5be8af-89dc-4465-8e69-f35b801b04bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690396296, "uuid": "9b174ca5-aa4e-4ecf-bd45-822cfe4cca38", "value": "SecuriteInfo.com.Adware.Zaxar.111.23706.24012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1dfb80-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690407766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407766, "uuid": "345a38ac-ec15-4573-b556-814dce645b50", "comment": "Malware payload (RedLineStealer)", "value": "cef13ab393a8dd3a0169f42b997ff0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407766, "uuid": "691d2526-0d4e-4915-9d6d-75fea4e3aa78", "comment": "Malware payload (RedLineStealer)", "value": "f4ab96dd216f74df9903be775e97aece1de50c66401c82676cc8838f1fa84b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407766, "uuid": "9dad9326-4532-40f9-9508-26460e0ef9d2", "comment": "Malware payload (RedLineStealer)", "value": "c453ae5f1793c31ddd608e656829ceaad6b2cebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407766, "uuid": "5fb666e5-ff1f-4890-87e8-486bb7f17425", "comment": "Malware payload (RedLineStealer)", "value": "88a56238a6773a7cd89c1f98d2cb62f64181b36ed4e35399232b3d89613dfe8a7d02b9bab633e551f5faad5d6052eee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407766, "uuid": "a04c2723-33f0-459b-b289-7bbd218bd917", "value": "T176B41256E6E84033DCB61BB05CFB02930B36BCA198B8536A77822C5F1CB35C5697436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407766, "uuid": "92a2f4e8-51d3-4a4c-aaad-9596f9149118", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407766, "uuid": "c6471e6d-6570-4d00-83b5-6a6e8cd52ae1", "value": "12288:qMrxy90MFL+EZfJ4GlLROgOWiC5KVBg0TDQ9yYW4:bynFL+gaGlNB5WBg0TDQMYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407766, "uuid": "a9731590-d06a-4721-9c0c-812a09ce0d04", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407766, "uuid": "2d2cb268-7ba7-4a64-b618-4472a8e30891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407766, "uuid": "8dd15fbc-4660-40ea-9399-f0dbf49c9795", "value": "cef13ab393a8dd3a0169f42b997ff0f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b24d611-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690355769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690355769, "uuid": "a0336d43-89ee-4604-a272-624f8c999782", "comment": "Malware payload (AgentTesla)", "value": "20ad14bdb8d85a6c0c877b6aa47383dc", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690355769, "uuid": "b83b4ea4-33e7-417c-9d23-95e8cc6be591", "comment": "Malware payload (AgentTesla)", "value": "f58c39861ed6fe0fc84f945402704529b9a6133bd52ecc1dd277d96185f0c6f4", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690355769, "uuid": "3d155995-a5d5-4841-a8b7-4bdc4c0456a6", "comment": "Malware payload (AgentTesla)", "value": "04418d90fbbe2d9857b6b21c3e84bbd2c0bb1b1f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690355769, "uuid": "5356233c-d1c6-4c15-b8df-5d90662aed89", "comment": "Malware payload (AgentTesla)", "value": "932c9f842f8a603d7a9843c89a2068ddbe0f463e7490d3079bc70911abd6ddac6a6478cda955819115f6b04999766f16", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690355769, "uuid": "3eb84595-14d9-4d82-8dcb-dd8cc496e86d", "value": "T10ED4336E28B95F61E805E6C6AB547A27F7B0161374CB56BB793429C09F6B84C30CB063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690355769, "uuid": "3d779411-4864-4e08-b0a1-e1c34d98a25e", "value": "12288:68Aw1E2hdLdM24rSzWa3RjPCe1uOlq+8mhSQ02p/w8jbSP4G6KSiZRY3nI:LhdLsAWa3RWcfDPSzMiZC3nI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690355769, "uuid": "035cc575-7b25-4072-9744-b9f920b99c85", "value": 644701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690355769, "uuid": "3e652dbb-50e7-4439-8867-b927cc216c50", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690355769, "uuid": "bf9d5fe7-aedd-4944-81c0-e2f61f8d6c21", "value": "proforma invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5eea9e1-2ba1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690368376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368376, "uuid": "2c4f9938-76d7-4fe1-b6d6-2edcaec455b0", "comment": "Malware payload (RedLineStealer)", "value": "0eb1fbc2d5ee4ff34ade8b4c2253e955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368376, "uuid": "4283f7d0-0c05-4a69-9d49-f6946c79ddbf", "comment": "Malware payload (RedLineStealer)", "value": "f5957f382ef0f17bbf1d83cc0b5d4f133ae56c9c5a3101548b66b2462dbe9b6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368376, "uuid": "6019ac01-8da2-4c32-9b94-776151e2a402", "comment": "Malware payload (RedLineStealer)", "value": "ab76633544a01eea4234f73c227c439ca8749eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690368376, "uuid": "68532f65-2a4b-4077-bdf1-6f0aa1682470", "comment": "Malware payload (RedLineStealer)", "value": "8d5042836ffceeb0fd4189daef25f00f6580d16d1ee4ab5a5b00bb71309e0f8dd03e56311ba60f2c0923d62a7f90580e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368376, "uuid": "fb981d7a-464f-425c-8358-f776ac57f53d", "value": "T176840152A3E88032EDF413704CF617D31B36BCA19E6443AB179A5C5A5DB27C1A93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368376, "uuid": "710103b5-8e90-42ef-81f0-e583de0ea4ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368376, "uuid": "322f93bd-5514-4965-b9d8-276bb8626734", "value": "6144:K6y+bnr+vp0yN90QEXDpy8+SzJ8b9UVB4pAj03UzOPE5iVWhM0ZihJ115sS:WMr7y909fb8b2bBQUcsiiM6uJ1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690368376, "uuid": "e045e2d2-1d08-4e5b-81fc-92a02fd5c921", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690368376, "uuid": "daec3983-0d60-4be4-86fb-92d888ca6e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690368376, "uuid": "14627641-d3e0-41fe-ab68-af30c376544e", "value": "0eb1fbc2d5ee4ff34ade8b4c2253e955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9c39c1-2b8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690360177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360177, "uuid": "0df77ae5-3979-4bd8-8251-ae23bbf97697", "comment": "Malware payload (Amadey)", "value": "6e9b0975d22594f044b5db83a71a60ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360177, "uuid": "678f5a07-1294-4d58-9dee-641b17258a10", "comment": "Malware payload (Amadey)", "value": "f615d98c4826f475fd62def444485f869dfd853f5bceb75fabdf6f7100470900", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360177, "uuid": "04cf2c27-22e6-4a14-a281-8b8e04189c40", "comment": "Malware payload (Amadey)", "value": "e445bd1a0c6429d5b5035977394646320921a2ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360177, "uuid": "5d5c68ff-02aa-49e2-b4ba-93f922ca21e1", "comment": "Malware payload (Amadey)", "value": "f3b47af652ee6ddddc4d5cd239ecb3b9e043c461b13b059d2ad12aa745174ba1ec0c73c5d0bb34c805d14f80bf1da000", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360177, "uuid": "bfaf233c-cdf8-4b7b-b481-cd72f965d4e1", "value": "T14FB40212E3EC4033E9F6277468FB42C30E327DA19D78476B2385A9694CB3594E57236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360177, "uuid": "25f408be-a872-45bf-9555-1d70d03da06c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360177, "uuid": "2ca3b25c-2c28-46d0-88a5-3abc419819c9", "value": "12288:UMrby90WtzUSZclDlTsfW7HB2QAo/k3M6MCt/nC:vyBtztmPTsfW7HIr7t/nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360177, "uuid": "9542a989-f025-4a22-b0ff-79213a539a03", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360177, "uuid": "5a2bba46-7327-4068-9477-26c31015609a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360177, "uuid": "5ad0aa62-7830-47eb-b64e-768462220384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a185264-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356653, "uuid": "c603fa04-ff78-4460-ab24-93bc6a16a0d9", "comment": "Malware payload (Amadey)", "value": "c44bc92997bcb78b5ff730303f562241", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356653, "uuid": "4d982c3c-1c98-4140-b1d4-4f2151f581d7", "comment": "Malware payload (Amadey)", "value": "f6938504835e1d56ce0bfc128ca02dbd890ef7875347a7764cfedb2263fa5201", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356653, "uuid": "0f0648ef-c846-4b01-9270-035cd74c84d9", "comment": "Malware payload (Amadey)", "value": "1c2fb25f63a12b22f0a02da59c81f38f81205cc7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356653, "uuid": "bc3fa887-2b84-4e4a-8a87-a28ec8c0af53", "comment": "Malware payload (Amadey)", "value": "cb5e8ae6e7c3845e2474fba49969d2d9c941527db64d202c0cf95dbc1e3bcfc395a8d8058996febeed094d5556ef5be6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356653, "uuid": "37aee904-307a-44ee-b325-4818c032f569", "value": "T1CAB40243BBE480B3D8B117B058FA06D31E397CD29E34C76F23859A490CB26D4A97177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356653, "uuid": "29b7efff-9397-462e-a9ee-e4da0fbf7aae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356653, "uuid": "0c4f4d6b-e960-4b7f-a6ef-59a0b11695eb", "value": "12288:VMrJy90MH0PTV2eRgbRWEMv8uScdQO+Y:syt001b1M5zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356653, "uuid": "d73fb800-8f2d-4969-9f16-d78cd5f45ffb", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356653, "uuid": "b3824684-8b7a-48a9-adbf-8030ef88c4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356653, "uuid": "62f727c5-ca5a-4da7-a12f-0304d79f789c", "value": "c44bc92997bcb78b5ff730303f562241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d82230-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408073, "uuid": "ff9d5e77-78a6-48d2-b7ec-5cefe7d349c4", "comment": "Malware payload (Amadey)", "value": "d8394ec558327729eedd07b306058a18", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408073, "uuid": "176d6562-4d1b-4561-8757-e0dc0cbae0fa", "comment": "Malware payload (Amadey)", "value": "f6a6dc79d4555766019063ac744dc95dfbe14d7462d7e2424103209b3b262554", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408073, "uuid": "6b789bfa-6bb5-4e10-8407-1013a76cb157", "comment": "Malware payload (Amadey)", "value": "52048b18edfaa34efce38a061b546ac55ac55b53", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408073, "uuid": "668faee2-2500-46ea-8fef-7b41205d2a87", "comment": "Malware payload (Amadey)", "value": "a76d212cb66b5e8d2990f9ae4af6f78fc0cc129b67dadd541098dcc95d4e2e5a399590553dea9af6a1e5b5740eb5bdd8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408073, "uuid": "4ca05107-356f-4e05-8402-6c05945053d2", "value": "T14C840202BBE88072D9F12BB098F613930B36BDB14D74836E2795685F0DB26D4B17572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408073, "uuid": "6252224b-15fe-4cd3-8ce0-61a4c6fe6e29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408073, "uuid": "ef1a23ec-f3db-479b-a859-a44833f2674f", "value": "6144:KRy+bnr+3p0yN90QEG0ibU9Nsn2UqJzGMmpLGIj9xuBIOnVvZ25vsjRfVt:bMrTy9080bHqqGZFj9xuBNnVkZmRfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408073, "uuid": "3e3bd983-c7ba-484b-b069-a35c92a69f4c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408073, "uuid": "f592547a-7d85-4535-98fd-6ca9fb377b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408073, "uuid": "9e3142c3-f6ef-485f-a736-dbd2c50e96a9", "value": "d8394ec558327729eedd07b306058a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d108166f-2bc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690385199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385199, "uuid": "1a3deab3-eb0c-40c9-ace1-0af29fd0bb76", "comment": "Malware payload (Formbook)", "value": "9465ea038ceaa9e99af7d72a0e6e3820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385199, "uuid": "d91a3b2a-e424-4eeb-8a72-7e4ae06c1cba", "comment": "Malware payload (Formbook)", "value": "f6b86fa0db0a8371b1baa4ff5180fd0def55a16b3ea40e4bf4b2cb7664c384d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385199, "uuid": "41791f1f-9973-4882-a27e-785469116adf", "comment": "Malware payload (Formbook)", "value": "7f09e88ed40b64af5ec94ab1bcc14d7a5e67e502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385199, "uuid": "6bc3e0e2-8e53-4f31-b71b-94b93f2654a0", "comment": "Malware payload (Formbook)", "value": "9d3c3b580c05d5a923b195e06f73455b97b078695c6d455602281f4473eada40cb8508f84e96d41cb32851e777b32cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385199, "uuid": "4dc631dd-5e35-4d0b-bd31-a18a3f4953bf", "value": "T112E40186326CFFC6D83AD7F525063945A7FC96231B27E3691EC220D29561B050FB3A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385199, "uuid": "8cfa34d7-e9d2-4bd5-99a2-4a0bad57f0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385199, "uuid": "476a6a62-98b8-41af-921a-de4ab75cd221", "value": "12288:jJmefaynh3+PlT0LGOi3949nwtVdUkjqIETBU3NeN4eO+VyS+BJSpahYcu:0eCQOl0N6MDTIRNk4LlvSkYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385199, "uuid": "8e4c58a8-5be7-4256-9769-bffbf6c60c1e", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385199, "uuid": "59ead1f3-e67d-46ac-bb1a-08d3e5834164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385199, "uuid": "bc3db8e6-2c02-47a3-b594-d8fbc0db6741", "value": "hesaphareketi-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d4df36-2b64-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690342088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342088, "uuid": "7fad846d-5702-4ad4-8177-4aa56d4ff6a6", "comment": "Malware payload", "value": "648fcace6a70b6800492350e02ccf6a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342088, "uuid": "d5b8dfc0-ccaa-4169-b1d7-19c21dcbea2c", "comment": "Malware payload", "value": "f7628e8ef0297ca1c10d1c514e992e3b44505c6d4efc88ce65f0ca958429a4d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342088, "uuid": "269d4a5b-1b93-4bea-9a12-f459709fe6c0", "comment": "Malware payload", "value": "fb8924182e5a05871082ffde577fc3b988a02922", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690342088, "uuid": "9f178348-95f8-48f4-9957-afdb3e8df580", "comment": "Malware payload", "value": "822a39a716cf54bd0af9151c8ec96426d60ada25173b5ea124ab44f7559b11cfda70ad43ec92a01026fc55f723bb31b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342088, "uuid": "820f0236-1b9b-49f0-b293-82abbb059c6c", "value": "T1D542AE324B0B44F9DFC99DB486879D6E2A22A42464880570DF360D0E7CA5BB7F29B4D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342088, "uuid": "724e29ef-c07a-4d7b-b79a-5cbf801de6d7", "value": "6b2143eb6bf3b6b18e23ff7de66e6891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342088, "uuid": "15e251e9-21fa-45a3-ad46-68d77d07fa31", "value": "192:0PWt0VONtmUIX1RpxmHxojXgqi6UnZ44yJpI:0etPyPlBOxoUqUOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690342088, "uuid": "f9e74207-67a6-41a2-8338-8794904793ca", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690342088, "uuid": "ef20eb37-0dca-47e0-ae79-16737077c510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690342088, "uuid": "46c73922-944e-40a4-bb5c-1496cd05cb71", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26370.28194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5549958f-2bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690407755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407755, "uuid": "79bd12ba-03f7-43f3-b47a-f887c4a3354c", "comment": "Malware payload (Amadey)", "value": "5b0a53db34e11d44de12484cb6883b78", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407755, "uuid": "268a557f-aa8b-4145-8ccc-8ab02db8c0e9", "comment": "Malware payload (Amadey)", "value": "f78d5497e1c27156b9de7249bbdaf3d02f44466943578a494cb2ffdcec95f445", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407755, "uuid": "c1804262-5fe4-49ad-936c-0c0ea3ba535e", "comment": "Malware payload (Amadey)", "value": "544941a8b5684fbd0b5352add5eac753a49a82ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690407755, "uuid": "adc388f8-30c1-4ba7-ab8a-f8c2de14569e", "comment": "Malware payload (Amadey)", "value": "85831bdd1056081d48255776adbaaf5f8bd94c1b116541bd90e02fa64b65ecf2c010ed4dd497cbb798c0ee83bd767f07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407755, "uuid": "ccd9975d-3a21-47e0-a7de-72aaf3535e99", "value": "T11FB41217B7F88473D9F9277018F716830B36BC958E3893176692A88E0CB26C4B57572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407755, "uuid": "ac1521db-1d9b-4bc2-82ca-7616f238da98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407755, "uuid": "ce5d0df8-d98d-4543-8b3f-daa79e443f38", "value": "12288:nMr9y904YoD6CqC9+D3wmrJCyWvhSSNwdh7fMTKgdcC:yyRY7RC9jyWvhSSq70TTcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690407755, "uuid": "52ebfbbb-3d64-42e6-959b-9bab8f90d9a0", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690407755, "uuid": "4fce26dd-5498-4fcc-bca6-def2f20f31cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690407755, "uuid": "356c1f42-cfc7-477e-9b7b-1a3c8d4c8b57", "value": "5b0a53db34e11d44de12484cb6883b78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffe7bd0-2bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690385385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385385, "uuid": "cd39c1d2-6f97-4bbd-b5d1-da690b7134ae", "comment": "Malware payload (Amadey)", "value": "a2798d955b5d70c910713eb5ad1f283e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385385, "uuid": "cb9ef041-5a54-467f-8901-759419996ee2", "comment": "Malware payload (Amadey)", "value": "f7b4f008a7bf3c66f8b8c95d13a0cd677cb0c2186cc3e1d5bfa105cc703bdf62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385385, "uuid": "eaa8dfd5-67ee-46d8-9879-5c25ede9dd47", "comment": "Malware payload (Amadey)", "value": "84f6ed5d43a70b44d62b5ea50a201efe6ebda156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690385385, "uuid": "fe3073a8-4db9-4075-903f-7de9a19ba43f", "comment": "Malware payload (Amadey)", "value": "f9d9aef1c2393b600df6eb9b55c7bc44426aa58c9a7633e796a8ce764773c5890ae8f9b7e26405a098507fcc9bde2020", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385385, "uuid": "02e02370-f682-4aeb-a9ff-7907f59f733d", "value": "T181840202E7E88533E9B5177068FA02C30D39BDA5AD7883673385684A0DB39D0E67577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385385, "uuid": "ef81d3e1-b40e-4427-a6a4-598a70545c8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385385, "uuid": "06f24ddd-bd7a-4dc5-b9eb-568818e416f6", "value": "6144:KHy+bnr+5p0yN90QEo/HYmYESorYxgE+glHMzbLirVmSzd5DzT5CcK:5Mrty90uHYmYERY+E++HcLoFPzTYcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690385385, "uuid": "b97b357d-692f-4ba4-a807-4737335af425", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690385385, "uuid": "13e3b7ed-5f64-4004-b1c7-7e7fcb43d912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690385385, "uuid": "96af06ad-4823-4adb-a5fd-6e4dfe145015", "value": "a2798d955b5d70c910713eb5ad1f283e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a98dad5-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356976, "uuid": "32dbce9e-8c19-4901-9874-28c075fa8fd1", "comment": "Malware payload (Amadey)", "value": "fd9c8a496f2c63d6cd91072aed35c366", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356976, "uuid": "e1e58426-5a4e-41a9-bc19-561c407cd933", "comment": "Malware payload (Amadey)", "value": "f805ff5d05c233ac0b27e172aca7df0efe5345e974a2fce1d64e0622d4b4d91d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356976, "uuid": "e7b65df0-d1c0-445a-a34f-d782031c05c3", "comment": "Malware payload (Amadey)", "value": "b8ba98b0f425e38c1243a62f80b2715d0f18a9f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356976, "uuid": "bc821b9a-2b16-49a0-a978-adc30b7dac76", "comment": "Malware payload (Amadey)", "value": "b72811b8a875136472ecd8ec058da9ab2a9d9c66cafd389b3ff9146a05399dc4b2460a2fbcd2a25a8227a560846d2c7d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356976, "uuid": "213b5313-da9c-4c81-a9bd-28428e565325", "value": "T1AAB40266ABE85033E8B927B05CF707C30F36BD20597883AB2788651E0D72AD465B5377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356976, "uuid": "d68dff4e-4691-4a84-a43c-9cf8b62019f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356976, "uuid": "83d40a8c-e90b-4d66-a07f-26a7f725816a", "value": "12288:YMrvy90oA4vjSelSL8abArNgwT+Qy7fxnKWS:Hyp2eML8XTeZnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356976, "uuid": "fa38cf87-5c8a-4d53-8943-87481089158a", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356976, "uuid": "ff3aa1b5-d1e6-4b0c-ab12-87544ad1a50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356976, "uuid": "932d582d-bf8c-4613-b58e-9b24626b02a3", "value": "fd9c8a496f2c63d6cd91072aed35c366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be445fcf-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408360, "uuid": "794f9ad2-dc8b-44cd-ae9d-ac2283dcd65d", "comment": "Malware payload (Amadey)", "value": "1b6ca4b3887874447697d2dac0664cf5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408360, "uuid": "1bfff2be-3463-4f3a-9428-0b13e4b1422d", "comment": "Malware payload (Amadey)", "value": "f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408360, "uuid": "81a1e276-c485-44d8-95cb-244fd4ca01d2", "comment": "Malware payload (Amadey)", "value": "0b2ef46a6bd9883b04ecaf8ae6fc47df13e2f8f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408360, "uuid": "77935592-8b70-4c97-a066-658064ccabbf", "comment": "Malware payload (Amadey)", "value": "95ae71040f000a24bee08088c692c0f772d71b7a78d0ad069cc4c1603eb3d1b01997d343bcd6219e5e7d4d7c18b830b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408360, "uuid": "a042171a-14a2-4620-9343-8f3ee3836748", "value": "T119B41213A7D58573E9B563B058FB02930A3AFCA54975566B2359AC8E0CB37C0B832737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408360, "uuid": "b99c5100-d77c-4cfd-977f-cde27a10cab5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408360, "uuid": "52d23fcc-1a61-43b8-b918-5d4184abaf35", "value": "12288:XMrfy90fa+YaQ3g3aNwmYu4neyzKmErzq93TU1cFdsJ:4y0a+YahqJYuGey2HAEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408360, "uuid": "b8e5539d-0cdb-4d9a-8ca4-3c2a49337740", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408360, "uuid": "48286b4f-90b0-4f13-bcd6-f2a511fd5e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408360, "uuid": "6d7c6f92-2ac9-4c0f-b048-0ec8d11a90b5", "value": "1b6ca4b3887874447697d2dac0664cf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3478adf-2b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690366278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366278, "uuid": "60bf8c3e-ae3e-457c-853a-c9c2dc1f6d42", "comment": "Malware payload (RedLineStealer)", "value": "94e2aec082ceac5c9dd2054ff7a017e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366278, "uuid": "e67ca20d-7da2-48e5-9129-56b50c000746", "comment": "Malware payload (RedLineStealer)", "value": "f8fa5fdda0be5a067cf7d58aaa494102580aa055c0e4bc636a7796281f97e9a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366278, "uuid": "e36c31a6-08b0-4547-b288-4e19ebe09b1d", "comment": "Malware payload (RedLineStealer)", "value": "5dbcb3c09e2428fd04fbb13245f1954e9e86cf76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690366278, "uuid": "e8acbea0-abdd-4440-a7a6-a1a9fc354b21", "comment": "Malware payload (RedLineStealer)", "value": "aced4f949794e429cd612db63f5e725588085ec2f38321403dc7201534d9fd7d74b5c944113edffb2828d61ec74c74d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366278, "uuid": "c3b44dc2-8821-4b6c-a271-5fe1bff5b997", "value": "T124840203B7E9C033E9B617B058F606830B3ABCA29D75936B1395599E0D727D4E43272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366278, "uuid": "e9c1712d-c505-4c9f-b9ed-b88bed5a411c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366278, "uuid": "7f9fb924-2702-482a-b800-72b23d41f664", "value": "12288:ZMrFy90bbuHJ3rUCSrWLAL6AlW+Vuptn:8y26J3YzWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690366278, "uuid": "714fc517-4555-42f7-abc1-c4796d863fd9", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690366278, "uuid": "653973d8-012f-4d50-b649-749aee6c4d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690366278, "uuid": "318bfe47-0184-410b-9fdc-71a0c5a0a823", "value": "94e2aec082ceac5c9dd2054ff7a017e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077d31eb-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690408054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408054, "uuid": "c2ef413f-f824-4634-8ba7-4d4628a35991", "comment": "Malware payload (RedLineStealer)", "value": "2de3042570f5c1958092fccd52196050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408054, "uuid": "d226a78b-30a8-4251-9192-9a044d322fce", "comment": "Malware payload (RedLineStealer)", "value": "f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408054, "uuid": "61b8a6c2-f788-4dc7-a4c4-88a773189453", "comment": "Malware payload (RedLineStealer)", "value": "825a3ed1c11fbbb29f78be5b760b7b2bd09b3608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408054, "uuid": "9611ae67-6caf-4abc-9c10-7c95834e597f", "comment": "Malware payload (RedLineStealer)", "value": "1cfdd5615e2fd4412c779ee00d5beeb4a37b44a675c1b072672d38b28d011b3b32284128efe28aadc41b9d81c69c87a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408054, "uuid": "7aeef135-3df1-4c85-92eb-de08e11db8de", "value": "T185840212A7DD8072D9B527B05CF606930B367DA19E78832B3759A91A0CB31E4E431B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408054, "uuid": "e670eb04-7ffb-45e2-a849-b656699ef212", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408054, "uuid": "c39e7d22-d709-41dd-b293-fd23670c5801", "value": "6144:Kvy+bnr+1p0yN90QELYTRHY6J0ZCPWEMjxFYWYUn3JSt2fgBZ+t4zDg7RJVrQ3N:BMr9y90I2CPzcnYCM2fgBYCzs7REN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408054, "uuid": "0094c7f3-87a8-4a92-9863-bfb28201f468", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408054, "uuid": "9d00c9ae-7df9-4c77-b4ec-b7d6f9833851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408054, "uuid": "1591ba9b-dbf2-48c9-9ebc-7c5f02d1f4c5", "value": "f943251c5b3ff162faabeb09676429800f82298b7971c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accb0393-2bb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690377407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377407, "uuid": "8b109cec-4486-436b-afa3-56beac930a4e", "comment": "Malware payload (njrat)", "value": "408e4be595b0ad3e1f4691f0e2a66b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377407, "uuid": "5c7ff610-cdf9-4882-bedb-29c7cf5c0c91", "comment": "Malware payload (njrat)", "value": "f965106a06794e80efd17253f3bc6a48cee2069c5b3a8c719d47b3ec2e7f772f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377407, "uuid": "ed477c28-eb40-40b3-ba1c-a2c8e405cae5", "comment": "Malware payload (njrat)", "value": "a0927ed3d95e137f24d5c1b01f44070925afc327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690377407, "uuid": "77ac71bd-9c26-4707-b73f-42fda56da947", "comment": "Malware payload (njrat)", "value": "c08e9898147e19aace2db9b0af7f60de794bf1520ea0ef807f4b47c2f40add14b92b61de3ae06b15d2c1f1b856fef1a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377407, "uuid": "4070d070-9586-447c-befd-cd4e789083da", "value": "T1DA033A4D7FE1816CC5FD067B05B2D012077AE04F6E23DA0E8EE564AA37636C58B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377407, "uuid": "82c24468-d560-450d-8e01-50c9c8beeaa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377407, "uuid": "528d2995-b000-472c-85f5-2e4539b193a1", "value": "384:FLFu/T8LgibBjpPu7w9qyMTO1P5RsW+D9rAF+rMRTyN/0L+EcoinblneHQM3epzV:6kNN9ZMTO13V+xrM+rMRa8NuEEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690377407, "uuid": "222a80e6-4668-4e25-bea9-db4779503b70", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690377407, "uuid": "24908376-849c-4a67-8722-21c24bd4c8d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690377407, "uuid": "07569f13-a0da-404e-bb75-d868960986e2", "value": "408e4be595b0ad3e1f4691f0e2a66b83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4ed9b7-2bd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690388335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388335, "uuid": "cf222e7e-84ba-42f0-91a4-2c7dd9a58008", "comment": "Malware payload (AgentTesla)", "value": "72001bce22646a1c43c8f5d2cd1778cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388335, "uuid": "7e6542d1-699f-43c4-bccb-a8c722c80ee5", "comment": "Malware payload (AgentTesla)", "value": "f965288f8e286199df63e46663fb0d547f1b833fa7f53d227c622807b0cb122f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388335, "uuid": "e39e764f-3f0b-45a2-975f-20317c094854", "comment": "Malware payload (AgentTesla)", "value": "b270256de279c12b6141647bd0618f11d6e72e2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690388335, "uuid": "45d15013-db90-49df-8de2-83fab9a4f8c7", "comment": "Malware payload (AgentTesla)", "value": "af3096b4428a51ad2999deac0264068a4eea032d89d594ff40e9017dabe3c30f2cce6556a3e0ed4ccf379e2d59e2d868", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388335, "uuid": "7558173e-6242-4307-8b2b-d4308fbae80a", "value": "T185D401975E69B110C469AB7735A10B0C076B0D6E7DE1E32B9D1E71F8CBB37C24642A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388335, "uuid": "d78d38e9-6372-4b61-990d-a694b3b4c69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388335, "uuid": "0cd1a1fb-c164-469b-830f-78845919c3d2", "value": "12288:FjOjzt9ooHjQ+ZPONBI1f+VdK69Ljm4DxgXo:+p97H06PONk2VdD9hD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690388335, "uuid": "66f5ccdc-13e8-4852-bd56-8f5392c07d1b", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690388335, "uuid": "0c6711e2-dd39-4a5e-a7df-a4f639baf357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690388335, "uuid": "e56d8a3e-17e6-4e51-a62f-83ac9e00b846", "value": "72001bce22646a1c43c8f5d2cd1778cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280154fa-2b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690357857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357857, "uuid": "4843a87d-b2e9-4293-a2ae-0e46dd34892d", "comment": "Malware payload (Amadey)", "value": "0bfbbad6cfb43407d054a2124a48a026", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357857, "uuid": "ac837688-a0f1-449a-b912-a3c403d42ed3", "comment": "Malware payload (Amadey)", "value": "f965cd84bae6daef2b84ca9ffd3e03231ff04f9151583e3d499a9052efae6079", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357857, "uuid": "9acb727d-40bf-4251-bae5-a9f59769cb81", "comment": "Malware payload (Amadey)", "value": "1e498d4b97f597cfea56c784a02683838d88006b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690357857, "uuid": "f4edb06d-6706-4ab1-ab7d-a678d3ed2642", "comment": "Malware payload (Amadey)", "value": "adb91f1ceb55e94a5960c0d81cfed4b3310657830e0b49a0aea55a692b4595e1753d7b2e4656dc8e236c6ce2115ccefb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357857, "uuid": "470ec85e-b175-4435-a7d3-94126a202138", "value": "T174F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357857, "uuid": "82056807-6f26-468c-be77-7e23370dfe05", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690357857, "uuid": "544f3044-0962-4d8d-aab7-13c3992bfb8d", "value": 34448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690357857, "uuid": "5b62ef1d-001a-496f-b307-422f5b147a02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690357857, "uuid": "42433483-b88e-458c-9a0f-386688761789", "value": "0bfbbad6cfb43407d054a2124a48a026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecfbfd6-2be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690398134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398134, "uuid": "68c71a9a-16a3-4528-9492-8ea94cfcd189", "comment": "Malware payload (Amadey)", "value": "020e4415aeef7ab6a112dbb7b477e919", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398134, "uuid": "7b962737-cb87-44a3-93ac-43a06c282851", "comment": "Malware payload (Amadey)", "value": "f9ca2a64d4681a298575931631629b611bfdb2d11cc171a4e4e206b96651fa08", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398134, "uuid": "d1ece2bf-bd2e-4c5b-bea6-cc35f2f55b4d", "comment": "Malware payload (Amadey)", "value": "ed98457d29dcfe6473c8c1d5079c95c28aff43a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690398134, "uuid": "4507664a-3d40-4ba3-a81c-48aa61ea9d6a", "comment": "Malware payload (Amadey)", "value": "2e5035fa5a552b32009b5f668fcea6732e7ba7300f092cd039e962d602023ce64e54a8836216ec98016b08869ea463de", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398134, "uuid": "0a4f923b-2820-4c8e-8351-173d468bfd3d", "value": "T114F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398134, "uuid": "97bbcb61-1831-422c-9b44-06ad773b4202", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690398134, "uuid": "5bf4b4b0-cdc4-41f3-8d14-4ff759c3caed", "value": 35959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690398134, "uuid": "ad67007d-4f3b-4698-95db-c4b4da43e6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690398134, "uuid": "18a770a1-5a84-4a72-825e-1c3561f22202", "value": "020e4415aeef7ab6a112dbb7b477e919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc380ba8-2b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690356066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356066, "uuid": "c9aa9d02-bfdc-4fb4-8e05-3f6c92a2e408", "comment": "Malware payload (Amadey)", "value": "22a54f0a53d7574eb128308265e34114", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356066, "uuid": "9d8a9bcb-6b70-4f81-a7a4-cf75367d21c8", "comment": "Malware payload (Amadey)", "value": "fa017259b4e4171a7478e5580e1af7ec7373aa8a554373077ee83fc2eed92d48", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356066, "uuid": "5a9162b1-d979-41ff-a37a-b5d45fe70d51", "comment": "Malware payload (Amadey)", "value": "aa7863fac657a3ea8aa5aab00570673efca87839", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356066, "uuid": "d8a56d92-8961-4e92-946c-98546ecaf7cd", "comment": "Malware payload (Amadey)", "value": "a699088bab2c740c2c6eee0c4145336ecd93baea5a39bcad6ee866117451bec2a8a68693824eb0b90497d5216f313470", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356066, "uuid": "6379ed60-67a7-4290-8e47-eb9347527743", "value": "T137840216F7D98432DDB95B7158F603C30A3ABC61997892AB2345A84E0CB37C4A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356066, "uuid": "f34a72e3-a5d7-4b3f-a5ca-38a7f6c2f017", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356066, "uuid": "e9c85072-b002-48d5-bf36-fbe6f9ff21d5", "value": "6144:KQy+bnr+wp0yN90QE+kcn2xCrKDCoUsENLl/EZOpqX38t4RpQmqg14C1cPJmW:UMrQy90ske2GKD3YLl/EQqXJp51o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356066, "uuid": "2e81dd5a-48fc-432f-9522-0559147c4c2e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356066, "uuid": "3dcd4970-51b1-4784-b7a2-9ff6345fab96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356066, "uuid": "82ba09cd-13d4-4d26-9e51-9aa06a1aef64", "value": "22a54f0a53d7574eb128308265e34114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1450ac-2bbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690380413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380413, "uuid": "bf8319c6-1fd5-4316-a1ae-f8cb20974ed8", "comment": "Malware payload (RedLineStealer)", "value": "5ed7643e177a74fc803f8b2ca8febbba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380413, "uuid": "9a483469-a4f3-4d1b-ac0b-fcf74f400fa8", "comment": "Malware payload (RedLineStealer)", "value": "fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380413, "uuid": "8322c20e-79d2-4fe4-9e80-e8d64a3cb4a7", "comment": "Malware payload (RedLineStealer)", "value": "2b8d2f5e2d3d1e302e941b0d3e47d9c91be060a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690380413, "uuid": "cdf0221c-a7ce-465a-bbfe-07dbaef51aef", "comment": "Malware payload (RedLineStealer)", "value": "597fec236676a7d8e58def916b246c6113a5a6a8a16c3b7424983c14109a6fc9636a0e992270b78aff858a500d070e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380413, "uuid": "407cd026-4a3f-4808-9912-e356ced8dbf2", "value": "T15E84F153E7EC9032D9B52B705CF601C30F36BCA19978836B2756699B0CB22D0A97172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380413, "uuid": "975cb6d5-7987-4344-ba29-4ebe9ecca093", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380413, "uuid": "e0b87116-121e-4e34-bf90-68435b69ee15", "value": "6144:KGy+bnr+4p0yN90QEMlBZAAZFvL4ja8Ofm2qSPyyR1aBm3QpsEK08KAN40:CMr4y90qXZ/4jOe2qSPFR1aux08KAC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690380413, "uuid": "c7a35824-0e14-4d22-9721-ff9f3abb936d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690380413, "uuid": "7e8ca969-0c12-43a0-9800-09af4e61ae87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690380413, "uuid": "8a291848-940f-42a0-83f9-24665d032608", "value": "fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ed8550-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690365613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365613, "uuid": "8ed1013f-8c8a-4ebc-99f7-9309c14e3f58", "comment": "Malware payload (RemcosRAT)", "value": "92c72cb1e229dc86a7e7b23345a008f7", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365613, "uuid": "ca9349e5-8af3-4701-9787-6fac5cff54ea", "comment": "Malware payload (RemcosRAT)", "value": "fa47322fc79b2d7737cde0c03490248f5be8d760b8fba9a747cc3b999adadb92", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365613, "uuid": "e68230d8-78a0-4669-ab2a-8f7d7ff2208d", "comment": "Malware payload (RemcosRAT)", "value": "2e8c6dfc3321833df7da3540142d0bb8dac21468", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365613, "uuid": "5686d758-2ec4-45c6-8a8c-d4f9984079e8", "comment": "Malware payload (RemcosRAT)", "value": "6fa56470118d00cfe09a1830faa3a25a05e5a183b085c1fe6c3b23951bb6bd701294e0163523ee211ffcf03a7c112e26", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365613, "uuid": "8fddae0b-cd7e-43c4-a072-94d7ef9901c9", "value": "T1C47270558D92153479177FAFE4828134D7740DAE622040A96BDFF2BC193630BBAFBD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365613, "uuid": "2857f833-0610-446c-aa6a-907f5a61d734", "value": "384:jJHKNvSsyShBhTKe/ZPIKdf8LP0eBCN4ebDQ3a:la6FGP7cP0eBlX3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365613, "uuid": "ceab2698-7b4e-41f1-8949-76b2cbb74b84", "value": 16766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365613, "uuid": "3cb8050f-dfa7-44d4-866d-357cc2f63871", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365613, "uuid": "e6fa3269-3b01-4ccd-8980-79ae073644db", "value": "Proforma_Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d068cd-2b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690351136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351136, "uuid": "08770f73-a5e5-4f5c-a462-b440257d0cf3", "comment": "Malware payload (AgentTesla)", "value": "f6d03b23a1cd4b0ce42ebf591b85a514", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351136, "uuid": "3e9daee6-bebb-444c-91c9-fb84756a8f64", "comment": "Malware payload (AgentTesla)", "value": "fa77fd0bc332cc52417da2001bbfee518d2d6cb6c363d15e67d1417afe784325", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351136, "uuid": "a137d0f9-0583-4b99-969b-d009303dc01d", "comment": "Malware payload (AgentTesla)", "value": "30906b2343ce4c5f51abecf743171ce96ad399a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690351136, "uuid": "426463df-722c-4293-a8cd-93698b54cbec", "comment": "Malware payload (AgentTesla)", "value": "9e8432d32d5e60f6202315e1a7d46a218875d9ff89c899fe562be95c58696cb35338209fba1864d4f6fa9582d7a47b9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351136, "uuid": "be475317-17d6-4a61-96be-213f7c4707d6", "value": "T18944120636E8E547C46350701F29470BAAFABD0756E98B1747352A4D7FB2372C70EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351136, "uuid": "8c6dc79f-b81e-4911-90ba-765aa9db7900", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351136, "uuid": "67973be4-20a0-4053-ba57-574811a9322d", "value": "6144:/Ya6SXvPueKovTHX8FGR5lSfrNOdWghqLm0tN:/YcXvmDuTMFM5lSVghqLFtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690351136, "uuid": "ab4ddafa-0fb4-40ad-90c9-e0299463e364", "value": 272798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690351136, "uuid": "779f4fc1-e76e-4c3b-8464-eb39f345e758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690351136, "uuid": "b157cb11-966c-4669-86fa-12b46c3ef2ed", "value": "ENQUIRY - PR-009583POWER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4a14fa-2bcd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690387365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387365, "uuid": "2dcd4297-3cfd-4b78-a758-2d0548d37586", "comment": "Malware payload (AgentTesla)", "value": "2fce3ea03605f3a2e006b93f0b6c2af0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387365, "uuid": "a622fd7a-c798-4d12-bad5-3ebc59e9ad20", "comment": "Malware payload (AgentTesla)", "value": "fa882068acfc15aaea82a925df6e6bf21a2c24c114f7f382cf524431690c4b0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387365, "uuid": "c05b93ae-ed32-47e5-97e8-03cc7f1e547c", "comment": "Malware payload (AgentTesla)", "value": "d75ef5712a5534f88acd745f7487006493b048e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690387365, "uuid": "c9ab818f-2102-4926-96c2-0bac0f67627e", "comment": "Malware payload (AgentTesla)", "value": "7b1036b3b0326a6950318a4d139992c038afddc171fdd0069af98a3c23d3e201ec87e997d7fa9162b5fafd88792c843b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387365, "uuid": "7d7cf08c-d4f2-401f-8493-a0da567dd57c", "value": "T1DDD41204B3EDBF6BD83AA7F00515145053F0DA536813E34A0EC265EBEAA6F154BB0E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387365, "uuid": "42b9383e-9fe2-4905-a450-32cb43db585d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387365, "uuid": "0dc1438d-69f5-4305-8fb8-6fe7a052eaa8", "value": "12288:aJmefaynh+9ahVe4CDhrMsRJPk6UsPnaOHhn:7eCQ+9+VeL1rMszpnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690387365, "uuid": "c77d2e81-2f07-4eef-bef7-a969e2ed85a4", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690387365, "uuid": "c47a6278-07b2-44b2-8f7c-cb2d0d00c806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690387365, "uuid": "555ce978-7a1d-469c-b414-df2410587ee5", "value": "COTIZACI\u00d3N_202307_2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f979e0-2b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356651, "uuid": "6b1b5753-ec29-4b85-8b9d-9b56b1f90854", "comment": "Malware payload (RedLineStealer)", "value": "0bc32c2bc1310163413c784cb59f352b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356651, "uuid": "b3268224-065a-44f4-a4a8-761324a04e6b", "comment": "Malware payload (RedLineStealer)", "value": "faa2daf2db5f5ba0927b64b5313347194e3ba0cf6dbb25ec408f4f5ab3a2d481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356651, "uuid": "c32a7a98-15e5-442d-81ee-21aff8e01f15", "comment": "Malware payload (RedLineStealer)", "value": "edb91869725fb2e7eeb2d6fa54932ea32fd19e2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356651, "uuid": "4380d95f-91e2-4c79-9091-6b68b35e0a88", "comment": "Malware payload (RedLineStealer)", "value": "54211b69f8b2c49079daf51ff99102c000387094efa279a0dbeb4fc4eb98063e1c618b9ab280cbf8aec4bf313a1ea4a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356651, "uuid": "088b60dc-29f3-4e0b-af9c-928bae70c425", "value": "T18C840203B6E98432DAB567B018F713930F3ABDA1AD34876F3785685A1CB35D4A43172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356651, "uuid": "ffcc2f5a-9ea8-497e-81e3-5e54a13bc73e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356651, "uuid": "d836da94-45bd-434e-b4d1-bb0ac23d0f6b", "value": "6144:KEy+bnr+ap0yN90QEfS0a7RHY62DCbkpp5tcU/2UZ3OmhLgBZ+t4yDEZLaIgN:EMrGy90VS00E75l2UZ3OmhgBYCy6a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356651, "uuid": "8a672a7a-dca0-46c0-a0f4-2ef5c23ad028", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356651, "uuid": "0546c1a1-cc77-47d0-9ddb-00fa9c31febd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356651, "uuid": "a13b25a3-90aa-450c-8013-22f052f3b365", "value": "0bc32c2bc1310163413c784cb59f352b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8f8766-2b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690365572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365572, "uuid": "c353f558-0fcb-48be-bfe0-2a0d8ae71557", "comment": "Malware payload (AgentTesla)", "value": "ea026d4a71a01d8e24216877150d58ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365572, "uuid": "20d838fe-3822-42ef-a7bd-556e2d9684d8", "comment": "Malware payload (AgentTesla)", "value": "fadfdea12797d2dd31cb11f28d33413d315ec40884caaa915f26b63b312e098f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365572, "uuid": "2168e231-3743-496f-8a0b-e0a9722245b9", "comment": "Malware payload (AgentTesla)", "value": "1ef3cda7b83edb8df6a2b5a2f42ff40f01136e9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365572, "uuid": "b84d9922-e19d-4bfc-a647-f87da9a04bc6", "comment": "Malware payload (AgentTesla)", "value": "0cf7b388c624a448c6f4108e14a66be4a540fb4f304d64bdade50e9aa108e5fbb1d3fce10764efb5ae18ec262b58b107", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365572, "uuid": "b4c9c3a7-140b-44f6-ae44-87ca2cca150c", "value": "T157D41210B3BDAF96D039ABF10516965417F0C977892BE3194F82B1FB8A22F110B71E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365572, "uuid": "a1c6cacd-587b-4f8f-9057-e585f83f711c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365572, "uuid": "55d954e1-b995-4366-acec-f4ebfecefa4a", "value": "12288:rJmefaynh7aBBKx5532Yx86kvQo99+Bp+VxHSFIr2YJAQI+0+:seCQ7aBBK5GYx5kvQoD+BpAHSFIr2YJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365572, "uuid": "a5572cdd-2335-4ba8-a762-52612fc7e30d", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365572, "uuid": "5acdb3ae-6b72-423e-8173-914046b5a8e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365572, "uuid": "7633f71e-00bc-4218-a912-db442d0dcbc3", "value": "\u00f6demeyi Onayla_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d87a29-2b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690365106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365106, "uuid": "2130ab1d-832d-4ad9-af62-d47bbbe4e59f", "comment": "Malware payload (Mirai)", "value": "d63052eedc6c21cdbbaa73bc098f6b35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365106, "uuid": "b41e42a3-e669-4a20-9ef9-9569a40243d4", "comment": "Malware payload (Mirai)", "value": "fb04a065a94c9097e6398261b86fbb049fa460cdf4959ab079dd3206a936f26b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365106, "uuid": "5e126c92-f626-4667-adae-f2197103fb63", "comment": "Malware payload (Mirai)", "value": "be96e50d943b1da1d702bd2a0c2a8324908f23cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690365106, "uuid": "de5e3517-b1c7-4ac1-9b53-d2d9b1ad723e", "comment": "Malware payload (Mirai)", "value": "0f61e889b7fb7f4b86af226d5d51178f44c9b3b2a72d290a6f6bcafeb1255a819143cfa0b18083ae924a754e9be54cc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365106, "uuid": "b7c7031e-a137-4498-b907-e72c0ec22faf", "value": "T105A2E11572A32D66F3ED1C3DC96E8317F9671BFC90F6327669415620C90D20A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365106, "uuid": "30b5b8b1-54a6-43f5-b7ef-bc00014aad38", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjewhymdGUop5he:TvQn4j+ZO5fKAlxiws3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690365106, "uuid": "0fc77be3-b6ed-40f7-bc69-bd12936b3c80", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690365106, "uuid": "cd9caa9f-6313-41e4-ae0c-5a15ef2eea46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690365106, "uuid": "55fd8607-0c2b-4e41-a3f1-45c81f936c91", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f40733-2bc7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690384528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384528, "uuid": "2cb1de53-a9c3-4e4a-bf23-cc1512c1fafb", "comment": "Malware payload (IcedID)", "value": "c75af3a0676a5849098232dd5e1fc9b7", "object_relation": "md5", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384528, "uuid": "11dbd2dd-3c10-430b-b36b-fd779b38079a", "comment": "Malware payload (IcedID)", "value": "fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703", "object_relation": "sha256", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384528, "uuid": "e2ced190-eae8-4d4a-8aaf-892defe9f9c7", "comment": "Malware payload (IcedID)", "value": "ffaa8079e219cb1bc37f331ba250b4630aec8d9c", "object_relation": "sha1", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690384528, "uuid": "c06b0ab4-534c-4bf8-bcc6-e1fb639db571", "comment": "Malware payload (IcedID)", "value": "2339be56275865b22a0fe1d3a47e2da8883a8a7996466e427fb018f42682f0d48376e0576c4846ffcd5c82a3798b5513", "object_relation": "sha3-384", "Tag": [ { "name": "3297324279", "colour": "#EA09D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384528, "uuid": "c98a9571-a985-41ff-a750-ed602c1e3b40", "value": "T196A4F18AD2310AF3DD76C53FD8E14046D6713C87AA11DA1F226842297FB31B14FABB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384528, "uuid": "6ff73375-d090-454a-bb5a-14b3ba63b1f2", "value": "122ad25046a6ae342251fe184815d102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384528, "uuid": "55a40a6e-71b3-4323-a604-3c6c3278beef", "value": "12288:A4C1uGMdmiY1M4IhevqeEbwSPeh4Yjkp9EPWoiZMshpG:A4C8GMEvohcUIvKGPWoRYpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690384528, "uuid": "9ac26e01-ce23-4d1c-8daf-9e2448297a49", "value": 477360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690384528, "uuid": "ad486ef0-a3b6-4095-a449-2792dfd11b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690384528, "uuid": "f0db3663-25b3-4b88-b150-d04806ee906e", "value": "Scan_Doc_07-26(214).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4dd011-2bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690379207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379207, "uuid": "b83315c1-e23e-449e-a8ae-b462631d82f7", "comment": "Malware payload (Amadey)", "value": "7f7259536faba88247841cf1adf8332b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379207, "uuid": "836b3b4b-ad2e-44f6-b8d0-37bd61fc9079", "comment": "Malware payload (Amadey)", "value": "fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379207, "uuid": "998eccf2-ced2-4168-bb68-23b9cef2075e", "comment": "Malware payload (Amadey)", "value": "d5dead80e018787370e99753e2af59c8ed7fa887", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690379207, "uuid": "c929f41d-376a-4563-a043-46ae4f64791e", "comment": "Malware payload (Amadey)", "value": "6fb8aa457ded11774d044da85688d85455c15050b1b56464a673602bd8676eb0742c822b1c50f4b5842329f544b0888e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379207, "uuid": "a605b8f8-9680-4134-a89d-467096e59fb2", "value": "T1F584F102B7D88073ECF01BB088FA12C71A35BCA5A978C36B6745691E1D726D4A936377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379207, "uuid": "74918fd0-991e-4363-9c5d-2f93059d0563", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379207, "uuid": "eb9484e9-bd71-4d2c-a979-cbe6df204383", "value": "12288:nMrUy90VMtGfE/7XH8MxeCVcEEKzVy6a3mB:DyTtGszXHLbmEEqVy6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690379207, "uuid": "8d8e9418-3e0b-4087-85ec-0843b034de3e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690379207, "uuid": "805a3d85-08cb-4a87-ae4c-a1a311991ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690379207, "uuid": "6ba5bc25-904a-4e46-9ce4-9cdd381ee2d0", "value": "7f7259536faba88247841cf1adf8332b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3250be60-2b93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LgoogLoader)", "timestamp": 1690362169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362169, "uuid": "4ae711b4-c4d9-4c6d-ac3c-ff32d53e198f", "comment": "Malware payload (LgoogLoader)", "value": "651230dae2c0dc316d24bcf5d999c001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362169, "uuid": "1b963151-3bd2-4cd2-b7da-622dba8200b1", "comment": "Malware payload (LgoogLoader)", "value": "fb5e26fb2c6209e4ec7ff82659fbdb03e68fe1adf088166cea4dc479af5ba151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362169, "uuid": "474c6c60-8774-453a-ba6c-47022b1500af", "comment": "Malware payload (LgoogLoader)", "value": "7e76383fa315e43e54e1f25ae4d72d550e208127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690362169, "uuid": "fe24baf2-d67a-4a84-9b1e-c7ce2551ae47", "comment": "Malware payload (LgoogLoader)", "value": "296828f5cd56bf67b7909bed64cbb6a0c412f0e0ef45d3f5222db7b4518d00c48a9a0c7618e5aef52515b93b770fec68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362169, "uuid": "0c6a7105-741e-4c65-99c6-17bdc372b4e8", "value": "T1DBC4120A5F482B44C8EE86B7741DB3CCEE213BA758D3DDB49AF13C9B707721646A1069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362169, "uuid": "acbead8e-8b27-4e8e-a61a-188a5ff557d9", "value": "12288:41CCeUe/mB0Km1Tqy/y7R2upCFmg58ROh9YG2m7PHY:47eHmB0Km1Jy7RF8yRS9z2g/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690362169, "uuid": "4e4e7892-5fcd-4481-a529-d5bfafe3476e", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690362169, "uuid": "0e7e701c-5f5c-4e4e-a3d2-a4697a1c10bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690362169, "uuid": "ea255893-db21-474b-aa81-8174bdc7018b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba95ff3-2ba5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690370184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370184, "uuid": "64e29bf5-781c-43ca-a1ab-701b5226cef6", "comment": "Malware payload (Amadey)", "value": "3a7863e0c5945e125252c52e2169bf7f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370184, "uuid": "a3a55716-4f5c-4600-bf87-2e8b652042db", "comment": "Malware payload (Amadey)", "value": "fc77d8044108a80e72c0252e627d016aebe0924ebed059fb5f984d6b47ee39fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370184, "uuid": "1deeb220-f64d-4bb3-b3db-cfbf0a8da673", "comment": "Malware payload (Amadey)", "value": "e15ce6192a92330c89edeacde5028cd151aa925a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690370184, "uuid": "26d449b4-b81d-4be1-b609-4181463b60bb", "comment": "Malware payload (Amadey)", "value": "9d76239ee7d0a7d244d9f791df5218cf8a4d08f590dea8dc0b673d20928c915e38e95331272a7d9dbe8ae807c3fa8a83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370184, "uuid": "9c3dc5ee-eeaf-4c53-954b-97cbb56f4a8c", "value": "T1F7840142B3D880B2D8B527B018F617931B367C626D79839F2785AD1E5CB32D4E47272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370184, "uuid": "e10e532c-a3c1-46a9-b29c-5a711058697f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370184, "uuid": "630009a1-316e-4770-af10-ba36b4ba568e", "value": "12288:pMr3y902gvhFQpY8D2agBYCXFfekq5sh:2yojt8gz1mkth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690370184, "uuid": "2c600161-629c-4733-829c-9aabaab7805b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690370184, "uuid": "f5b08a57-343c-4b76-a354-19b47515b336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690370184, "uuid": "87941c2f-917f-4763-a939-9261afafe2e4", "value": "fc77d8044108a80e72c0252e627d016aebe0924ebed05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0a64a4-2bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690408061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408061, "uuid": "85b1ffaf-8bcf-468f-9958-eb11d5f2eefd", "comment": "Malware payload (Amadey)", "value": "bd7970c047c1c32c21e5344ac4e16fc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408061, "uuid": "40be5a91-ff0e-4cac-9820-f64f7ebecbc5", "comment": "Malware payload (Amadey)", "value": "fc9113ff391a9567116360e2f33d5c4490221577133a29c648fbb8f6629a3921", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408061, "uuid": "6f2490b4-61a6-4ee9-9de1-3cef745b5609", "comment": "Malware payload (Amadey)", "value": "3c92af4a4d6f27fe19a5d5179c358b82cb02afc2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690408061, "uuid": "ac7129d4-bb7a-45da-aa6d-e3519eacd78f", "comment": "Malware payload (Amadey)", "value": "6d3a5a45b256a339c0a226ea9687a7a888c717e1e213c0c00e79cf59916ba936c576136d47c8dd88031c7969e924a8c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408061, "uuid": "b23e6c62-5abc-43d9-a42d-54b6ec647da7", "value": "T1B9840103A6E98072D8B517706DFA46970B32BCA29D78476F2389AD5A4C731C0A57273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408061, "uuid": "1e6190f7-45b0-470d-bfce-463ef1021dec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408061, "uuid": "e562b6ed-4296-4367-8f22-cb75692fa9a7", "value": "6144:Kvy+bnr+yp0yN90QEDco8EwBSeBKT2tawPruuFmlubVWPgBZ+t45DjnLtT+Af:VMrGy90eDtSeKT2rDuuFF2gBYC5Dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690408061, "uuid": "0dd958c8-a428-4402-9438-56a68f74151e", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690408061, "uuid": "13c00c7e-c2b2-4015-aea3-1bdaa6a9989b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690408061, "uuid": "97f1b071-6c18-4f8e-8716-f5a3d46b21b6", "value": "bd7970c047c1c32c21e5344ac4e16fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035e36e1-2b4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690332026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690332026, "uuid": "81ae0bba-268d-4b59-b1bc-97aeb40eefae", "comment": "Malware payload (njrat)", "value": "258f29faaebd69fb1a24d139b86bf8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690332026, "uuid": "a34b1d4b-b3ab-458f-9443-95dace99c7e4", "comment": "Malware payload (njrat)", "value": "fcd18d1ef37a0aa43b1ab1ba9f52f16bfa6d2e5d640c365496b4e8545c67d4b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690332026, "uuid": "9479177a-1fb2-4006-862e-54e7d8ec7b64", "comment": "Malware payload (njrat)", "value": "7283e756c95dde4b0ac7c982b3405ef57f619269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690332026, "uuid": "a4d33a86-d966-4748-a5dc-a537f8562073", "comment": "Malware payload (njrat)", "value": "2538e81ce8330c6883886f72c90cd1c442a9e4ca5eef6a6a47604c9247e27b7d6dd0173cfcaed027bf477939407fe101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690332026, "uuid": "c4dd180e-0bee-4fff-b94f-6a8f897b7e86", "value": "T1B783021202ACC537D9EB4F376AE775A2332046923A23939E60DB406ACDD951E84757FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690332026, "uuid": "0639e026-cf00-4f22-a70f-6316f593f9e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690332026, "uuid": "06e000ed-cbe1-4cc2-96b9-1c6711a4cde3", "value": "1536:DK2PiT7qOFcqi8YkZ+GYXyEdmGjqpcCDNH1rACrBqk4uqvfCAUBI:eoiHqOFct8YkYXEoqpcQVr5r9afCfBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690332026, "uuid": "da6287e0-b5ee-4e97-8935-9766aa327d2c", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690332026, "uuid": "93d526d5-798a-4145-9721-e57701daa7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690332026, "uuid": "233f55fb-e681-45ca-aaab-339496730214", "value": "258f29faaebd69fb1a24d139b86bf8f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d48a2c7-2bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690382938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382938, "uuid": "4d84b484-2425-429e-8143-7bc58138721c", "comment": "Malware payload (GuLoader)", "value": "62224343e692daf39da2047e1386ef34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382938, "uuid": "0c6245ae-c422-4c7a-ad35-2096c484bd48", "comment": "Malware payload (GuLoader)", "value": "fd8041671d2c1c0fbd0a5150cbe98a4cde0c437efb56c6b5a0d90f279a38d811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382938, "uuid": "1879cbd1-fe14-4f44-8112-e465975569eb", "comment": "Malware payload (GuLoader)", "value": "36a43d564b313bdf3edfa22b8405188491accc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690382938, "uuid": "7e97a79f-99bd-4504-8da0-af9a36e442c7", "comment": "Malware payload (GuLoader)", "value": "c87335cbfab389f57c00e025e2899c7dc8c95ae0e04af3dc46c76c748c5740e093be6088c4989826c0acf35d70e6f4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382938, "uuid": "c62a7163-9c0a-46c3-9ed0-634aea327749", "value": "T1B4059E772AC0C7EACFB1BDB2792B48787B666E7B51545457338033C90BF65A39832602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382938, "uuid": "046a45b0-bf9e-42d3-b45d-7c92a54e1e3f", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382938, "uuid": "97e1e7a4-dc5e-47ee-8c3c-f92e5afc6b69", "value": "12288:dIkdkz6kw3kfkVxkUxkekKkpkRqkwk+kTkZkJkDkqkzkAkkYkk/ck7kAkkPkkjku:dg3MRT3FSf4hAtjaTw0mYgjl1tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690382938, "uuid": "9a18d93d-603f-4b8c-9e54-3d502f2e55eb", "value": 834640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690382938, "uuid": "502039ba-7608-4ae5-bc6b-3769933c4a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690382938, "uuid": "3730f729-6f19-4e73-81f2-28c9e9c33512", "value": "copia de la transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfa9ea0-2b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690356955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356955, "uuid": "c945b010-e2a0-4b89-89d8-f97c2b704fba", "comment": "Malware payload (RedLineStealer)", "value": "f490405742809d488ed08e4843adf6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356955, "uuid": "ef961ebf-1594-4b30-a800-a4e9a2e8af3c", "comment": "Malware payload (RedLineStealer)", "value": "fdaee76eed58dad40a8a28f02ccf4708c1beaeafb8611eedbdbdef475e4d879c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356955, "uuid": "cb57e6b8-beaa-4fc6-94b3-9abe85433092", "comment": "Malware payload (RedLineStealer)", "value": "243f251acbaccc9513c9760e375b85e35c61bece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690356955, "uuid": "6423a1fd-6d07-4c4b-887c-e16fcfe9c5cf", "comment": "Malware payload (RedLineStealer)", "value": "294030be3f2c4a764ad44ab30ecc8e78bed26fb073a797322deaac2bb4f4d4f795db654e58bcf3d080e2235de74f3ef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356955, "uuid": "a9440761-691c-43c9-8c08-e351d701cde3", "value": "T194B41216E6EC5833C8F66BB45CF742830A377C919978866F36866C570DB2AC4A53133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356955, "uuid": "18d5c7cd-4e82-4f1e-a752-5abcd2864b4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356955, "uuid": "8017ddfa-dea1-49a7-8c5d-66f4cff3616c", "value": "12288:WMrBy90ayNdjGp2x0M26AZf4IVRIVaUUpjcSh6SYyjfpKa6zH:Py830H5qaV96qpKa6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690356955, "uuid": "be2e609f-5275-4402-8ed3-38aefb8c6f40", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690356955, "uuid": "ed743c8e-f170-4b14-9c6c-b9541aa15482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690356955, "uuid": "23f53a7e-f4cd-46ec-b0f7-2b405aeab76a", "value": "f490405742809d488ed08e4843adf6d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c891ff-2b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690350720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350720, "uuid": "594a3561-5573-47e2-a3d0-4c5f6618c15f", "comment": "Malware payload (AgentTesla)", "value": "9e6b7def31645b36fad56f1ef8957e66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350720, "uuid": "27ad70e6-0a36-4880-968e-4a11043be798", "comment": "Malware payload (AgentTesla)", "value": "fe2a3fcda27624034be9b8a93b5644f866b117dde2f253c45999072bcd1da74c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350720, "uuid": "41f75739-6369-47f0-ac8e-576a9d6c73d6", "comment": "Malware payload (AgentTesla)", "value": "163ac63d23b61a44d362d29562e24afbed5577cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690350720, "uuid": "504b31a9-3000-4cf9-8235-7ca8c22c6ed3", "comment": "Malware payload (AgentTesla)", "value": "e117bdd2a82e89b1a62f77492b90298602bf782040de4c1a4bbdb08fe3fe395a00bf51368d6d33af4865e3e8df324dbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350720, "uuid": "0710ee07-715e-48c8-b34b-ed93f2b5b8ae", "value": "T12205C25B71DE4177FE551EA01C2A4A28CFFEB01D600EB50A7C25CE8A1E7DA4CC1AA746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350720, "uuid": "7f941c2a-74c9-4f67-aba5-760642e0f052", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350720, "uuid": "eabd1108-2b24-4b3f-845f-0f535479d0e6", "value": "6144:GaNxKZdoeU8OnFiKPBbpTo8g6fj6KZdoeU8OnFiKPBbpTo8g6fjXtsOlL3N3aZRZ:GaXrarXtBdNqPuYxeh8E8recUt1Tuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690350720, "uuid": "39d744cd-b673-4829-88ff-966bbe5382a7", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690350720, "uuid": "de78b433-56c8-4431-b2a5-f0440d0fe002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690350720, "uuid": "f0a1f779-965a-42ed-a522-e4778e921415", "value": "order#2_970351841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeece24-2bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690381243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381243, "uuid": "999020ce-b9d8-454d-a0eb-cb5d2b75d06b", "comment": "Malware payload", "value": "0582dec8998b61f35e1c7d3e5a3c704f", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381243, "uuid": "fb2ae9f4-d401-4069-8841-e310f70a68bf", "comment": "Malware payload", "value": "fe32b7005d14b2d0fdabc348b1b87c1500a90976b69adaf1951c2e19d13b141c", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381243, "uuid": "01974654-4bf1-415c-90b4-8d6eb350fb35", "comment": "Malware payload", "value": "b7da0fbd73ed838fddbc9f4e39ba30be2c341c71", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690381243, "uuid": "9cca87cd-8049-449b-b90d-9dc89b35f9e7", "comment": "Malware payload", "value": "85554b32b85443f9334689b5ed48e8c5feed463d370c2ce18f1955ba9c4ae4baadbbf83b273e7da093fedbae8eb6f725", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381243, "uuid": "ec97e193-a1cf-40ea-b00d-cda9557e1cb1", "value": "T1BFF44DF476D07BD70FB5290DB7CE41B23D54B457F0EEAD8626890D1E92802988DFADA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381243, "uuid": "1fd0dda6-464b-48ec-b13a-94540b7854a6", "value": "12288:oeIBBy1hWVBKlwh8TOT46vsz9arWnqujyaSxU8Wk3fvr5/wa7UnHUfNdar:qjy1uKuhPT4Osz4rWnqYyTxUktwa7UnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690381243, "uuid": "70f3ffef-0225-435c-bf5c-d57f2fbbb6a2", "value": 764604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690381243, "uuid": "5ba3e6e7-c1d9-452a-90d6-8d5fe22e07a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690381243, "uuid": "f6be63cf-e558-44e1-9549-34e775b2f18d", "value": "rdbxzerynxldupbjmpgjuyixpglsiqzkanszrbbgawoiorxnru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ee7267-2baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690372287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372287, "uuid": "c17b70f1-c059-41e4-afff-eeb515b332e8", "comment": "Malware payload (RedLineStealer)", "value": "73efed144d45b69abe4b87996da8ff29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372287, "uuid": "dc655ce7-ac0a-441d-91ce-e369dfe05bd8", "comment": "Malware payload (RedLineStealer)", "value": "fead40fdf7ea4c8a6bd5db6e92856bd9707402fdf94dca4b9094f199c9349746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372287, "uuid": "8307e854-f752-4b17-bf10-c654d99b2eb5", "comment": "Malware payload (RedLineStealer)", "value": "71e78d852f3936b44ad82ca19243b9253cd9237b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690372287, "uuid": "b8c53558-41b8-4c70-a823-1f386fbb6dbc", "comment": "Malware payload (RedLineStealer)", "value": "2c467f93d4c6740b3e647520103c54155da74631ce8c33879c0f36a575e7d42d2ab074f35807e74d1c2843425704c3c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372287, "uuid": "4cf0c7f2-0a46-4999-810a-5930cb074c01", "value": "T19884F143EBE95032D9795BB054F313D30B36BDB9997893A72382A91E0DB36C4A471327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372287, "uuid": "676ed0b5-4568-48d3-ad29-76beb12345a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372287, "uuid": "f613f102-0fbc-41e8-a4de-baff63aaa9b4", "value": "6144:K5y+bnr+Yp0yN90QEFKSiYNmy0uzU99B4LkK+w83qC7nknzDm030Fw94e8S1tI:LMrgy90XbvNmyTVL+w833Iz9AM4NKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690372287, "uuid": "ee216bab-1cc0-4a61-afa5-7a9b5c4dc27f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690372287, "uuid": "44c88f23-751d-4b9a-87ab-8e59631e9ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690372287, "uuid": "9a4fb21d-5eb9-4cbf-b8cb-4a16cc4633d3", "value": "73efed144d45b69abe4b87996da8ff29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556af38b-2b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690360510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360510, "uuid": "6c789f60-b013-4db1-ba43-b6cd1dcf1fa6", "comment": "Malware payload (RedLineStealer)", "value": "a8c3cc9218f89cab64fd1c26561f7b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360510, "uuid": "c17ea66f-e613-40f1-8c2d-0c7b861e4594", "comment": "Malware payload (RedLineStealer)", "value": "febd6964bdd7f4d619fa5b9fa4cab9664544370704d3cf04976eb8c520825c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360510, "uuid": "e43e373a-82fd-4c0b-b657-784a7e4b2e24", "comment": "Malware payload (RedLineStealer)", "value": "97f81a7aaeccfa05f089277be5da9bdf24365095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690360510, "uuid": "7daa4be8-da9f-41cf-b701-16422e7b5f59", "comment": "Malware payload (RedLineStealer)", "value": "89220588d751745aceab755c0934141435e57dab153aae3200558518e86bf8e71b6c9846c8c65d5824ee1ac138348114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360510, "uuid": "6504ef0c-b9d5-40fe-b013-92f5c9776c09", "value": "T171A4088383E1BD44E9258B729E2FC6E8760DF6508E4D7B66B128BE1F14BD1B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360510, "uuid": "02b25e65-095d-4181-af25-98e851972af0", "value": "44d39cb42f1ecc0351f10c8bc772392a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360510, "uuid": "166e9017-1947-48ca-8ded-64e48979c0bc", "value": "6144:jEOUJLQ3M/WDsyalkCxONK5uPbEGn0ASXMPZljv+HTs:dUJU35DRaYPoz3Oljmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690360510, "uuid": "0a47b9a5-254f-4728-848e-900a2170bd2c", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690360510, "uuid": "1c8e5878-ae1c-4845-9add-d8b74ea40304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690360510, "uuid": "f13c70da-1ff0-48ed-9c3f-d1d3f0b8acff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fb5d37-2b95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690363273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363273, "uuid": "f6288072-a7c2-4732-8399-8658f0654e06", "comment": "Malware payload (Amadey)", "value": "c8e7f0c634eef3a787df3671baf49a52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363273, "uuid": "c63eaa5d-60a9-409e-9509-94690d2b9e95", "comment": "Malware payload (Amadey)", "value": "ffcf0a615ed97ce1541ab83b48af4525ca01158e13b869841c9b0d6598b71e2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363273, "uuid": "860d5e07-c3e1-4c21-8afc-9a3cd56d6a11", "comment": "Malware payload (Amadey)", "value": "e49bd80225e53537422b2a4000f7db3576eb0e31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690363273, "uuid": "d4dd6c15-11f5-4b25-8dc8-4f24a812fa9f", "comment": "Malware payload (Amadey)", "value": "5994b5e07280774f81cb87adba183a39a97cf7197ba602404aaf5dc14216a63979580f3da03ce381ccba074ba152d840", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363273, "uuid": "919d8b2c-3aa9-4779-9a33-d99ca68b3c2d", "value": "T10A840213B6E9C032E8B127B024F717931B7ABC91DD7882AB2754A94F0D726C4A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363273, "uuid": "bd682a32-084d-45e8-8562-6cf34caabeee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363273, "uuid": "35facca5-82ea-438b-8cc7-7e0fbb5aae3a", "value": "6144:KMy+bnr+gp0yN90QE0o/VjvkWnjZNmKHwtkU2nhX8Eu49tcDrt72S/BCrO6M:0Mrgy90tFNlBMv4gDphJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690363273, "uuid": "a6af9986-32fe-4d21-9cfb-9e59bf3feb16", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690363273, "uuid": "59e90f35-3d55-40c1-ad95-62994c8d2965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690363273, "uuid": "cad8de04-6797-4dcf-82e3-c94b380ed724", "value": "c8e7f0c634eef3a787df3671baf49a52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }