{ "Event": { "published": true, "date": "2022-05-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-12", "timestamp": 1652400181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "368b815f-796e-4a8c-aef4-cbf90d61a847", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf6a1b3-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340184, "uuid": "a976b148-c1eb-4278-929f-8d6701a6174e", "comment": "Malware payload (Loki)", "value": "bee9c5e199625f24d9312e146040de5a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340184, "uuid": "96a99a61-6536-4d57-b5a8-9fe51588492e", "comment": "Malware payload (Loki)", "value": "0066ac567535ef784042e542274a757cef3f009574530c3dd1ce400da26d0499", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340184, "uuid": "43692153-be97-4896-a06b-6829bca47169", "comment": "Malware payload (Loki)", "value": "75597e406caba85a004176a15405f4d3cd22b91f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340184, "uuid": "7aef4887-d1fe-406b-b273-ad627805cf00", "comment": "Malware payload (Loki)", "value": "6b4478ea2126056283e6bea8410148cecf51bcc39fddeef9d87df05b0f254527d945e48079a324d4c89b45a46d41692a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340184, "uuid": "a3bbfad3-44af-4edb-bb1b-21fec1bb61f7", "value": "T145A412262B942733EBEC4BF5EE8991DD53B1AF529C20C25B0CE034ED1971B925D12B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340184, "uuid": "bec793a8-e1b6-4516-9b9b-1d54eb58f694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340184, "uuid": "8c916844-8e4b-4450-9715-d84f988a656c", "value": "6144:MPUY9k3JeojCTi6Cg6goePr7GXWtSAGtsKgEaj1NKulaT/inMgh2Ax3ROd6Fwhnr:aU1VjCM2HuXWtSkxN1g/kxV6A+xU3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340184, "uuid": "67510488-9908-4076-a1de-3a2341c71312", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340184, "uuid": "3f826886-aa11-47e2-a6a5-28bf84cc8659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340184, "uuid": "1dd1fc86-d597-4f3c-9dcc-21e6d3e5f2b6", "value": "DHL Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64677efb-d22f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652386153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386153, "uuid": "3ef75992-18dc-47e7-a1de-b96ca7f86c2b", "comment": "Malware payload", "value": "6801752dca0fb79af0f2e7d44948b82a", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386153, "uuid": "7cb9d914-5110-4206-a703-65d37299cdf2", "comment": "Malware payload", "value": "00b7daeb39ea995ac36aee2917db409adce86bcd0398a5437747cc66aaa36466", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386153, "uuid": "06df3494-585f-48c2-b58f-9940b27852a7", "comment": "Malware payload", "value": "886162b9543e91c3e5872c3447422648c73fcc3d", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386153, "uuid": "553746d4-e79d-42f0-b871-730a786ef47d", "comment": "Malware payload", "value": "a9cf2146c6e47532623f21d05cffb63f2a03c2eeb56c8fd3f0092cc9fd8af4f397d2f6be92180cdcecc9be854003280c", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386153, "uuid": "016f93dd-2273-45fd-ab5f-1d6136e0652a", "value": "T1ED62D01888533C03CF681578B6329129A15282F93EF20880F556DE2F9CEF32AF15967C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386153, "uuid": "ca1f5af6-144a-49ef-a9c0-41d306f1959c", "value": "384:n2UouVFsmBcYZo0cfHGgAuRGl/woNRSDOyY1BVjI:9FXXiGx2MYoNjyYZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652386153, "uuid": "2bbd8ebd-e198-46c1-a5db-90a1b22224fe", "value": 14929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652386153, "uuid": "25ff28d1-9405-4a53-ab53-cfc0208443d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386153, "uuid": "9e4bc296-bc3a-41a9-a6df-d5fe8bee55a7", "value": "Dokumente 2022.12.05_1230.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e69b13b-d1e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hive)", "timestamp": 1652354467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354467, "uuid": "060672a9-04a8-4150-b375-7b7023b50328", "comment": "Malware payload (Hive)", "value": "92c314b7692cb2b64512750ad7b3d1b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354467, "uuid": "40d64c0f-deae-4601-a537-772ac98d937c", "comment": "Malware payload (Hive)", "value": "011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354467, "uuid": "302462f6-1fec-4a0f-8732-4e0a0918bc22", "comment": "Malware payload (Hive)", "value": "a9a80722656e7a40fac99cc7eca2956e234e70c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354467, "uuid": "e5889888-e2fe-4cfa-baab-987104b766d5", "comment": "Malware payload (Hive)", "value": "ba0a59c485d9d58c3358175d96f9238b3a290108c54a07c0059ba6f0be6f8c6c709135bf2034c6f27219ae75c65c85a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354467, "uuid": "ed3b2987-2504-4fe8-81f7-4ad0a54cea38", "value": "T156163353524DE264CA6AE87D6315F5E9E2433233175C283F6CC6DBB007348D5A688BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354467, "uuid": "546412a6-8966-410e-b5b8-4d614474a011", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354467, "uuid": "ff4fb169-38a1-4ae6-b3d1-1a2e87c7660e", "value": "98304:X6jSrREHZ3lNmzNdI76iA0klXUOnHtlqdn7RrD3t9Y5:geElGzNdEcTNlqfrbt9Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652354467, "uuid": "8d344c88-7aaf-49ba-ad5e-cc55d6785e7c", "value": 4329984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652354467, "uuid": "56794cf4-71f2-4754-82d2-223a42db79fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354467, "uuid": "ad774d6b-0510-4597-90ea-7c0dfa719f6b", "value": "011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8c0650-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652374169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374169, "uuid": "bf1b9d6b-58ee-41d3-b2af-c7002ee5e10b", "comment": "Malware payload (Formbook)", "value": "1d5becae103e00420f9839efe6fb73a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374169, "uuid": "82dd1e18-da65-431b-83ae-b3cb844e9453", "comment": "Malware payload (Formbook)", "value": "01395e90d0c8ad1f209e098302edb7f9082529b52208bbd08eb78a6a09760c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374169, "uuid": "e2d03b17-cff1-419d-9886-3ab7321c31dc", "comment": "Malware payload (Formbook)", "value": "d4d1a991575ce3285a845741d81020370b51b939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374169, "uuid": "29fb85cd-40c4-49ba-9f57-983788c2a2ff", "comment": "Malware payload (Formbook)", "value": "639845e7e049fecae685a42c99658670abaac260795091ce52c467c330b09ef37dbfeec336fafdc9833208c88814de13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374169, "uuid": "dcd4ac78-0e14-424c-8280-8fe55bce30d1", "value": "T1F2D4935C7A410A72EC5D91386C130919BB621F336B86FAD627CB3DDA87EF1E91C05C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374169, "uuid": "5a1e2807-f2e9-4f27-ad5e-e36df40beefa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374169, "uuid": "ba7f7082-863c-4918-935a-160caf0caa8c", "value": "12288:emcnC+kaS6DWiqILl7fppL0sTz1L0mis7/BjclCV3Li09zDT:DZ6Cu7f3Tz1L0mis7Nn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374169, "uuid": "d3f6bcb1-3763-44db-9f87-0a5e86f0feda", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374169, "uuid": "b0774d82-4f1f-4d93-bc24-33e80099f1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374169, "uuid": "f96492f4-ffac-4842-a5c8-4d11b883b6ea", "value": "SecuriteInfo.com.W32.AIDetectNet.01.30541.14558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f458d5e-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340617, "uuid": "3a15eec0-ad8f-411f-8877-59b622ace44a", "comment": "Malware payload (Loki)", "value": "9eb9e0b2d312768914016744d9361751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340617, "uuid": "41ead652-eed9-457c-9a90-5db28eeffd5b", "comment": "Malware payload (Loki)", "value": "0160e6f20b6dd8840c7cc06c1b7182b42cd711181270f70419f7df38d62c9304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340617, "uuid": "5ac8bce9-e19b-4621-b391-4ddfda6d5da0", "comment": "Malware payload (Loki)", "value": "d64d4932a27f2dec2119297dcb9536ad1c1e2bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340617, "uuid": "0f6d6225-cd00-4da9-8bc1-4cf18afbbe9e", "comment": "Malware payload (Loki)", "value": "424a2b63e97607055b68b38feef16b328fca6d7a9a116f1e21ecf407a653586e0bc82458db5fbf8469cfaedc5d273202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340617, "uuid": "15ec8f77-e31d-459b-aee1-d8f7ee5f2aa4", "value": "T1B7040250B7A4DAB3D862A3B60E3E6F161FF4D83225304A4747417A193D36691EE4F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340617, "uuid": "eeabb6d5-2ed8-4a20-8df3-51776b302728", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340617, "uuid": "3a26cda1-bef2-4221-9dce-5d16213a376d", "value": "3072:LODZGPEounb5RM4RDz1Y4Qzn7w1h/gUtc7z2LdmcYl2pwjr7y5fMjmR:LOtIO1RfyMk7JccJ37yVSmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340617, "uuid": "443c4228-5a91-4315-a2a5-d3e8c62c51bd", "value": 182823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340617, "uuid": "67d03a52-bb56-4444-b049-8898ffd32b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340617, "uuid": "9bae088a-d0f8-4e79-ac80-80a6b6926943", "value": "9eb9e0b2d312768914016744d9361751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a8c034-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379638, "uuid": "bb7da6eb-7157-4aa6-876b-88976125bb55", "comment": "Malware payload", "value": "b19600ea7919091056d0f22b7af5e42a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379638, "uuid": "63af13fa-2480-4143-b040-67abc0891f98", "comment": "Malware payload", "value": "02ec292bbea5133d080877227a06f9d95ca6ea88e2750b94755b2c064862b6b1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379638, "uuid": "045bcb29-3347-4709-a080-5c6b3870c796", "comment": "Malware payload", "value": "15cca65901df1c73495fdc1fc17cb69b4f9bc74d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379638, "uuid": "08b2891c-ca8a-40e2-bdab-d9710d0b6e54", "comment": "Malware payload", "value": "c55302fd3e8101f9e50fbaa40bb7dbe7d47717a4a58c80bf9fe8c844c5020e26f33a6aacfe714ede9ce2d1cdec9a661a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379638, "uuid": "fa2a4359-0637-4f99-a633-e4327a1e404a", "value": "T165C4120633F89F72C533ABFC2672204617F632222523FB9C9CE650E65995B258B44DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379638, "uuid": "9e67b56b-1dc3-4bba-b4d2-43cfc2faa3f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379638, "uuid": "58f3ca35-0ee3-494d-b8ac-ec0b8438eb6f", "value": "12288:RHYRpj89QXwYF0o1jaUYL+BGjumdcY4nS3gHnLwOXf5V1LE7xN3:KPoQXaoYUYaUum6nw2nLVP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379638, "uuid": "36258193-3a74-451d-ba3a-165306cdd1fe", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379638, "uuid": "2576b576-ae77-4b7c-981d-50b4e7c125fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379638, "uuid": "23564b98-d2c8-4cdd-b261-b649a482f765", "value": "DHL AWB (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7172550a-d214-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652374578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374578, "uuid": "1a20511a-19fe-4e7e-86d8-0ac396c633ef", "comment": "Malware payload", "value": "c249fc25dc318578f39ad29c265018b7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374578, "uuid": "5f6aff4c-a64a-4f54-a3a3-9ca41ea00542", "comment": "Malware payload", "value": "0304f6f3430a7e7d09ea6487005e3f7c7e238709fd4265648aa9704242d3a2b4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374578, "uuid": "915f5ef2-7e95-4613-b57f-d86daff4b62a", "comment": "Malware payload", "value": "b27318476218789792ee793fb4a50824c9457d2a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374578, "uuid": "f17c9bae-1c16-4d66-8494-56271c11fdb1", "comment": "Malware payload", "value": "91306bb05d8ebde89eda1122b10000e1c654bbb9a4b73869d61d996dbf73e7d859c954a10d09c2d3a7a6a49174e2bff6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374578, "uuid": "fb437f01-18e1-4931-b8bf-04b13ad2d0b0", "value": "T1ADC533C3C94556F7E3B3B263E8EA31A257A63989FD36DDC1FA35A81961494C020F70B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374578, "uuid": "67aa3bcb-b02c-45a8-8272-b1e10ac78f61", "value": "49152:cHHzxTFD4c/tZezKl4I8qgt7me71k2FxWzB8boBOK3iRLiPdYODE00W3cwch/VUg:wHzxTht8zKl2qeHaMcmboBO2i2PdNDxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374578, "uuid": "20da931f-c8f4-403b-b6c4-08ba35fb360a", "value": 2662684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374578, "uuid": "abd9193e-cb3e-4512-8919-6169e0b3550e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374578, "uuid": "9782912e-360e-46e0-9595-adaf62ac88f8", "value": "0304f6f3430a7e7d09ea6487005e3f7c7e238709fd4265648aa9704242d3a2b4.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b37993c-d1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652350006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350006, "uuid": "417b0f35-c20a-441b-82d0-06866167f68f", "comment": "Malware payload (Heodo)", "value": "d8585b25305b809c8b3161b00813dcb0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350006, "uuid": "cf1c256e-02ad-450b-9ee3-74b7125d6de2", "comment": "Malware payload (Heodo)", "value": "0355dc9fc4292cbf7748f2753a666476d23e184dd9f9e373b4ff15738e348285", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350006, "uuid": "87ab06db-7a1a-43dd-bbe7-ff1573dc5e3a", "comment": "Malware payload (Heodo)", "value": "2892ae5cfb5ad46980fd5ec3bdac5a7d2fc6e608", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350006, "uuid": "12578f1e-c1bd-440f-9a0d-987591ae673a", "comment": "Malware payload (Heodo)", "value": "2503501aead653f1d0757449b427a200447d4fa383018dc504892a903153a40e5c676c3b54873f3d1adc4f07e61bfb93", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350006, "uuid": "7b3bde20-8277-472c-95d0-83bd75313695", "value": "T14503834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350006, "uuid": "c133141d-e814-4b00-b431-e138a464fb4f", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAg:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350006, "uuid": "5fe7fdcd-141b-41ce-ade6-db1e041750c8", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350006, "uuid": "17205a72-a5c4-4a52-b772-e07d7e5f3daa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350006, "uuid": "63888fb4-d052-44d7-a9ab-4e5e5482a02f", "value": "Dokumente 2022.12.05_1118.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b81e8e-d1fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365089, "uuid": "a2e34f21-0da5-47e5-a108-9c9589f3c15b", "comment": "Malware payload (Mirai)", "value": "6466a0190e4c1ee89c2b650aa04c8610", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365089, "uuid": "1a5263b4-de1e-4ff8-ab81-1147b483d01a", "comment": "Malware payload (Mirai)", "value": "0406ed74128a34b207265636fd45b57026cff2c9a5ca5511dab2bc559ad03bd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365089, "uuid": "5221dd6f-6af4-4670-aee0-70e1aa1c1af7", "comment": "Malware payload (Mirai)", "value": "f63698fd05cc530da0a8b57a7f95b6ffcef6e634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365089, "uuid": "c0dd1e68-f937-4de5-b1e8-a0981fb8dfbc", "comment": "Malware payload (Mirai)", "value": "35419419402e07799b6d06b561044cdff60c92b7fd62d435de376f5a9b920a3648f3d9b9de5756984f7c6b3f659207b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365089, "uuid": "2f11608c-4988-4cfe-bb1c-a822768500ac", "value": "T1D4F2F1654ABDE870CA70623AD56402C35996273CC1FF353F50A68B227FB899719FC1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365089, "uuid": "1abf9315-bb53-4b29-8576-c09cf7059dce", "value": "768:D+dJp6bLwflHky/cmFpoEnniawYBrFRjpYytg2oGj2a3E/8dRK8H9q3UEL5R:IYoFck6E7xFZSyyraU/0hWLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365089, "uuid": "536338b2-c04f-4c06-b7f1-79561b67bbca", "value": 34908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365089, "uuid": "b5613d6e-0ec8-4524-ae2e-fb377ba88e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365089, "uuid": "caf0c49c-a0b7-40b3-ae50-7136b540ac67", "value": "6466a0190e4c1ee89c2b650aa04c8610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe2914b-d1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652347645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347645, "uuid": "cfb7d698-f8b2-40f4-991a-1483750b9f3e", "comment": "Malware payload", "value": "5d4e1b429fc24932f33d07f16f45500b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347645, "uuid": "d671015f-18b0-4f9e-989a-49d3c9e44e23", "comment": "Malware payload", "value": "0465b8f926808af631cad38b4327c496b3fc21b4550af2ed8fcdd031cd2a4ad7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347645, "uuid": "3fbcb5d7-56b4-4081-9127-46fd747d41d5", "comment": "Malware payload", "value": "2df5576637bcae518b0f7a1a64b32f51ed29ec76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347645, "uuid": "7d4fcdf5-186c-4790-9067-c5b5ebab1c46", "comment": "Malware payload", "value": "1767aec2ac4f9ada6681c5ecc2485189685bf7bed4eef3be490ca3d5504fba8f090065017de507ae9daab2b353af2bbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347645, "uuid": "7515def3-e3d3-43aa-9feb-3ce7a08997be", "value": "T1C004128C6AA19810FE508CF72DB152651E61AC6F9366D044820B333F77F09E7DCBB692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347645, "uuid": "7f1decb9-f19f-4080-8f4d-8deb84a6abb4", "value": "3072:0DER61rIGKyTvdBT4MAjv9L/N0iHfSa1Jy0/HBCvRrWiLiRxRbnLaTVfVYhv:YER0Kw74V/P//1I0vBAAi+XRDLkVf+hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347645, "uuid": "2789f534-f60e-4142-9427-bc066451b2ec", "value": 188280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347645, "uuid": "551bfad8-b117-4630-9674-2c52ad2d6df2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347645, "uuid": "926127c9-0309-4902-8664-6d0c8b1b3871", "value": "Remittance copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3a119b-d22c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652384775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384775, "uuid": "ee282ccd-320d-4dbc-bb12-3143c7ad5e43", "comment": "Malware payload (Heodo)", "value": "b6364470e9613491751640b6d6f36285", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384775, "uuid": "645c9033-1f91-4e15-8521-eb25478cd3b7", "comment": "Malware payload (Heodo)", "value": "04d9f70bea7cb6873f8930b6589bccbb43567e2746dc3a81f834696741068ae0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384775, "uuid": "8ce2b2a3-2007-4514-b740-86a0e2724790", "comment": "Malware payload (Heodo)", "value": "aa8bb6feb07102d8167aa9a39b7ca880541ff1ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384775, "uuid": "d96b7755-7590-44e7-8e33-c74affbf8788", "comment": "Malware payload (Heodo)", "value": "754f3615e597a7e15986ce7ee76491490929b761b77c004cf950c05ab0a1da0be73ba7636d44998683fad216ff0dd968", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384775, "uuid": "3a967090-ecb6-45d3-a720-5bf72da0ea42", "value": "T14CE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384775, "uuid": "2e3ad140-2b06-4cb9-935d-4cbd49e67594", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384775, "uuid": "7a9763a1-8ed6-45ac-b8b6-62311d261d25", "value": "6144:mkajLyaPIvW1TFpvzYNB1MRB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8G6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652384775, "uuid": "9a39f282-e0a2-4f6c-9077-ff14ced16738", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652384775, "uuid": "cb63041d-ac87-41ba-977b-ab63cab9b0cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384775, "uuid": "b98efffd-d774-4296-be8c-15b0c5d39cea", "value": "b6364470e9613491751640b6d6f36285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f870cb-d1da-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652349755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349755, "uuid": "a67779e9-c9d1-4dcf-ab69-92ca31aece26", "comment": "Malware payload (Heodo)", "value": "76b93ae16e220272405a43d7fc1f9840", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349755, "uuid": "3c03b24a-6fd7-46cf-8ae2-34892b0feca1", "comment": "Malware payload (Heodo)", "value": "05cfea46c774d7a2ceb558bda02096cfdcacd71f83f7bf93a170d5618ad1adda", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349755, "uuid": "9845ce2e-9a85-4601-8df4-774a4f5d3849", "comment": "Malware payload (Heodo)", "value": "2a53ac12ff256ab6490e7b2f3e3ab22addf0e703", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349755, "uuid": "12b3741b-7579-4845-a850-c6587430ef3b", "comment": "Malware payload (Heodo)", "value": "7cc9c1ce9bab96369a04be672c28d22c0a8c888c0164aba39bd7e43deeb79a91d15aa35bcdb7533e3bf294bede99fdb2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349755, "uuid": "d1f145ce-c81d-40d9-bd97-2d8522ee93a0", "value": "T17D516C2C2EEE2119E5F3DF717DE47AD5DEAAB9737911895E00C1030A4912A40FD91E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349755, "uuid": "f92e640e-7e93-4da4-97e0-9cddde68c244", "value": "48:8m8+rVGzXjeUuISQDl/KNVh5kWAljH2X9eL5MM4ab:8m/Ga6Sqwh5SH2X9yMM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349755, "uuid": "b0413737-e77f-4241-a8da-22b70784008e", "value": 2714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349755, "uuid": "2431112a-074e-4d6b-937a-35da0bb18f6d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349755, "uuid": "fd850e9c-eebd-4076-9628-1a638b4db300", "value": "3487187-772818-Neuer-RV.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7b749f-d1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652353607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353607, "uuid": "f6f87d07-30fa-4da5-893c-adabca24febc", "comment": "Malware payload (Heodo)", "value": "081f5a326eaed29665ea665cf9186c3d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353607, "uuid": "d0ca5065-b31b-46a3-8505-64992fc1ed7e", "comment": "Malware payload (Heodo)", "value": "06f1bc7a8ac48cd7324efaf13cec4652484d9bc23135b5431f5458aa193fc0e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353607, "uuid": "bf95172f-5ab6-4c00-a2a9-948ecbadf044", "comment": "Malware payload (Heodo)", "value": "9112cd407368863383d32633cde2958d14c1b3d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353607, "uuid": "f4021b83-c086-4f4d-b740-0490dcbca1c6", "comment": "Malware payload (Heodo)", "value": "8f2a3c7813158698cab17a60266dfdf6f450df328aa738e4e08b0bbcfa0a5a9d1069768c71d9b981c4960183a7b02dad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353607, "uuid": "ffd9a6eb-69bb-4c11-b42c-3027830bae90", "value": "T1C503834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353607, "uuid": "10a124ff-f7b7-491e-88d7-3672c2bf0059", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353607, "uuid": "635dcb53-baab-4d6e-b2f8-6931437331b7", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353607, "uuid": "09770482-c8ce-47da-b3a6-3708795c4625", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353607, "uuid": "1d9256eb-660a-4655-8bcf-6316c54d2a33", "value": "Rech 2022.12.05_1216.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9883111e-d1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652352739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352739, "uuid": "436557cf-9adc-4f4d-855f-d956be42c02c", "comment": "Malware payload (Loki)", "value": "0af7fbb3b5a2a7059555859c4c1db8f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352739, "uuid": "5e7f3320-d37b-4d7b-9641-1cd0c2c509cf", "comment": "Malware payload (Loki)", "value": "0728b4bdf11dbf9da1c04ad542981e9bc44e313747bf5b86dccc15ca7f8dc927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352739, "uuid": "a1bbe54a-b9df-4cf7-8159-7a4d5169a4a3", "comment": "Malware payload (Loki)", "value": "67e96d488538213b16c6c0c599648437a176039a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352739, "uuid": "13c29c58-0eb4-495e-860e-7f7fe08efc16", "comment": "Malware payload (Loki)", "value": "34e09c5940f56d7129111be140bcf4a350dfdd79d4ae996d345d1bdc95a25f231291f1e9b4833158dbbc00240301c695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352739, "uuid": "d894d141-d763-482a-9966-adac4cdc5a6e", "value": "T1BB2402213255F0A7EEE623323D3BA77AC8F7A5152CA1099B570112D6B9F3201F61F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352739, "uuid": "f0071894-2da2-4508-916b-987954285e2d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352739, "uuid": "347812f1-be01-4858-88b4-2e7b08cad8bd", "value": "3072:LODZGPEounbPcYshIYLbrM88cu1IC8N5vE6z8kRZSKbzCbQnPanr+83Mckm/fsjz:LOtIOUr+Y/rzu1T8r1gk/lPOGMEjuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652352739, "uuid": "daebfae0-dbea-4fb3-bbe9-f9722f824f50", "value": 212868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652352739, "uuid": "634406f8-ac99-4f8f-8ed1-72b171157054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352739, "uuid": "494e9fc5-cdce-454e-983c-d5728d14909e", "value": "SecuriteInfo.com.Variant.Jaik.72878.10394.17964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d992438-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652379565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379565, "uuid": "3d24293c-352a-40ab-895c-97a4cee902ff", "comment": "Malware payload (AveMariaRAT)", "value": "fe8cb9a59bf27ad057a750b21e0bec09", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379565, "uuid": "bea851c7-6c42-4a11-883f-c313c6fe2c08", "comment": "Malware payload (AveMariaRAT)", "value": "072b925ed756b0cf46062de6802901dae92bd72c6a305c9129437f95a6c8b751", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379565, "uuid": "fa4326ca-ff5a-4e8a-8807-611162fdc6ce", "comment": "Malware payload (AveMariaRAT)", "value": "96b82aeba60a560c36a9d058a0b6b3fc96f17ec7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379565, "uuid": "a886974d-b649-4f56-b612-aedad3edf70e", "comment": "Malware payload (AveMariaRAT)", "value": "dee7289692542c2787148457c386b5e473b0e38a7d758065f2772e71468eb885941d16a38fe3bbc9fcc88c091348ff1d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379565, "uuid": "2d8e9769-fa39-485b-b921-7d543901e85f", "value": "T181942D2C7A415A72FD4DC1385D130A09BB620F332B4AE9C657DB2DCA87DF1E92D15C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379565, "uuid": "81abb977-3198-4ad2-bd32-4bd05d1fac4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379565, "uuid": "b9519ccd-7eb3-42f6-a328-09f825293afb", "value": "6144:C0bPNaal8F39EKouTWAnMxlp1SshDYc5eNbofq4f2J93Bj:CAgal8F3eK9TxKlp1XDYcdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379565, "uuid": "dc18ee4f-e65e-4c4e-8f16-ed8daa4e7ec4", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379565, "uuid": "5ed6eef1-6b42-4790-b887-d8c97faf00a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379565, "uuid": "10089f78-c86a-49df-9f96-a97ad712cf22", "value": "Fatura i\u00e7in Sat\u0131nalma Sipari\u015fleri 05-12-22,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19d828e-d241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652393986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393986, "uuid": "5b9772e1-927f-42cc-8ecb-62144a8914c2", "comment": "Malware payload (Heodo)", "value": "b2f3a9acd3ae06bbe2441ecafd705cdd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393986, "uuid": "2aa2983b-51b5-4af7-953e-249000dc6d9f", "comment": "Malware payload (Heodo)", "value": "0749ae4fbaba4c32165fe6a257b19a932fa89ffa0a5831d8ffad9b47725b2d18", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393986, "uuid": "a79ad3fb-e137-487f-8308-0fd52fcd6a31", "comment": "Malware payload (Heodo)", "value": "fd12113bdb88044f8fbe49b5af196bd62170065a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393986, "uuid": "32fb6dcf-882b-4d64-b7f5-e5a011f8b25d", "comment": "Malware payload (Heodo)", "value": "8cbdea9c3a3f0b86973a5c8b7db74abb69bb3b5feb3464efea6f2720acf325a6e8ad6a8746ab263022840f390256b737", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393986, "uuid": "0f60a397-2202-470d-8fd2-be2ef400c189", "value": "T10DE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393986, "uuid": "183053d9-c7e7-41f7-af78-eefe0146749f", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393986, "uuid": "82b0e5ff-c8df-4592-8691-36c708887ec2", "value": "6144:mkajLyaPIvW1TFpvzYNB1MLB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN846nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393986, "uuid": "eb4a36eb-0594-455d-b8a8-7c0f37ce0d99", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393986, "uuid": "756228f8-1032-4afd-8af1-e4029fc2349b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393986, "uuid": "1b7e61ee-d2e1-4fce-a721-fed68af0182e", "value": "b2f3a9acd3ae06bbe2441ecafd705cdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77dba2a-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363636, "uuid": "1bbd1321-36e7-408d-ba2c-494ad7b0a85d", "comment": "Malware payload", "value": "b7bd434c52f1b520ab2febed4f7ee13c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363636, "uuid": "4d98812f-60cd-49b5-8922-5046ef916f04", "comment": "Malware payload", "value": "0810c5a418d628039a045a5e68b436047ce961b03e800a1730f4f36693ef36f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363636, "uuid": "77b86323-79cb-4086-afed-80302e20ecfb", "comment": "Malware payload", "value": "4f99e8046ec8b7a8e59f7235c0ded6f7e466747d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363636, "uuid": "1974ab82-2d15-4603-9d4d-2b1d61c798ee", "comment": "Malware payload", "value": "94221d2dcb9f2db46744ffa65987d27c1e531d7a5fe7fb02b32bdfec955ea846c2e1bc12f5dcff2a20fd1e1bab749cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363636, "uuid": "74a42cd0-8824-45e7-965b-9a5d9075ef29", "value": "T1E0A3010637C24225E87C4FBD89B70654967DFA4F4C27BEAF8B4C910D9D13AE70960B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363636, "uuid": "7f294112-17aa-44c9-a288-1d2d9b189a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363636, "uuid": "0bdf7beb-e325-49dd-824d-7b74cb6f03c5", "value": "3072:nO7WG9EX2tDiCXTLfSkeu2AcYMD2SP/LLO8Xv:nO7zEmt26LreZ3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363636, "uuid": "5af3057a-9b04-48e1-a116-c984b8177c63", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363636, "uuid": "b49e18a9-c5e6-4fdd-888e-7d560654361e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363636, "uuid": "1d200287-6f65-4fb0-8812-e1bda451e76a", "value": "0810c5a418d628039a045a5e68b436047ce961b03e800a1730f4f36693ef36f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ad802b-d1eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356813, "uuid": "63fc1ed8-ebd8-4d95-96f0-451e7a705a0a", "comment": "Malware payload (Mirai)", "value": "944b7b36b82f7a5d805a1352738ba73d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356813, "uuid": "46eaa3ec-1356-4a54-9874-5ceffa25d137", "comment": "Malware payload (Mirai)", "value": "08f7287d74396262cb8bcb9ec0e78905a621c942198a2590709a8d6f693e2a99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356813, "uuid": "fe7ff601-13c0-402a-ae8b-8db196cb8c1c", "comment": "Malware payload (Mirai)", "value": "e50ad121f4a0c34881818741ccdae5d63cbf714a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356813, "uuid": "27b075cf-4b17-448f-96e2-6480cca26e40", "comment": "Malware payload (Mirai)", "value": "5959c5a0d60d4ae0203edda760e7228b81ea67aff40721bea6d60dd1666c1be65780c060499c1abf5deb99ec4536b701", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356813, "uuid": "a1c52fb6-52ef-42f1-a044-bcd4b69814e5", "value": "T1DC33F13EE229B3F3DC4DA6F9A18E2B690C3674A5F37B57952750810855110863A8CEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356813, "uuid": "62c4847b-ebfc-4398-a22d-3192dbd611b1", "value": "1536:HZFo5KIItdW4epUaKhI/dT18WR0ZfZgPXSl:X9tdSUaDJRWfZSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356813, "uuid": "00182a04-b582-4b50-9999-888e2945a359", "value": 50336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356813, "uuid": "1e874c91-5e24-489b-b107-1ff8ecab72a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356813, "uuid": "93aaf0a6-f724-45e9-81cb-dcebdba61a7a", "value": "944b7b36b82f7a5d805a1352738ba73d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25789f6a-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652345674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345674, "uuid": "e6158a47-7956-4636-9715-2f628ac318da", "comment": "Malware payload (Heodo)", "value": "e3e3e801bd973fd6aa6eb8160c71d67c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345674, "uuid": "e51bc11c-c52c-4102-b99f-f597e246a1bf", "comment": "Malware payload (Heodo)", "value": "09607f96ea2e2c7a2cf04e4f8c8b41847d069a0e3f1149835071e1533e6fd2a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345674, "uuid": "5e21b895-f85e-4e97-b7ea-5b7d3514a28e", "comment": "Malware payload (Heodo)", "value": "fb697511a52da471c2bd8cc6332a8878d7194299", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345674, "uuid": "7b5d79e7-f46a-4f7c-bea6-642f7cfb5d0b", "comment": "Malware payload (Heodo)", "value": "1eeaa046f75c48b7805df4ea3df338e8c7b77c7457070010fc6192b0c43bb625c39088f451f2a5398eb52a2ae3bcfff0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345674, "uuid": "5a0384dd-cddf-4c3e-b178-58def6b00ee6", "value": "T136F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345674, "uuid": "6f8ec6e7-cb81-4f5e-986d-3a36ab876fc9", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345674, "uuid": "859aa0b9-ac4f-4656-87d0-550a0772bc73", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmStjNwgraKRT61cKGNx:S4DzZKnH4ARGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345674, "uuid": "cdb03aa8-18b7-4e8b-a72f-8dcd2a54e6fb", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345674, "uuid": "87ebeb05-fb24-4a15-a0c0-c73528b8e8b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345674, "uuid": "c7c03d80-6916-4fa1-a3ae-c7933179319a", "value": "e3e3e801bd973fd6aa6eb8160c71d67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1020cbc2-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kaiji)", "timestamp": 1652340914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340914, "uuid": "06e833a3-2c10-43fb-afdf-989b59e27e77", "comment": "Malware payload (Kaiji)", "value": "98895dfd226d14f1cb6622ada5aa7ffd", "object_relation": "md5", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340914, "uuid": "2e66ada7-e202-4b11-99df-ea58f950e1ec", "comment": "Malware payload (Kaiji)", "value": "09c746e58ad2593f3feb335e2f470077593fc7e84d93994c59cdec88b8f690a0", "object_relation": "sha256", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340914, "uuid": "545ceebb-0ccb-4ddc-a481-c46d48a55f91", "comment": "Malware payload (Kaiji)", "value": "ca9656547547b9ac4f2877ba504380ecadcf3ae1", "object_relation": "sha1", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340914, "uuid": "e3193ad4-c318-4929-9bed-82f534522992", "comment": "Malware payload (Kaiji)", "value": "1a8ddf0a31c44336e36a761e1425bc981ca749292c8adf903a0d31d4af50c51d8ca64a29eec79bee67ad7ee45954e09d", "object_relation": "sha3-384", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340914, "uuid": "062001ec-3a73-4552-a0b4-5b057f7f2989", "value": "T11EA533696349F0D41CEA3920F38BD981564C115748EF8CA3C5AF56DB9DD8AF1A3F2780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340914, "uuid": "b97c9c6b-60e4-48b4-9f33-e4c8a30976b9", "value": "49152:3SScVp9TSu2t0wWdRGDHJIwzbu6TE2EiyP4w++jOTOasZE:3fIMundRi+wzbu6E2E/QjTPYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340914, "uuid": "625d88e0-71ee-491d-a6c9-2db0880ed1dd", "value": 2065100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340914, "uuid": "04c802b7-2e49-4c83-b2b9-9ed63daed53a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340914, "uuid": "c010b0ae-2a50-4a36-b5c4-03a7feb6c17f", "value": "09c746e58ad2593f3feb335e2f470077593fc7e84d93994c59cdec88b8f690a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3be368e-d24d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652399278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399278, "uuid": "7ad50700-3214-498f-b0f8-89dac4802f84", "comment": "Malware payload", "value": "bfa6a35755791e6046c304ac582770c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399278, "uuid": "1b70b06f-33e3-4d20-9f4c-d3d47d92f571", "comment": "Malware payload", "value": "0a35b0e0112fc3ffb7fb29e2f7afa092ae3b5932ff8e79c7a9b5365ad5e08013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399278, "uuid": "6eb7e171-5b31-4e2e-a8d0-35c71ede502e", "comment": "Malware payload", "value": "6f921e0412bc2506ef0c1b65f0f086da4a161ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399278, "uuid": "da005324-a93c-463e-ba73-25fcc5aec707", "comment": "Malware payload", "value": "1f18642e27b9a871f7d13d9904b38c9bf9344e442565e7c829b85a28b4482eee1f5dfb156af3c9ed480ddc13738672b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399278, "uuid": "4de7f05d-cd53-4e90-90b5-2e6fb070d0ee", "value": "T1D2B412206A73A228D65E4B37CDD950DC02B69F439D23D51B6EE971AE1F327C246C0B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399278, "uuid": "e6cc17ef-77a4-4d78-bcce-d8961cf30946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399278, "uuid": "676f7ef4-5fd2-4142-9577-1c8607615db5", "value": "12288:nN1Zy3oOPK+ZYmyZNQ5yJKmronZ71OhoM1qr0gHLwES17Sl2uCSzI:N1442K+ZNyZWIpMZohoM1qr0gHLwEC7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399278, "uuid": "510bf7fd-8db1-42cd-b7f8-10cf764d7952", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399278, "uuid": "489b0640-4489-4b56-abbf-4fdaf05f28e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399278, "uuid": "3e7d1b7b-a348-470a-b44a-86be1c28f0a9", "value": "SecuriteInfo.com.Variant.Ser.Lazy.948.25861.26687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee09e03-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652346146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346146, "uuid": "cc87be59-f1ed-45f2-a9e6-e3210a3af784", "comment": "Malware payload", "value": "f96a2a63125102b0d96b541be4c107fd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346146, "uuid": "2912c8b1-af48-46ac-9cc9-f579e2a0706e", "comment": "Malware payload", "value": "0b4b035aa14a556e3c2bb2fac92f601085e8c30a09fcd94964d6255452ec4288", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346146, "uuid": "cda78c11-fb1a-4b1b-a5b8-6588f6f3450a", "comment": "Malware payload", "value": "121c4f2ed3f69add990bca44635bdf95455a3ce3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346146, "uuid": "7811732b-abc1-4963-be47-0990af1b9566", "comment": "Malware payload", "value": "9d0be87e1a0b3694560fd1a9e7920dc49ab3f7c65a945dc4b230a5a29b515099b9abdbf8279b0b5c810849d7492150b5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346146, "uuid": "a623f168-85b1-48b3-9410-b97396621afa", "value": "T1BD448FB303C407BAF6840FC480AD611B15F1C16E756829AD8BF2199B7C7AD97AC74B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346146, "uuid": "7cf3b4fd-bdbc-433b-b014-f5d43de38e9f", "value": "1536:sz5LkCs5FlOHLvdpb3YE4ZeLXxMxgswiYD:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346146, "uuid": "12e9aa66-4f9f-4493-8aac-fbacb2578eb5", "value": 268489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346146, "uuid": "49ea9ef0-c2af-4dac-9e09-e28f137676e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346146, "uuid": "046e02ef-4e1a-47ed-9b8c-bca042d82c0a", "value": "B.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bd27ad-d223-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652380954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652380954, "uuid": "c5adfabe-893c-4442-8862-62493e3f25f8", "comment": "Malware payload", "value": "a4d15ecf367ded23eb46e8e1b6730b4d", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652380954, "uuid": "39bcc5a6-69a7-484b-94fb-a6f41db3fb75", "comment": "Malware payload", "value": "0b56433469d6327485de48c93813bd77040faaf4b743df0f9ba23a7e53b4a89f", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652380954, "uuid": "27c33b04-8aec-4cf7-9fd7-ecfea9c57f67", "comment": "Malware payload", "value": "0545145a188e96c0d6c6d612738f5edce6f94b79", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652380954, "uuid": "80837510-7a5f-47f2-bdc6-65f1d9062e9f", "comment": "Malware payload", "value": "5cd607c4ecfe56042e8c5caac82c81248df52d0ad6e8966b370c865237c931469b51f7c664f293f3dfab9b4f87b5ef90", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652380954, "uuid": "71eecbd4-8fe9-4e20-b9e0-c6badc055efb", "value": "T15B62D1A20149C0FCE3C68DB474ACBAE8A49A4B54386D1507A61CC58A8F4FFB5624BC9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652380954, "uuid": "7644e23f-e80b-487f-ad81-55e0b2aed326", "value": "384:txfZ/gxC2kV+liiIq+NApqdsjtnIxsYDGtDnF9d:txBYxaUIqgOqd6ZRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652380954, "uuid": "b357220c-0a3c-44a7-a2f7-e64dcbb2b56c", "value": 14943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652380954, "uuid": "d51ac0cc-1756-450d-8d33-df74cc2014e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652380954, "uuid": "de093e0b-874b-4b86-81d0-3f23ae3854e7", "value": "Rechnungszahlung 2022.12.05_1232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b859c1-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652379462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379462, "uuid": "e8252806-c7fc-4bf8-a200-ea1fc566abfe", "comment": "Malware payload (AgentTesla)", "value": "d5f48428d1ab627e7f9ac953e9080995", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379462, "uuid": "75552c02-e91b-4156-82fd-435599943602", "comment": "Malware payload (AgentTesla)", "value": "0ba980f3ce5acff4bd93085a54c1236e0744e14e4949e440b7e9de44ed3d5fc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379462, "uuid": "d182b18e-2a0c-4ae5-ac02-391b0930885e", "comment": "Malware payload (AgentTesla)", "value": "0a58188aa2f8c6bd1d6a3e770ec2b77788bc4e5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379462, "uuid": "666c6f76-04f1-41d9-ba62-8baf2ea05067", "comment": "Malware payload (AgentTesla)", "value": "5e7ed32ac5fd4df02a396227aba280999a78c5d91f583899698dc500a24d0e9a40dc5a2199de122beb330fcdf287e49f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379462, "uuid": "216266f2-2058-4a4c-8d12-40fb8e05d455", "value": "T15ED4D031375CAE14E6BEE77A0020854093F2D55FBF63D92EBDB7098E1909B0157B2A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379462, "uuid": "e3fb2d8f-5500-4fcd-82ff-d6d29faaa8cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379462, "uuid": "9fcfa5bb-aa10-4e51-b15f-f6d97ecdd8c9", "value": "12288:2xWritt3szwHfMW044AjYK6/G00IowOUC+5f:8WAt8MUWqAkBG00HwTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379462, "uuid": "834373ee-3eaa-4628-b9ee-143f5ed9357d", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379462, "uuid": "fe322f6b-858d-48d4-be21-450cec580481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379462, "uuid": "764ff6f2-6b55-4cf0-a93c-5a65a7507473", "value": "SOA (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afb49cc-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652337899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337899, "uuid": "d5c89305-1385-44ca-ada2-1b36172924b2", "comment": "Malware payload (Smoke Loader)", "value": "80c97a8c5898d9a44d0e15af0ebe11cc", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337899, "uuid": "d9091525-5b32-4119-8958-70afa984c4fb", "comment": "Malware payload (Smoke Loader)", "value": "0c34d87abefc2bc1b32ff700a189fba2cd4691ad07e8d26c4722c3e4b70f95a2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337899, "uuid": "8f12c7f9-27cc-41cb-933a-c240ad8efb89", "comment": "Malware payload (Smoke Loader)", "value": "87a335d5f07ee0ad5aef79a1d60570c5d48ca686", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337899, "uuid": "f12031c8-461d-48ec-b047-fd80ae051b99", "comment": "Malware payload (Smoke Loader)", "value": "20b7a2191e3f7ac0296978656cb7d868bb26fea2043cc3c73bbee0f8ba19b8bdbffce127315f8ec2f60053d66a428e70", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337899, "uuid": "5dc01aa6-7221-4c06-83c9-ffa742e40b85", "value": "T1FD44ADD17792D031C1A73A3184B49BA64E7A7823E770594F37742B2F5E702D18ABA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337899, "uuid": "14f014be-7d0a-4bdf-a063-6ad16004676d", "value": "a4da0fe0ce24b93ecb26fe81f91544c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337899, "uuid": "fc6ae57a-a298-4721-a046-d7f53063df10", "value": "3072:Qgfi2U0ZfDjNibGZ8Xiy23oVggjcGkNIVqI:vi2U0ZfnNibGSD23k7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337899, "uuid": "58dbf8e6-7d5b-4ab8-bd6a-bc53f46b20c2", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337899, "uuid": "931d7912-9d7a-40fb-a229-6455af91a555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337899, "uuid": "72731b69-ea04-407a-902d-e56690f0e7c0", "value": "80c97a8c5898d9a44d0e15af0ebe11cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80de6e4d-d243-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652394790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394790, "uuid": "a585f802-854b-4727-a0ef-637a371ca77c", "comment": "Malware payload (Heodo)", "value": "becac1f659c3016466f83240471bc2c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394790, "uuid": "efcb574e-b0f6-44c1-aded-060da54e537e", "comment": "Malware payload (Heodo)", "value": "0cab45e33809a9a89c7851b97e933ebd805d70314fa8d1ff7d6685a0eaced29e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394790, "uuid": "21afb5f2-21a3-4daa-9109-750c944f7485", "comment": "Malware payload (Heodo)", "value": "c0d807349085e273ceb69f6f8234810e62855f64", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394790, "uuid": "95544ff5-390a-4532-b0b4-3bd926c0f455", "comment": "Malware payload (Heodo)", "value": "73d1ed56840bf0541e1f6a0c933258f1f02be0fa6fd3553f7f5b5585c28463af40b7821f8d20a4ecac1b4c68b8f03898", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394790, "uuid": "30c58432-0d36-4fa9-ad9a-7258394b3189", "value": "T1BEE439022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394790, "uuid": "005f6229-a611-4964-82d7-718a48c1b988", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394790, "uuid": "c2073b19-94e3-4dea-9642-0d759947c26e", "value": "6144:mkajLyaPIvW1TFpvzYNB1MyB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8X6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652394790, "uuid": "71d70e7f-354f-42d1-a7b9-0744e7f571cc", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652394790, "uuid": "fb20a6d0-9a80-49ec-adfd-cd19173043cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394790, "uuid": "a1b4375d-c690-4f9f-ae94-b6b3323871fa", "value": "wi4w9t3pbYGJjD6LoROgeypXqffyaAg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65c8811-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652379391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379391, "uuid": "6f0eef3f-24ce-46c4-a6f4-970b8af9f988", "comment": "Malware payload (SnakeKeylogger)", "value": "6e92e89b7dfd9bb77a5ebf8802fc0e3f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379391, "uuid": "97af83ce-eac2-4b1e-b388-e984ddee3032", "comment": "Malware payload (SnakeKeylogger)", "value": "0cc3fa2c72d0ee787cdc1e7b13d8a94be5d59e13f66a9da6d5262640e1e0066c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379391, "uuid": "bea85123-ada4-426a-a877-d84b389c0e9d", "comment": "Malware payload (SnakeKeylogger)", "value": "97b65c45da66f7f627de3d168513004fffe9d148", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379391, "uuid": "6c948c97-248a-4198-9ff2-8b32a371628c", "comment": "Malware payload (SnakeKeylogger)", "value": "def256013b69e28a2ff0efe13eeac4685a9ec048de7bfdfd74cf179f335a736c1122e6aa6b84b61202f7d290386e1243", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379391, "uuid": "f46c0a85-cacd-4da1-ba73-4a1e6bbb96b4", "value": "T1D133CF7BA2FED14AD6AF017D9907D12C91D6AD1C3643121A27CD3A4D3E36F0B8D460AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379391, "uuid": "9c6ec5b4-132a-4f77-a0ae-d1d1ba8cdbee", "value": "1536:9E/arfNfbhdq1eTEu+s9+Tu2q2iJOmwB0:9EmRbhlEfs9+Tu2q3JgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379391, "uuid": "f349a1a8-9908-4251-89e2-2ac2f05ccedf", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379391, "uuid": "3d6ae25d-55df-488b-8f85-17d8c720216b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379391, "uuid": "fd63f49a-7a1c-41f5-a7a5-40e1c04f88af", "value": "bank swiftcopy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60456a4-d242-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652394450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394450, "uuid": "cd1163a4-c41a-4616-bd07-6429f6c100f0", "comment": "Malware payload (Heodo)", "value": "19832bd964c5ebde26898498f106de87", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394450, "uuid": "6fbb9515-cce8-4667-922b-9ad50636b7fc", "comment": "Malware payload (Heodo)", "value": "0cf6efee60e47b186c29a2fdfdf46612af7f966045f93e0c675af8f34964ed26", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394450, "uuid": "afb6d478-bc12-46f6-b686-2ca68fe041ce", "comment": "Malware payload (Heodo)", "value": "5d14b60d4b4cf484816ff93050d4c2216d3f2a3e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394450, "uuid": "6cab4bd9-9983-40f9-8f41-2017a01816b2", "comment": "Malware payload (Heodo)", "value": "5659877775a98cdf9eb0851d9b9706494a9c42cde857f38661ed2b6fb33086bc548b4f69629ddf1de590b50760c57ae0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394450, "uuid": "e61f1775-13b5-4a38-8b27-653a68cfc393", "value": "T108E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394450, "uuid": "f2571dcc-2505-426a-85af-1bc2f6fda06e", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394450, "uuid": "4a20e520-afa7-4372-bbfa-1fcd6a5897e9", "value": "6144:mkajLyaPIvW1TFpvzYNB1MUB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN856nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652394450, "uuid": "0346bf84-77fd-45f4-bd6d-dd35f074ff8d", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652394450, "uuid": "56f03d0a-347f-4e64-ab08-7396a6705293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394450, "uuid": "51ef6dcd-2d59-4b60-8677-f3bb5db28d7d", "value": "19832bd964c5ebde26898498f106de87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50113f37-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652340592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340592, "uuid": "37c63483-bc52-468e-817c-a8f33f5eb910", "comment": "Malware payload (AgentTesla)", "value": "171c9b18ac0627bbb69d8656cbd376c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340592, "uuid": "b7453209-616f-4aac-a95c-8c2937607dfc", "comment": "Malware payload (AgentTesla)", "value": "0d1dd17e57d56ff97b51fdf5c77dd94eb107015d693a68d066e98fe9d5544b3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340592, "uuid": "5ab831fd-ebca-4b24-953c-d27ec36a94fe", "comment": "Malware payload (AgentTesla)", "value": "64161518d02462f9cf0f6d5b007bfe30dd6f5c43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340592, "uuid": "ac651448-2a5e-4dc1-8c4a-14e965c98b03", "comment": "Malware payload (AgentTesla)", "value": "63054383d44d3205b226b23feffb310229bd6fc8f8d9ded8c0d3b9e2af55a6cce9c087c6d1cead20d82cd4e004db3a5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340592, "uuid": "ea9be1c3-1c17-460e-9e12-709f73a8ca78", "value": "T183A401287ABC7F63E97D97F20120A60453F75A7AA272E7959FC2B0C71061F4485A1F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340592, "uuid": "519c9481-e43a-4c90-9986-eb27b333d374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340592, "uuid": "683b9d91-fc11-4b39-8403-aacd4c9560ca", "value": "12288:AAqSSSBsHOJ2RLzK2CvYpHOYN57lYctgMwoNW6:liH42RLLcYpbN5XgMwN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340592, "uuid": "3bc54243-a439-4651-9753-e53af938c720", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340592, "uuid": "3bae9a32-e2ce-410b-b25c-3db7a54ea31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340592, "uuid": "5b118205-9e9d-4dc0-9bda-60d56a50990e", "value": "171c9b18ac0627bbb69d8656cbd376c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7d6744-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363591, "uuid": "f18c6c6f-f964-46bf-ac1c-525fe75cc0c4", "comment": "Malware payload", "value": "f01c765569c171f9e0cbda3c53df4606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363591, "uuid": "ab7a9647-8125-4745-93f6-c51d5c8d3cd0", "comment": "Malware payload", "value": "0d398e91042bb9c460b9a7f4a65a2dc51b707dd65dcbc0f24ee00bf91a1f053f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363591, "uuid": "222748ec-1665-4455-a9d4-5bac1d57bf6d", "comment": "Malware payload", "value": "896c921375911ee0260dee771c5acbcd6a7861c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363591, "uuid": "1782da30-9a8d-4603-b23a-b50e1a5cfdf2", "comment": "Malware payload", "value": "4b4957e5c461f13fb787fee5027940291f1417be09ba1146f6d057c8031471c51772661bf981e20c63a36e38c3ba49e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363591, "uuid": "365c760b-4a7a-4007-bffe-42dde53f80a9", "value": "T143635C19B680C13BF9E9027F9DFA0598827CA9304BCE51F7B5850A9EC9162F712367C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363591, "uuid": "1dc989ed-d847-4e05-9f64-68e4bbfc1175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363591, "uuid": "c76d8422-9a26-459e-8bb8-b1db0bfa8467", "value": "1536:nUyUZPaOklHIAWvL+csPmuM/FhuQTT5t26i:UOWvL+cseuM/FhuQTTD26i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363591, "uuid": "4f050d27-f5d3-413a-8d47-7f29edaf1df9", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363591, "uuid": "8e36ebff-06ee-4ea3-bf81-8fd2f7d0c801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363591, "uuid": "717c6d36-cfc0-434d-9704-ed60b7dbaac4", "value": "0d398e91042bb9c460b9a7f4a65a2dc51b707dd65dcbc0f24ee00bf91a1f053f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02bb6fc-d230-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652386682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386682, "uuid": "402616e6-6cc5-4b12-a913-6bb89be42259", "comment": "Malware payload (AgentTesla)", "value": "2892ff1c5bc56ac460a98e3b9698c000", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386682, "uuid": "9225be4d-58d7-4732-ae53-349fcb8703de", "comment": "Malware payload (AgentTesla)", "value": "0da32b25f952af33d360d44dcac64bb94bbfe13149d13674f12acd4a94bbdc8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386682, "uuid": "deef0c11-f771-46de-8147-0bcba4a08a28", "comment": "Malware payload (AgentTesla)", "value": "91bfb3db3a07475fd4f455871d9bf3e8aff7be77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386682, "uuid": "c45863f3-eb4e-4545-beb3-e95b31d3b784", "comment": "Malware payload (AgentTesla)", "value": "114abd91ce683edb172a181e1ed4e7639c5b6c576684ba59b0139f217e08e8cd319aea50f3c94f02636b423c06e13b38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386682, "uuid": "6f13c98b-77cf-4da0-9fab-a835507a536b", "value": "T13A55CF20B75A8665D2EE363FD3C628441BF2A5D34A31DA097B9E63D118936835C1F32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386682, "uuid": "ae44fcba-6993-4b01-8489-9bc82f8101ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386682, "uuid": "8d6a0f82-e472-4db7-995f-ff7cb561b6ff", "value": "24576:CPnV9SVAXACzvT5TiotoTjVL3+vLkfG/YJC794TVFMvHb7AhiBwR9XM1RFhv0ocy:CPnV9SVAXACzvT5TiotoTjVL3oj79zFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652386682, "uuid": "38663269-8c5d-4f27-9e2e-4c0d185f5aad", "value": 1386904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652386682, "uuid": "86fc8bcb-e50f-4207-8fec-402d561a0224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386682, "uuid": "28ce9d18-7c99-46db-b16e-d90b65f397fe", "value": "Updatedcontract051222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a64403-d1f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652361913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361913, "uuid": "f51271fe-768b-404e-b926-bc48c0d34b38", "comment": "Malware payload (Mirai)", "value": "d920902203942817692b058332a7c063", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361913, "uuid": "f1ece3f4-b73c-4455-a0ae-c16f683f3d01", "comment": "Malware payload (Mirai)", "value": "0dca581c2064f869279c1b871c496bf1c6a26e52ddf7219b4c54ee22edbb608b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361913, "uuid": "0fab24d2-2be5-49b4-89f3-625c8eef87f1", "comment": "Malware payload (Mirai)", "value": "9a2728f987178b47497ba73ff6705328b58c327e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361913, "uuid": "59af34d0-864c-4866-8b2f-fbad55cf8945", "comment": "Malware payload (Mirai)", "value": "61af31f6bcc7c976e6add10bd365d2e14a601ff451ea2466c30044335082041df69d8fc2aab520f21be0c8ca1b6fdc59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361913, "uuid": "b8b286e7-c9eb-4553-a64c-449f057ecdbf", "value": "T1E863ADA8D078ED9CC66586B8F54485355B23E00862633DF7DA83C3A6406BEECF5057F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361913, "uuid": "0322a4f4-8669-4ab3-975c-efaa89c89426", "value": "1536:C/de+O0oGXaasT2CC1VFNO+XjsrzS02cfs3oGb2BbagqC8IiZ:CleSpXsC1VfO+6zS0Rf+NChagqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652361913, "uuid": "5a9c6b65-90f1-4f34-971e-b931e1158c49", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652361913, "uuid": "55d62c0b-d0b4-4a04-9936-5e0a159842a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361913, "uuid": "166caba3-28dc-4955-ba6c-14d8586f3b95", "value": "d920902203942817692b058332a7c063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29960d46-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652377464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377464, "uuid": "8b25288c-716a-4c54-a03e-bf512a72da59", "comment": "Malware payload", "value": "3c445a0d0e7d96ebfba730db72bc8e37", "object_relation": "md5", "Tag": [ { "name": "bluescreen", "colour": "#CB2BFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377464, "uuid": "a53dcd91-84cc-4c4f-ac9a-c5fce1d3b3ec", "comment": "Malware payload", "value": "0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07", "object_relation": "sha256", "Tag": [ { "name": "bluescreen", "colour": "#CB2BFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377464, "uuid": "088bb986-83c8-4a2f-9cda-830db922b68b", "comment": "Malware payload", "value": "063dc457d3a879769b118bde5e16816d58388912", "object_relation": "sha1", "Tag": [ { "name": "bluescreen", "colour": "#CB2BFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377464, "uuid": "2233d940-2af1-4ff4-9af8-d41d0cf32580", "comment": "Malware payload", "value": "772d962b922733604a81e2510964932768d443d2040f1c831e674294605b1aeb5c8e76ea5b7e0a61d97f4cf75d7ea89c", "object_relation": "sha3-384", "Tag": [ { "name": "bluescreen", "colour": "#CB2BFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377464, "uuid": "5da7c1d3-9e52-4ae8-a3e6-81f2bdd66084", "value": "T1CC763341B2A008B9E87B417D8817C639EA737C221316C65F17A9D7B73F532D2AE7E640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377464, "uuid": "525d2c0b-227c-4e9a-a995-d3048395f7b2", "value": "0bbecc8e9f9f17b0ea9cc3899b15e5cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377464, "uuid": "bde4d522-1a91-4e2e-a8ff-bd57dc6d79b8", "value": "196608:YmpFpsmvdsCncs4njQthsiHz8n27ki1Z+SwiAhAW/oBq:x3vaCncNnKhsx275Gj99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377464, "uuid": "21bac7f1-3da9-47c0-a8b4-1d8194f87809", "value": 7731386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377464, "uuid": "25d43f59-a723-46d1-bce2-cfdc54c85124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377464, "uuid": "e03673bb-e36c-40d5-aad4-fa1c5a26db3e", "value": "BlueScreen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5ff8d8-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340698, "uuid": "990b5d85-02b6-4110-b6b8-efa9600dde04", "comment": "Malware payload (Formbook)", "value": "1fb869590edefb871e165767e7a8750d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340698, "uuid": "259426e7-7e0b-4af9-9dec-2e430ba7a5c8", "comment": "Malware payload (Formbook)", "value": "0e1bf822663f3c819fa79746f35b364d8d1886a6dd406011eb8c79ff9a5edb03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340698, "uuid": "aa898791-e822-4258-93a7-786f328161bc", "comment": "Malware payload (Formbook)", "value": "6275e8fb1f562db051920b47258a4ac4f0da3dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340698, "uuid": "01544135-c81e-4523-bda7-b343f5b1aef5", "comment": "Malware payload (Formbook)", "value": "2f27c4d1c774a5a3068eb01a8380d6cedf12ed5f648430a7b9d658c1a746a0d3815bb9fc7018dc87ff68eec800e49b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340698, "uuid": "e169f30d-c584-49a6-b5a5-ac3f1cdbc311", "value": "T16AE4C04367C85625C3FE3A70E099553142F1EF8F4620964B48B57DEA3FFE283DA016A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340698, "uuid": "72504b35-0fa3-49ed-837e-536d00fde7b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340698, "uuid": "0a9b655f-b3bb-4593-b2ce-e0620e5f680e", "value": "12288:EKkRwmjQt+TPbV78kCucSM2IvdPcyF/9v69jZaPMC8Y:EKkRwmjQ4TPbzCucSLIv9co1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340698, "uuid": "3d6ea708-4e83-47c3-aebd-5baa37409523", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340698, "uuid": "7b8c0c91-d70f-4e1f-aac5-d63ad0cbff0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340698, "uuid": "00e89383-2b6e-4348-ac48-6fbfed2e9a70", "value": "1fb869590edefb871e165767e7a8750d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba05e542-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652340340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340340, "uuid": "838bb8c2-a394-4680-adcc-e0871568b9b2", "comment": "Malware payload (GuLoader)", "value": "955fe48af7a63e4e098b3f88531477b7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340340, "uuid": "1445b91d-6fdd-4af6-ae92-1992abb40db0", "comment": "Malware payload (GuLoader)", "value": "0e4fdbdc868bf7c19e4ce17d06be7958ad8e86248693e460a464c7c276ba1e76", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340340, "uuid": "05692dd5-cc66-4c8b-a5a2-14b21d6d6ad8", "comment": "Malware payload (GuLoader)", "value": "6ab3df8df732a99722df6b3839886776f7a1d470", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340340, "uuid": "0b14205c-d4bf-45ee-b6b3-5e27ee0b571b", "comment": "Malware payload (GuLoader)", "value": "cb0d8ccefd61c136eab4535946465bcc35cd3f93acaafd59885288dc32d7dc889b9c5d509ec5320fcaaa4f32e77b6a6e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340340, "uuid": "cae824e9-a078-4f25-b6d4-9887cb6c23ba", "value": "T15B3499A045B0DFC8C1F93AAFCB0D4620B3409D6AA2D7F59C5AA111BD7FC76D9431B2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340340, "uuid": "22b36f54-a6d6-46b5-8ae4-af3c114b3289", "value": "1536:PSMf9TVGlt9g9hfJKNp7cgS0rrdebjmnFaqiX1bm8SfvhRF5OBabgzVZzXwQHNL1:PddVEMpKNxdbdebCd648EvP8+gZJ4bM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340340, "uuid": "d02f6bb1-223f-4a62-822a-bbaadff66189", "value": 248819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340340, "uuid": "a4ad1687-74af-4551-8cd7-b3ed25878582", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340340, "uuid": "edc11cc2-2e63-4761-9424-47e0906d54aa", "value": "doc7338383737_73637364773.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54242f18-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652341887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341887, "uuid": "fcb032e1-5570-4bb3-a9f9-25320b25deec", "comment": "Malware payload (SnakeKeylogger)", "value": "a11dc78a76b77eba4ee7df3283780020", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341887, "uuid": "b07beac2-98cb-4b76-851a-fa040ccc241b", "comment": "Malware payload (SnakeKeylogger)", "value": "0f104d7e8fc50aeb1eda7580e404214021778ac7fb3ed586b3e0820b2dd3ff6d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341887, "uuid": "2feb55b2-771d-4d72-84ec-81547579f36d", "comment": "Malware payload (SnakeKeylogger)", "value": "6a42d8bc466504f8d27bed3198875d164c60854e", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341887, "uuid": "1547f0eb-0499-4fa9-96ef-2d412dfe0043", "comment": "Malware payload (SnakeKeylogger)", "value": "00fee66ffdbf2058dc00d297aecd45dcc1cdd6fc23d641ea70ed20d69bd3b03265b97652b8ecbfe8d0feaae953bb6e33", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341887, "uuid": "4ea39f6a-ab3f-4e60-b706-50b4195ae56a", "value": "T1F79423BE84077F6FA6CA7C97DC61A2B9E3BE24893D20154DC87907822DF150ED1AF056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341887, "uuid": "18ae452f-c271-48e3-bd3e-fd37b66f9b30", "value": "12288:JeIsJoxCp/5Uwj9s6Tqm2ETSm8u7+b+3LCzRL3fHjmpk:Jej/i2WBE+m8u86+lL33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341887, "uuid": "e43dce1c-6727-436b-98c9-43b4781d4180", "value": 443828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341887, "uuid": "c3f46dc4-0241-4950-b61f-c3bd5e55bb47", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341887, "uuid": "dddfebe0-9178-40c0-9105-a2269feac64a", "value": "Invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569cf7eb-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346186, "uuid": "cd7979a1-a7df-4d0d-acbe-35ed9358bf95", "comment": "Malware payload (Heodo)", "value": "479992a697c27b9bd4bab9e6f0824668", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346186, "uuid": "d5e19ea6-9550-4912-8d56-e9cf3081881c", "comment": "Malware payload (Heodo)", "value": "0fd88f07d5d55e219e798e6b558a4379e7577e63e3ede3cbfdc3e5a3558e28b1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346186, "uuid": "b4222b6f-ad35-4933-8921-4e0cd82f9c94", "comment": "Malware payload (Heodo)", "value": "c1347df7b91c056c5af91d84ece4c09e8685cda0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346186, "uuid": "437913d3-bcca-48f7-af69-52a7ff414290", "comment": "Malware payload (Heodo)", "value": "0e23e7eacc1d8d67e721491ed1b696c42575799afb54c9489db9a77e2a4f28ae397aea8c86b8e5676fe2d4eefac66db6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346186, "uuid": "09794f27-2216-4307-9b5a-60e1dd0d2064", "value": "T19FF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346186, "uuid": "97e23a47-4d50-4476-946f-1589380e99d2", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346186, "uuid": "37235dbe-02e7-4d13-8607-105d534c2c6f", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSgjNwgraKRT61cKGNx:S4DzZKnH4xRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346186, "uuid": "499ff758-1e3f-4322-8ef8-a402c67d51b7", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346186, "uuid": "765655dc-4b94-4f40-aa93-532f83179d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346186, "uuid": "cc252ca7-3061-489b-bd34-b9e9d59a2cdc", "value": "WTcaHJqZytr0HbJaZN2WQ70sTFcbxV0m1l.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45422f9b-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652337138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337138, "uuid": "2af7bfe7-8567-4753-9e39-e0b6eae97633", "comment": "Malware payload (AsyncRAT)", "value": "ea07b1dc3a5bcd33b8f80b041d2a0c10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337138, "uuid": "29e16615-6fed-492f-a259-a19bb3f371c0", "comment": "Malware payload (AsyncRAT)", "value": "0fe89ed6775aff2aeedde96f4851d85634f4fa801919a72cd5d6b99fd3375297", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337138, "uuid": "011e66e2-f4e2-4fbf-b62d-2af9f0e4a9c3", "comment": "Malware payload (AsyncRAT)", "value": "5b8dd1cbd4bc59d4b0b47d05fc44d581e79155c3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337138, "uuid": "78d23ee7-d003-4035-a2f2-34ba55ae2ad9", "comment": "Malware payload (AsyncRAT)", "value": "e31e08d6230672e49bb45d091bcefd81abf75ab6cdad5b23108c27e6ec89bacf29c93b8cee830ebcd320fde8494125bf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337138, "uuid": "f53618ed-5756-4c5d-b3c4-1df64e8ad6ee", "value": "T1D6F5020EBA445671C698373BC9EB2068A3F194CAE667C70B5ED8B6E81D33753DC0E458", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337138, "uuid": "034bc3f3-1a9d-4694-86f1-dd5c47a23558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337138, "uuid": "0ef485a7-03e9-4f81-be34-0d49e5f090a2", "value": "49152:+mPCALkZu6kOqP+kEpaPljiMQscAN5c591hFht+hbfCIPZOz5/RiI2VqMkjn:+mRLH6Y+kzV7idrFh8hbfk4Vwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337138, "uuid": "2b6952fd-807d-43f3-a15a-2ed45206393c", "value": 3640832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337138, "uuid": "d2f8d98a-610d-4356-8664-052f6edceecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337138, "uuid": "29522907-1214-4f0c-beaf-888d4139d351", "value": "0FE89ED6775AFF2AEEDDE96F4851D85634F4FA801919A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fb0d5b-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652344685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344685, "uuid": "095516b0-8ac1-45f6-a697-97e1cd3f9f1d", "comment": "Malware payload (Heodo)", "value": "076ae848f5f64473fec103a0f7045432", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344685, "uuid": "cc046412-0a7a-4980-9cae-3e531e34fe3a", "comment": "Malware payload (Heodo)", "value": "10421e3584318bb52d7b6b34e735939488c3e35c34a2c3e7d939f7a2f4fe960b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344685, "uuid": "00f004c8-e530-4be3-ac5f-8608d869d37c", "comment": "Malware payload (Heodo)", "value": "4fa7474cbfc146cb60276c7041cc2a0a27367b7e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344685, "uuid": "4eb5d3cc-5a53-41a8-9dd5-d205f299fbaa", "comment": "Malware payload (Heodo)", "value": "7ce0e1d1e07bd70f324c4148fb310ffe3be9182821ca14dbf8113eec564298a379c3ce45eda0c277eb97e0658586991b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344685, "uuid": "3bc12622-6786-4eed-b3ff-2fedd248f526", "value": "T19303834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344685, "uuid": "7e61e486-3a9d-4aeb-9e18-cb978a228aca", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344685, "uuid": "ea79bff4-a631-4342-8e85-35011dd13810", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344685, "uuid": "f74e387a-6684-45c7-af23-85e1e46b64e5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344685, "uuid": "d520d395-10de-4148-b186-e0a2059b6669", "value": "Rechnungs-Details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e90754-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1652340575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340575, "uuid": "e1422077-df42-4f66-9f04-886d9681df7a", "comment": "Malware payload (BlackGuard)", "value": "686b51a114701f6f3b2ec7b377a48d19", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340575, "uuid": "366a8d66-ec1b-4a72-8674-2a5f56652c1d", "comment": "Malware payload (BlackGuard)", "value": "105ecd45e6c8b9adb5d43daecba8d62244683b48964499d29f88899e00c5ca7e", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340575, "uuid": "431bf9b4-f5cd-4a8d-a25c-6d5cf3d09627", "comment": "Malware payload (BlackGuard)", "value": "8ac414e746294cda1b52669bac5530ee6fc7d87d", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340575, "uuid": "3566cf69-f638-4f1a-9f46-6c5bd2738576", "comment": "Malware payload (BlackGuard)", "value": "0b9d74f8167ce9b169a25aadb5058163924046b9e6fd5d1fe4eba6fac231cc7d014974e43fcfe6660991dcc6a679a129", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340575, "uuid": "db3790bf-f82b-429d-805a-0fc1d83a6c9f", "value": "T1ADB523243BD81524D7BFDF70E8F0A4980AB96357BC16D79D0A8160CE1D62706EA93B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340575, "uuid": "0c983a8f-afa5-4db7-96c0-563494204557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340575, "uuid": "89224eff-b380-4d73-92e8-a16cc46c0082", "value": "49152:V30T+Sk6BU7HIFPLH+tkWJ0/lw+W7SCFHT9kly8Pv6UcN:V30T+Srp1HgkWJ0/2rz38X6Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340575, "uuid": "4a6b2bc6-e73e-4f4a-b920-b358ab579fb8", "value": 2398208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340575, "uuid": "754d02f4-80c3-492b-aa34-f37999c48ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340575, "uuid": "c81a67a1-8a9e-45f1-aede-7c516b192a09", "value": "686b51a114701f6f3b2ec7b377a48d19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2b0c91-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652374172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374172, "uuid": "22471169-d7f4-4393-9d7c-b380d2941ba6", "comment": "Malware payload (AveMariaRAT)", "value": "8b7c54f1404c7a809f36480a4eef34b7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374172, "uuid": "116cc4ba-ba72-4cfa-bf31-1f431dbd27a8", "comment": "Malware payload (AveMariaRAT)", "value": "10782303485dee4f558b21984dc9af1beca7537c4666d17756a179b7f152c432", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374172, "uuid": "28c22c49-65c0-41de-bfe2-c9eb4aa28806", "comment": "Malware payload (AveMariaRAT)", "value": "d9923abae69904383cbb17e24efde17163697422", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374172, "uuid": "5c30401e-d7c4-43ba-9055-a9fc3b3bb517", "comment": "Malware payload (AveMariaRAT)", "value": "b7c862bda101c81fb03b0b63ea4d03cdcfc27e06eec7a1cec0a01995507cb0178c14c46002f8885ae1a4d2f9d5fefb94", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374172, "uuid": "dab8598f-8c54-4579-8bdc-464c991a6f79", "value": "T14D429FD4EA39E82CC52B813A825F85D8E56D00D29341284E7948BB3F76D67AD034F7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374172, "uuid": "0be6526e-edab-446b-bbce-b4a9fcdb954a", "value": "192:q8L3JBhaFUlbVvevUqzQXpS0g+ndQcF6dCpta3RfADI19Db/xyKPafl:q87OUlM9z6pvNF6dJ3RfoI1BrZaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374172, "uuid": "dcf0347a-8cc8-4b8f-80b6-ea01faaf69a6", "value": 12979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374172, "uuid": "1ee352c5-f246-4c13-8cab-6165b782de99", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374172, "uuid": "d5405aa7-08b8-43d5-88c9-cbd12d1fac75", "value": "SecuriteInfo.com.Heur.906.30135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c9ed58-d1b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652335442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335442, "uuid": "f51c5aa7-f59e-48dc-8860-42c5bcee2abd", "comment": "Malware payload", "value": "a80820fd8a5b7df83af829fa0c9f1446", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335442, "uuid": "f7f99a28-174e-41f0-b531-414bc18e6935", "comment": "Malware payload", "value": "109465a5f8aa3c322d7d63922acb1cbd66579840c9053e2bc641f9c26b439bb3", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335442, "uuid": "6e9f757b-9b59-4666-9358-42180262a6d0", "comment": "Malware payload", "value": "27988e1dc80bdf34b77196c2499410391e2ecd61", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335442, "uuid": "f68ca1f4-cd0c-4812-9d89-061ec6ca05cb", "comment": "Malware payload", "value": "c4fedacafa6db52a38ec3f07f9b6177d896ad7e94f7230ec6ceaa47a422af045d12a3fc2efadf39efa93e97a82d2394d", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335442, "uuid": "eaad1892-8b01-48c4-a4d5-87ca219ed5ba", "value": "T169A3B4D224B6F691FA40C1B9563EC6A7F573AD783501D028E059FE092EB156DA3F20F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335442, "uuid": "1e2b31ab-213d-4733-abb6-5b7e8bc4b60b", "value": "1536:l47+sNatoyfzn7pQek06N+Ct0n3sLti80DU0DB7fx:C7dNatRD7Pk0PCt0n3sLt0Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652335442, "uuid": "84fb0864-936f-4d4b-8a6f-c1f57b79292a", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652335442, "uuid": "5d7292a9-f904-4ad7-b4b0-0f864fa84c82", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335442, "uuid": "b78a35cc-9ecb-4550-a1ae-38032a37cdc1", "value": "Win10-11_System_Upgrade_Software 2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99bdae9-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338621, "uuid": "1fbb2a1b-b6d3-4db9-a596-240b9b691afc", "comment": "Malware payload (Formbook)", "value": "cd83024df0271466899a41ff2591bc5d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338621, "uuid": "7b6b195c-2537-4a27-8596-82962062c556", "comment": "Malware payload (Formbook)", "value": "112a4c4f8c5807a0abe6ff27988981e6383e45454b8abdca13d8cca47234752e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338621, "uuid": "e1eb52bf-e940-40f0-8048-998955c71f82", "comment": "Malware payload (Formbook)", "value": "1ecae3d08e1a27ad30f98c955be97a9fc2f376f9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338621, "uuid": "a57c17c4-36eb-4143-b7fc-ea6ce8fc47a6", "comment": "Malware payload (Formbook)", "value": "278202e29ec104da7cd018f9f53aabdf9079691185bc1422a0876553f44b7c922b09da3fc028fe1711653c6b19aac905", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338621, "uuid": "775dc8e6-cec3-49e5-9243-23210e245e4a", "value": "T13804028DF721E8D9D6DBA67C16A1F2D0F716DCE44762783971A03B467730220F068E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338621, "uuid": "2be14901-503b-49a5-b88e-65e2d59fd834", "value": "3072:UkcngvvxNwrudM7CeM70eCxIVczOjuiGXGD5kHyYDE+BLyN3R3:RGgnxNj27CeMQewIVcCA21kH3LBLcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338621, "uuid": "74670c47-0d6a-45e1-bb63-068613a7b1e6", "value": 187832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338621, "uuid": "2c6868a2-4ea2-44a6-8f57-9c5f4d0876cc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338621, "uuid": "cb78bfbe-a6c3-4cb0-b7da-557ec874d464", "value": "Statement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa58185-d1fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365099, "uuid": "bf5da648-86cf-43ad-9a43-f6896ef12fe0", "comment": "Malware payload (Mirai)", "value": "69dd5985b46ce2c4373fbf4ee6ec9bc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365099, "uuid": "558a2202-746c-48b1-8325-d6a28c16be31", "comment": "Malware payload (Mirai)", "value": "1148b2c145912c15533ed457ace80b6a3e921923adafc55b36a23f8e4b23e49b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365099, "uuid": "b016b8b5-c7a5-4fed-8cd2-7575f053a2ae", "comment": "Malware payload (Mirai)", "value": "146ed6b71d465ffdefb7667678ee682fc53aac52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365099, "uuid": "afdd9eef-cd8d-45be-9094-e4783163230c", "comment": "Malware payload (Mirai)", "value": "087f91d6b11a1a88a7dbd81adf6aadd3d7ee234cdd8aa49efe08cf66bc1846eb520819e86943a52183dd17ddaa568f42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365099, "uuid": "febfc137-ac0a-4748-9695-53d963cb3866", "value": "T1BDE2E1359E0718E9C6F650FD65900FD038B00FF58A52A6CFAA49D8739F814BD7C813AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365099, "uuid": "75f7ffb3-bba9-41ed-b796-771bcde51d77", "value": "768:BxW9fiewQbqt8tXUPn9xanQ6sPzMyM9MiOzJgGlzDpbuR1J+:Bo9fieV+9z6ATi6VJuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365099, "uuid": "b97251df-cdde-41d0-a643-2bee26bc6950", "value": 31308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365099, "uuid": "9cdfee8a-c70e-4633-a1e7-d986833aabaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365099, "uuid": "2c450000-0cb8-4aa2-932a-7480e7e374cc", "value": "69dd5985b46ce2c4373fbf4ee6ec9bc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97c094b-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652337762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337762, "uuid": "44d9a930-2ec1-4f82-8f91-46d2874c5e98", "comment": "Malware payload (Formbook)", "value": "5db83f201cbba31da05401c74fe4aa9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337762, "uuid": "d8eb2d79-1b43-42bc-b2ab-a73b925b4df6", "comment": "Malware payload (Formbook)", "value": "11a7ff5bbc61ffdf2bf726710f6d091b8724027e1bf3ca6b8e42a3d337cd0f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337762, "uuid": "330b9234-42dc-4921-92b9-e38e04277a5c", "comment": "Malware payload (Formbook)", "value": "8e925b6b51aebc7fba6d2a0eadf573490ffdc71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337762, "uuid": "75f28988-2bbb-43c9-973d-0f9e61bcde20", "comment": "Malware payload (Formbook)", "value": "0ab970b742cfac852248d00dc1a5bf533faa07cbe8b3ef8ee1e469216dd6817726ccc7982d67343cc6ad3e7d6f30bb01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337762, "uuid": "9f85a568-9858-41b6-a4ea-13e863066ed3", "value": "T13D4412543799E0B3FDE08B324D739D7679FAC66601EA928B47207A897C227416D0FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337762, "uuid": "b25db8ad-a35b-462f-ae7c-f906297ae3b1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337762, "uuid": "672f9bdd-87f6-4d4b-8790-d9fe11886139", "value": "3072:LODZGPEounb5DQpZsJ/iK7DoXD/R+tRV2XelueJPUdTkT17MjoYnJbvTiDdPDtI:LOtIO5kalMF+zVSegIPe+7IrTCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337762, "uuid": "9d02b3b9-4f5c-4d36-a1f2-613d13a9db1c", "value": 258527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337762, "uuid": "e5ab8012-44d1-492b-9eba-a4e31d645f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337762, "uuid": "57604b54-e99c-431d-8513-0e708ef61048", "value": "CTM ARRANGEMENT$43,000_MV SONIC STAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911b263a-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652349291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349291, "uuid": "79df2937-e8e8-4fb3-9ffa-05b1f1b71ae4", "comment": "Malware payload (Mirai)", "value": "a1dc95e33dbac24e3814460897b61589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349291, "uuid": "9f1296a6-6b4c-44e4-b5b9-8fef56d8b73a", "comment": "Malware payload (Mirai)", "value": "11b73397473aa2786d4f1e0a556f557cfe2729b194a3e64d38e245428198be56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349291, "uuid": "8d7d8369-2939-4f75-b5a3-1ba3345ea4f6", "comment": "Malware payload (Mirai)", "value": "abfb7d2542a812b9c0dbaa0c12219b76bb3d25ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349291, "uuid": "5206ced6-113d-4f43-92aa-5401607c1a21", "comment": "Malware payload (Mirai)", "value": "b4a062b88ecf8c6914c7c3f1167fd7dcec060932945e86d484a9d605284b4818340397af2307ff1f899e1befd3d474a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349291, "uuid": "ed0f4358-cc0a-455a-9702-502716f18788", "value": "T171A3AE70D495ADE1C090023065F1EE785B63EAC4A1132EB66B9085E7244BEE5F60EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349291, "uuid": "26630de2-1017-4a87-a360-41d9fb8fb351", "value": "1536:ra5QQeASgKQ2D8uYupkeLMVsnA9/kygrC9+kOW3o2yPWuCLxaXna10:rASgKaupkeLMVsAm45OWYFPWusj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349291, "uuid": "a02f69fa-45fb-4cd2-85c9-9b3f672d275b", "value": 101012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349291, "uuid": "cfc20151-d2c7-49d3-b944-67c16fa2ca26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349291, "uuid": "193699c6-5cce-4861-bd86-acf378746233", "value": "a1dc95e33dbac24e3814460897b61589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d35be7-d21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652376976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376976, "uuid": "02b82939-84ac-40f7-94e8-f710b71d76c8", "comment": "Malware payload (Gafgyt)", "value": "43107749e41f07a96411f0bbdcd06721", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376976, "uuid": "79206e11-6fcf-488b-a549-1cdef6446727", "comment": "Malware payload (Gafgyt)", "value": "1258b15de382b3fc511da5b1d45672814eda99fa4ad68c674c0c0cd81fa179b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376976, "uuid": "d882eae2-28c7-4efe-bfc8-6bb063544c63", "comment": "Malware payload (Gafgyt)", "value": "a2909552b84adc70526107da22f0059ce04d1a0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376976, "uuid": "016d3074-1deb-4a80-8bbf-200e0409cf34", "comment": "Malware payload (Gafgyt)", "value": "e994dc9926de04e38940a9e2d4010f375fa5cf6ed4cb2867de265f30fc52663cdf366923c040200135f2ede2171d6fd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376976, "uuid": "cdc4fe67-f441-4e0b-afe5-7aa14cf7663c", "value": "T1CD933C86F643CAB3C8430772125BAB6A4931B6FA0A2A9F46F31D7CF06B134C53516F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376976, "uuid": "a02babdc-98fc-4a81-880e-bf2f2a37c94c", "value": "1536:nbPxzpWd/trpLHKaw8dYuzmKYWxkTvJ51Om1+cVOz+sEcfW7k:dzpW1XjKawEYOFmTMm0cVOz+XcfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376976, "uuid": "df84cf25-79b5-4f16-90d1-955d750fb119", "value": 89198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376976, "uuid": "538b00c0-e731-43b9-8cd0-8f1c99ed04b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376976, "uuid": "da4b574b-fdda-4b6e-a173-745abc573422", "value": "43107749e41f07a96411f0bbdcd06721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73cd986-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652379393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379393, "uuid": "631a2a0f-6923-4090-81f8-6830224e28b3", "comment": "Malware payload (Loki)", "value": "4672483774aeda8f1cc4485f1e4556ff", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379393, "uuid": "dbcf1c3d-6271-4da4-9e20-64d5ff706a3a", "comment": "Malware payload (Loki)", "value": "127ab9bd42596cd40ccbbaf0dd7bd3379a6f520adf883b3ac83bda1d19c8cacd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379393, "uuid": "924374bb-df31-48ea-8e88-4cfde61dca13", "comment": "Malware payload (Loki)", "value": "99f955b5cabcc8d7592103d1b5b60520fe60b2fb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379393, "uuid": "1c900d2d-549e-4545-ad88-67302a8c331d", "comment": "Malware payload (Loki)", "value": "9d69aa2f90beb273259cba672f8c07cf6666048d429a6a7ab568ca7509a626c449dec04a0e7490f67ef77ee28fdfe30c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379393, "uuid": "bd641d58-da82-42d9-82ef-499bd9b16bb6", "value": "T1AF04029563FA6334C8042DB88D65917E5C36FCAD8FDAAD0BA1F3747008B1D33A865B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379393, "uuid": "834df5bb-bc5e-4941-a561-7b1ea1f25e2f", "value": "3072:HQ7aaNoTYWNHDq2rsF9HfQQefVfv9QB/P7z7ay2z5+9F9OJF3CTkJNIHh9a:w2coTYIRszzofvalP7zoeFyUuNIBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379393, "uuid": "6a8ca3ec-d77f-4365-a51a-ac409aaeab09", "value": 188184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379393, "uuid": "8ba28148-f147-4e36-8619-c24f4759bb73", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379393, "uuid": "3a38890c-6386-4497-8ff2-612aed28f4ef", "value": "Paymentnotification115.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51432a9-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338641, "uuid": "8a7c5911-09aa-47e5-abe2-081d8d188c15", "comment": "Malware payload", "value": "86a3c61812a6d22d23feae99a344593d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338641, "uuid": "ac18de32-284c-41e5-857b-2a8930336e12", "comment": "Malware payload", "value": "135f3dd6231ea8364497ffcf4c73e1478e7f52fbe04ede699f7195bbbfea688d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338641, "uuid": "24e44b26-57c0-4d59-a8d4-2c1a0f4ec1b6", "comment": "Malware payload", "value": "def01f88a7dbb59095d6120e5fdc24b030d70e41", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338641, "uuid": "71884dda-f9c6-4774-a77f-821e4cebe7bc", "comment": "Malware payload", "value": "545cbbd5163f6fc5e9fc9d80d69b6235082376ad0437af7c35cc35448f31b85385846cfbeeafbd0e667416631dca8aec", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338641, "uuid": "72259924-90dd-46df-bb4c-27a4f96ba265", "value": "T15892F5F516F0AD48F3D32EB1EE076620CB27ECED9C8689AE2095BB290131541F4216F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338641, "uuid": "da572179-3cbd-4b1e-928d-3e9a4cf638b6", "value": "384:PXSX3dZ5E6CDS+qFY2LjnL00+mMpNR3lz9pdd:PidP+cXFSlztd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338641, "uuid": "3f6b8be3-2e76-4bb4-9e1a-ca4a713d2636", "value": 21048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338641, "uuid": "e7f717fb-52be-427a-aee9-8919a7546e4f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338641, "uuid": "273165ac-cbc6-4f55-aae9-e21d9ebc0d13", "value": "Invoice-Transfer Details 12052022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857ca438-d237-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652389644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652389644, "uuid": "668600fc-cb79-494e-8c34-45d7504726cd", "comment": "Malware payload (DCRat)", "value": "00e5bdfc36fa226cba667b59b3da1308", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652389644, "uuid": "0b47d3fe-48b0-444f-9e66-add6b8499553", "comment": "Malware payload (DCRat)", "value": "13c1a977b6222b4dd4f5fe84c6417c7027b92e1a2221fb9ced1942e576df2651", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652389644, "uuid": "45a4c680-be1e-4c76-8e75-15534b83672c", "comment": "Malware payload (DCRat)", "value": "820cae355126baa6e0dc37fb688c5f65665588b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652389644, "uuid": "9fc5d525-d757-4a47-875b-1a42adfbbb1c", "comment": "Malware payload (DCRat)", "value": "d6e1ba6d7e1fc2129f7a42fa6471d273a3a3c76523bae03bbbac3cb0198661a7dada34fbf484d58833b4221594437d5f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652389644, "uuid": "13a0f9c5-3fc1-4f7d-938b-2b6787ea0b7c", "value": "T14EF485342EEA5129F177AF7D9AE07596DA2EB6A33707994D00B102C60723B42DDD063F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652389644, "uuid": "1975a9ae-07a6-4f66-a440-47b5a28674c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652389644, "uuid": "9d627a8c-587d-4754-bd90-ce7f0fd15a94", "value": "12288:blaiYdrewdcGb7FlHniJRG6klNXV4SgiudBDUjmTVKJa5xii:blapZeyLCJRtulWizXEqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652389644, "uuid": "746d5822-f1c7-4902-a656-ca921204b43a", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652389644, "uuid": "0f0c64aa-f775-4ca4-acee-2b65f0b55264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652389644, "uuid": "0fd63045-4cb9-46d6-a5fd-c741bc279637", "value": "00e5bdfc36fa226cba667b59b3da1308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6ba0ae-d248-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652396852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396852, "uuid": "dac8f448-8c82-49da-9628-6282072ae6b5", "comment": "Malware payload", "value": "69ce4966a9b9e4bfce967b14afd469ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396852, "uuid": "9a5b6821-e625-44d3-be0d-cfb1f01901db", "comment": "Malware payload", "value": "1438520fcb0ba0834909a77cd92ae1eb2d85eb3f06825f1efefb3fc846c8362d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396852, "uuid": "70698ad3-4938-4308-babb-6ca4eb382fb2", "comment": "Malware payload", "value": "74ce6285b7fba6237a23cbd636d2b76bddbdc20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396852, "uuid": "4a13c140-b08c-4ef2-bb4b-aa107b5db214", "comment": "Malware payload", "value": "11678b7427103439a9677c95096d12e42e9069c593883c5cb3e80db60751721858be8a898ff02c72e81b9dc641523d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396852, "uuid": "eec0b850-031a-4407-9516-227ef6c8aab5", "value": "T107E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396852, "uuid": "dee0d393-0bc3-4a52-b8d9-41c8aa264d1a", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396852, "uuid": "1fdcfb7c-a921-4f23-af2f-4feffc3392a9", "value": "6144:mkajLyaPIvW1TFpvzYNB1M2B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8P6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652396852, "uuid": "43db16c7-e662-4299-b159-08be191c32ae", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652396852, "uuid": "18fb71ad-07ac-4457-b510-f3cd1cb2b54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396852, "uuid": "5f4f263d-babc-4842-b950-d42773cd1c5a", "value": "69ce4966a9b9e4bfce967b14afd469ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c1255a-d21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652376968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376968, "uuid": "08f3e7f4-d6bf-4be0-a434-82579749e7a0", "comment": "Malware payload (Gafgyt)", "value": "ef709a40b2cbfc773d4e5f67f087b10d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376968, "uuid": "b5291545-9138-4462-9a52-066f706f25cb", "comment": "Malware payload (Gafgyt)", "value": "1497a5cd15bf3b0e1ac52a3c26aaf32d406ce2b16cd65cfa9bdb29e2f5bcf931", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376968, "uuid": "a4c20af8-572a-4374-85c9-5d7f75658b2f", "comment": "Malware payload (Gafgyt)", "value": "9d6e92664aa7143b17edc7822fd8488119945302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376968, "uuid": "25d0a7ca-70ce-4749-98dd-753ede19da23", "comment": "Malware payload (Gafgyt)", "value": "bad0ca4895e39a050e1aab48b874c7396ea47500fae48cf5938f13ea7460001d62285d91d384e7b277867406150ebe86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376968, "uuid": "569bd7e1-19ce-42b6-845c-6e48289f7e0f", "value": "T192D3953E7E12BFBEE6A8823107F65F70879521D237A19381E16CD6181EB128D1C9FB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376968, "uuid": "0dcaf7ba-d787-46d0-bde7-3b9b43ea29dc", "value": "3072:kSOY/Px9CkEZ/Px9CkE1QpOZ/oOU3Iz1aktK8fN6BfDdRo7REzT/Z97z0LZrmW+F:IG7RC/vf0drmW+eFB1Dy1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376968, "uuid": "49f6fbec-e33a-4b80-9244-f3355580ed19", "value": 133624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376968, "uuid": "58ebd2a4-8506-469d-a54a-23c2fadb3baa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376968, "uuid": "2d546202-b75b-4b12-a0d6-d84197acb649", "value": "ef709a40b2cbfc773d4e5f67f087b10d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aedc031-d214-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652374621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374621, "uuid": "4440e816-ec77-48d1-87a6-9464858e9562", "comment": "Malware payload (Mirai)", "value": "82a444d8380900945d18941110e06fc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374621, "uuid": "f218f82f-17d3-445f-9e73-22321c8960f8", "comment": "Malware payload (Mirai)", "value": "154478a38586822ae0ba4352b7bec59676bf787e220dff602be699fdd4100712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374621, "uuid": "74a69932-9534-433c-99d8-d60ffec7b75a", "comment": "Malware payload (Mirai)", "value": "4309207a7b66f0695c9e63269eaf9c06aa0decaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374621, "uuid": "c6b8471b-6f07-46ec-bbe8-93fefe68621c", "comment": "Malware payload (Mirai)", "value": "155ba0bd24321617e2883d4ced9c1dd48576e42f9aaeb8e89875d7c8261a0e30d8d5580d4a4588463a8f68351aa6ae4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374621, "uuid": "df5c2af6-3ea8-4806-8297-3a88c3e23791", "value": "T1AE92D152418D9C20D87089359FADCD82A14A53FCF9EA2D223F6C5778EA56107EBFD0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374621, "uuid": "0ff70e70-8cf0-401d-a001-9218508437d9", "value": "384:5QbJx4urkhTMifTUS0UF/H4pF7vtJIMxG5qZXJP83oSEhymdGUop5hu7G:E4ueIyF/YvbxG5q1J4Es3UozM7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374621, "uuid": "fa0fcfc0-1f3c-4c4a-9cfe-d31efb2c642a", "value": 21032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374621, "uuid": "71eed165-2c72-4944-8124-5183bc05159b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374621, "uuid": "47f087eb-f3ba-48ec-a034-2c8950399f35", "value": "82a444d8380900945d18941110e06fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad57eb4b-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652379403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379403, "uuid": "965efbd4-65ca-4aae-a9b7-0ec57e259051", "comment": "Malware payload (Formbook)", "value": "ba9f9a4431109cf3e1a8e123057787b2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379403, "uuid": "4a37a0d8-50b2-4624-a087-ced321bbe36d", "comment": "Malware payload (Formbook)", "value": "155586b39b78202120e1cdb196b2f339e887a68ded8d9409d8b8037dd12ae739", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379403, "uuid": "b972167f-7bc3-4eb7-88bb-baf009f05681", "comment": "Malware payload (Formbook)", "value": "d5d4a0e54edae169e847c47dd5cd7ec32d0006e8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379403, "uuid": "589f94a4-74d5-46de-8710-c36fd86f2f31", "comment": "Malware payload (Formbook)", "value": "b976418a1394265c1426ce64f7090654592fec4bf2900e2e446393033c2fd13e2c8bffd038bce453d8434b69f663c9ed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379403, "uuid": "b1f662a4-7f4b-43e6-ae8f-2e21c19e74d3", "value": "T1FC041237B6700D73DF978EBD3956EB73A225DD41A54A4604BA09768AF0B0B612C22F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379403, "uuid": "c68b6ad5-a5ea-4d2a-b44f-ea113753689e", "value": "3072:AwZrARrfQjbmdGkFbIuesx6af1Y55JWxiLFBcR450KJqFttohoOqMcHAI72Dm5j:0pIjkfxFY5midJqTWhdbm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379403, "uuid": "142ed5c5-b29c-405f-83e5-bc0b425d1f13", "value": 188344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379403, "uuid": "d22cccba-c259-4809-8779-048230e357ab", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379403, "uuid": "89a35947-b6a1-49be-9ecd-ab0cd0ec8c88", "value": "New order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46954ab-d20f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652372624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372624, "uuid": "8f9f14c9-27d7-4fef-95b3-08124c7d3052", "comment": "Malware payload (AgentTesla)", "value": "3541d73fe9136eb5744422dda5c718ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372624, "uuid": "84be032f-5b1a-4ae7-b295-670b5863a3d6", "comment": "Malware payload (AgentTesla)", "value": "158185cef899d67faabf1e968de02b3a8cbd0446c0fdf0e3579cb4533dd3768d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372624, "uuid": "0588f10f-6507-415e-bc1c-797ccc06fbe2", "comment": "Malware payload (AgentTesla)", "value": "f8012209e404973a2f75b3e64634075dc7380d30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372624, "uuid": "9652d348-7e82-442c-a055-08b76d8f3880", "comment": "Malware payload (AgentTesla)", "value": "4bc03d3d4b29add7621c6d5e9753d8d53d54ed9ece4f9f4c91d3b6f5faf4859498e808aab7638c42ab4cfb47ce6a2e91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372624, "uuid": "af18725f-e847-43d7-8756-9b1b57247875", "value": "T105C4121D33AC1B22C8B94BFD61B2301A03F5616B6161FF6D4CD220DABA56F554B04EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372624, "uuid": "3b81d6bb-75bb-4f0c-920f-c9d21cb9cbc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372624, "uuid": "72c25ccd-1243-4ad9-b3ce-7b28e77c2d1b", "value": "12288:1mg3qJvF+pXaHprT3sSNbNBTMHF4HnMh7ai6:Q/9FwXaHLbfYiHnMh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652372624, "uuid": "aa02a2c1-3d3d-4742-9583-6fa8b05a38e3", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652372624, "uuid": "0bbf2994-dd32-4889-8883-9ab922b09ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372624, "uuid": "1de5ec4f-c55b-4044-b001-8d4a04f5d514", "value": "New Orders Drwaings and Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33daea4c-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330237, "uuid": "dd96d9ea-8df5-42b2-9b41-412585fa2910", "comment": "Malware payload (Mirai)", "value": "39836b3fd85ea38063ad43688000b82e", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330237, "uuid": "0f038315-8279-4f48-bbf9-199e40667e5a", "comment": "Malware payload (Mirai)", "value": "15d29ecafd715e65fb413f84a25f4ff3f8e01f81d473283be2880fe8151baa7c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330237, "uuid": "950324f2-2e0f-4721-aee7-162dae7835f0", "comment": "Malware payload (Mirai)", "value": "9f70afdfc8bc4f84efbafc24c51f94bc9c1d5b18", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330237, "uuid": "b90c4640-2394-43da-b07d-8071314a92e8", "comment": "Malware payload (Mirai)", "value": "d461ad36c67e8d2b814613d2900ac536aa611d41acf0ea2a1fd98d9ce841b2b109083caab3027d8428831d78ab431913", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330237, "uuid": "82f79cba-ff1d-44a7-a4b6-4ca4cc7f545f", "value": "T1C2938DC2CA83E8B2D93311B21263EF65DA72D4712061E407EF7C1B71D966640EF563AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330237, "uuid": "e60eeda8-c019-4275-8ed6-39ffd8e2e8a4", "value": "1536:s7uoki/5ZK1zINXY/wLb1c9BetLo7uZP2zMfV38WCIMt2x1EsUEptZ:l/sXi6b1c9oLo7uZOI/tMt2x1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330237, "uuid": "657c5513-7f91-48a5-bbea-3dabb7a0f99d", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330237, "uuid": "5b6f9923-2311-4b27-980f-addb0b4297bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330237, "uuid": "0dab0c14-ece4-4a36-a523-abb3a47972e0", "value": "enemyboti686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab7fa42-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330248, "uuid": "7f3e4ac9-5547-4dfa-b111-47fbe765bfb2", "comment": "Malware payload (Mirai)", "value": "cb28ac788377ee8a24f26617c51be873", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330248, "uuid": "c9aa70c5-2736-48ea-a3e7-ca2354abc01a", "comment": "Malware payload (Mirai)", "value": "15d55f6e0706f6caf5c77f4d98eeefc0867a5260476b5c43172e9d049e25e69a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330248, "uuid": "dc92d1fe-5ea0-4f5d-874f-ad8b7c078062", "comment": "Malware payload (Mirai)", "value": "d49feb714f353c300a04e0a2e8ca0a8164453a1c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330248, "uuid": "3bb609b9-6878-4ca5-8904-25fcbfb24b5e", "comment": "Malware payload (Mirai)", "value": "25dde715aa2764fdf9687d5f63f81d12c55aefd560eabd36b27c02fd55f61e0cbe904617ca99c5d180ab7414552355ee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330248, "uuid": "2259586c-c01d-4b58-93f4-562211fece75", "value": "T10FC36D36B672192BC5D1A57A61F34730F2F2874A24B8C61E3E610E8DBF6424036677F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330248, "uuid": "85f25619-82fe-4cc3-8c3a-e188835bddce", "value": "1536:EJndbQ49MNllurfbLx5SgM9wDuKw5tF/Nmo+Z5KXX2trUdNKDWO:cnGmIlluH39M9VLXYoQKxmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330248, "uuid": "d4a693e9-6a38-4eae-b900-7f39fbe09602", "value": 118344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330248, "uuid": "1fe2d997-21c8-46eb-97bc-50477b0cf1bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330248, "uuid": "b3f07933-9dba-43a2-8745-7fdcda79755b", "value": "enemybotspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d95f2c4-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652337098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337098, "uuid": "4e975ef6-ac71-48c0-acc7-da10e3f450b6", "comment": "Malware payload", "value": "d5f38bcc4483a20c2e178bb8ac10d09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337098, "uuid": "ecdc6c24-6f8c-475b-9a91-b77d1449188f", "comment": "Malware payload", "value": "15e902772e7df496a227d532f1d4a74b200f1af7f074a3bc1912029ff186489e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337098, "uuid": "f8e23293-00a6-47a6-9f91-bab6439507f1", "comment": "Malware payload", "value": "3b66d0b23e80cd83ff121302f91b4996d3e8b35e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337098, "uuid": "0edb60a4-825c-4c57-9172-bf8d3c2ee4dd", "comment": "Malware payload", "value": "64fdd5ea1e8cad07ead6766dfea74e7280b8a46a49eedb9b3a5f41606eee076fc79889521418c1998ea2b0dc27fe8447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337098, "uuid": "e5dac1bf-4453-468a-aaca-87c5ba5b07be", "value": "T11693B6D2E69A005BDFE71BB490723F74506B6EF8FCD2A5852598305ABE379C30632607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337098, "uuid": "baec28ac-ea29-47f2-b4a4-8c6261221081", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337098, "uuid": "079565ea-9c38-4761-a219-9525bcdbf602", "value": "1536:Lxm4HKYaodwdZZKZp9mYw+PKqUbWE4UACB59gK8ysCWQWM:LoZVZZKZWCplyg3CWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337098, "uuid": "a8f40929-f6f3-4231-891b-13cfb55e4bc7", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337098, "uuid": "37d87bc0-e6fd-4ff2-97f4-b39da785e584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337098, "uuid": "2285fc6a-3433-4a28-a3bd-9277bb31f0f8", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24545b57-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "f5c68737-c4c9-4485-b41a-0ab078617c39", "comment": "Malware payload (Gafgyt)", "value": "dff42aac5f2db3a79355b09b8c43b0da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "7771b502-9ea4-494e-8b87-0691a8148c0f", "comment": "Malware payload (Gafgyt)", "value": "16de867d548b31900a96c03bb6b3d0efce7dcdd6a5b1c627e683e671d409542a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "dde48456-1d3c-4e7e-b4cc-dd363b718382", "comment": "Malware payload (Gafgyt)", "value": "184193e16c14912d8617c30bf81c1e80070e2694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "c30b606c-f4e3-4682-83ee-6b67b93ce625", "comment": "Malware payload (Gafgyt)", "value": "3795f621d21dbad60de1bda826985b1af971c163ff99f9034b818bb63e7393e9bed5d5c76201e724ddf1a02b37c07538", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "66752b45-4152-4580-a129-32e5e66459f7", "value": "T10D734B42E652CAB3C8930BB6029B5B264A31FC3A1E2B9F59F31D7DF49B124C87217355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "021da89d-0a75-42a5-b0a7-4752cf51886f", "value": "1536:0+xNVpyQWuKv8xKBnq5PeOj5zMLVamLI2VOCjXUfJRk:nNTI30xKBnq9eGKamU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337083, "uuid": "4fb1696b-ee34-453f-a0b4-4d4b09800c57", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337083, "uuid": "0399a36e-8c3d-49da-b244-33dedf1b1e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "cee92401-28d5-4cbc-b0e1-50db48336ae8", "value": "dff42aac5f2db3a79355b09b8c43b0da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946f0e43-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317943, "uuid": "3203dc2f-386b-454a-aabe-0d5e18cdb202", "comment": "Malware payload (Mirai)", "value": "2b9c587bc73ed5c099bd6bfe04611443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317943, "uuid": "7cd82154-49c2-4ae4-9624-14f435a517f2", "comment": "Malware payload (Mirai)", "value": "16e726706204e3b471ba75438e1ad4b6fdf8f53e15cba631fddea25b965bb47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317943, "uuid": "a6da2cc8-0fc2-4e6e-a6ef-91246de6ac16", "comment": "Malware payload (Mirai)", "value": "fd4d255ff566a6de371c0072318c83ff7cac9606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317943, "uuid": "81095761-110a-4dd9-abd2-6cf45a3ea538", "comment": "Malware payload (Mirai)", "value": "27eae686ddf9e30d7003fab3f3de96de596841fef1bd5e06d8d8c8984f0f160c66d00daf7ed22845a3626e1b1ec34b7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317943, "uuid": "c752c34f-3b33-4f1c-ac66-46f54e34a410", "value": "T1A0E2E1CB936D8233E819EB7B052C382D8C97BB808694876DF98DB42C42359B874F9345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317943, "uuid": "88e2577f-a23f-49cc-9d3e-fcb1c33dd4f3", "value": "768:ZRkSez3kNJdXcXpi4bXeZMxdlzDAkEwvcfC2/o2S:bkSs3kNJdXcZvbxZ5EfCso2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317943, "uuid": "483f8127-8163-4515-b876-ec1b5cf492fc", "value": 32072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317943, "uuid": "a490638a-9790-435e-8147-b3c88a15a937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317943, "uuid": "1ad29e86-3367-45dd-be1a-b0fae7e4fb11", "value": "meihao.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546ff280-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652355632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355632, "uuid": "92de7a39-e2a2-458b-9b51-9cde971ac492", "comment": "Malware payload (Mirai)", "value": "15afddc19f44b32c83b03c3312071d2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355632, "uuid": "5c4dde72-6175-431d-b3a8-16b1928c8b11", "comment": "Malware payload (Mirai)", "value": "16f62942b8e8e0165477b48c548a945fea34c5fb3208bd7ea939f16a64252705", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355632, "uuid": "3156e3bf-c3d4-4812-aa37-592a0f1bcec7", "comment": "Malware payload (Mirai)", "value": "8da1db3ad96e00b4aaf6b5fccea90ec0463a6bda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355632, "uuid": "656d7751-6d3d-40dc-9de7-3ef2d69abaf7", "comment": "Malware payload (Mirai)", "value": "69d60dc5d89843170180386e9218f25dec570faa771a41d225bc7eb799c8af9338149df0a263f0ceea7c8ec7a06986f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355632, "uuid": "3e8da38f-06ab-4b24-9f12-7320c7e80597", "value": "T1BA63AE63C9741D18D24889F072E49B35E323A61981C72FFAC165C618E893EEDF265BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355632, "uuid": "3adda3a2-b3e2-48d5-b63e-62415383ad16", "value": "1536:IoWCpnZF+XMuWd6mlYrliW6VN9/CRTi9uK8/Qv3a9V5hr:jR2Md6m6SVNFSo8suV5hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355632, "uuid": "fd5a4e8c-d252-4b68-9c00-bca10366d6bc", "value": 72468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355632, "uuid": "2313a80d-1cb5-4e19-86be-ae4ab1143e20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355632, "uuid": "ecb6a543-3491-44f4-b897-fb2d99549f77", "value": "15afddc19f44b32c83b03c3312071d2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5505489c-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652376678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376678, "uuid": "dc422569-82d7-4a52-b1b3-68a812d6ef44", "comment": "Malware payload (Loki)", "value": "d25226a4c59ad2975844cd6bd4242a44", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376678, "uuid": "f814aeba-645c-4a7f-8391-aaa7b9843c0b", "comment": "Malware payload (Loki)", "value": "189f13d51ce0895ce15207125770f3a318457b7754ad10aa1f54c7ef5c90477b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376678, "uuid": "22e86095-16ef-488c-ad97-b33e2c880ba2", "comment": "Malware payload (Loki)", "value": "c7f64b27265da385150b96e8dd83614cce49e983", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376678, "uuid": "607ef62d-736e-4fe6-b40c-ce69b5469707", "comment": "Malware payload (Loki)", "value": "fdabf31fe564ba12e07fe40466076c4426ee1459d7bd0169cc74c6818bbe401d21a74ede8e52bffe73d74cf8cbd1e22d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376678, "uuid": "1e2019f5-03ec-4e8f-babc-4ec03fc70182", "value": "T13E0412A8F7D2A752D8B28F3A3913B4112345DF29A89B169277D4347842FCBE16460F1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376678, "uuid": "07381aa3-0616-4511-b8cc-10cc8f6cb333", "value": "3072:/zuUW8CQENsNczsp0grytvOM2VcCcEDx7k6eSSM7Q5lRj+K3Sfpmmt:yUW8CVsQsp0uyV5CcCxFeSdwd+K3SRmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376678, "uuid": "81ffb753-6556-4c51-a972-2532bbf96d61", "value": 188456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376678, "uuid": "9ead8d1a-8570-4f62-930a-0bff0e97f451", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376678, "uuid": "350f5324-3aac-4a9b-be9f-bbf087f080d0", "value": "Bank Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c630709b-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652379445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379445, "uuid": "3ad85989-5ace-4a7a-b439-81ff09607e0d", "comment": "Malware payload (AgentTesla)", "value": "2391e6aa319cba9248661674ac5f2105", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379445, "uuid": "dbf900dc-3f4b-472a-9b82-a91fc0e655d3", "comment": "Malware payload (AgentTesla)", "value": "18fa3e8547f1b76b8a53b1169c4b3ed78f1a3efb77163e0698ae3b1faf7efb71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379445, "uuid": "4256a8c7-d9f8-4129-b0a3-ba4f47063e05", "comment": "Malware payload (AgentTesla)", "value": "bbdb700fd74488cc9f3f3e4d66de6b1321ee94b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379445, "uuid": "93d881c6-c1b6-4622-95e8-0eaf85fe2e1e", "comment": "Malware payload (AgentTesla)", "value": "6b2bf987425c95d81791eda1c50cb193dfc82a433eaf749c456dadd1a3b1ca372fccafe7f6ca96fdcf6f3cdaf5d9ec12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379445, "uuid": "a1015f5a-efef-4c78-9100-f5c8ca01dd37", "value": "T1F133BE6B63B6A1ACD83E71BBF113CD36CB0E7D21D20DD9091811B24D84BE8568B527F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379445, "uuid": "819a4914-4d83-4f2f-a5a3-9fb77acc724e", "value": "768:kqmuNsZ9NhvSSQDqAAtBMTB/FwedrZKvN6lEq+2+SVj+PAaBQeqruUlEWymcfl/q:kqhq5L0qBM9SML+SVjcHBtH9JIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379445, "uuid": "a811b9ff-fc8d-49af-9194-82496427afe5", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379445, "uuid": "1ecf743c-223a-4815-8714-c20b585042af", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379445, "uuid": "c4e54203-92da-4b3b-816b-f9cab915704a", "value": "soa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dad848-d1e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652353005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353005, "uuid": "edab38ae-afef-4e6d-80a5-a434bc3b08a7", "comment": "Malware payload", "value": "b2f392a1dd6c290f390d0aac7f4bfe46", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353005, "uuid": "dbd172a7-dd3c-42d9-bb6a-aea3bba4f967", "comment": "Malware payload", "value": "19867586298dba124d760385b87a113884fb785c3e704d288cbdec73e3000fca", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353005, "uuid": "7ac03749-1c8b-4eb2-9d55-298879bde498", "comment": "Malware payload", "value": "231d8aeb435454a27359257afd0ff8bc4998e521", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353005, "uuid": "e0078f7d-a29e-4a23-9eb6-ced229233d15", "comment": "Malware payload", "value": "eecf430a280d3c7d4c74c5fa95e3defa889345937189e45a39bbfaa475d9c265975ba30102afe820c75e5764726b25ec", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353005, "uuid": "9543212d-889f-4972-b9cd-da9014920473", "value": "T143B6701C9A703EA1FA2716BB50424E90981CACDC9E14D126333BF7D376737E562AF906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353005, "uuid": "0632ec44-a16d-43ec-955f-228e713d1962", "value": "1536:6RG/+RhlckzjhgF8gS43l3a00CtTUzQxDs0D07pM:TMJzjhgF8SH0Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353005, "uuid": "7fe166fe-1f1e-442c-b6d4-a54eaccf8d3c", "value": 10526720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353005, "uuid": "ac7390b3-6b66-4a66-bcbd-d00a82865eef", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353005, "uuid": "86b77768-1c2a-4bf8-883f-e60ca1b9b103", "value": "System.Upgrade.Win10.0-KB21585660.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e144d1-d224-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652381407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381407, "uuid": "e248b2ef-6767-4d30-bea6-1d9713e5806d", "comment": "Malware payload (Mirai)", "value": "ee5a4faf6a4d735aec8bc80f83055cfd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381407, "uuid": "ebfb7abc-82d3-4ddf-bf7f-079f7a1dca47", "comment": "Malware payload (Mirai)", "value": "19b5e054225dce291fd269ccec774a350aee9735000999b711667e9a3a65c3ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381407, "uuid": "dc0edc87-5576-4f48-a205-c1060973d33c", "comment": "Malware payload (Mirai)", "value": "93085e894c2980cde7d4648b24e48891697f5b9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381407, "uuid": "77217b73-b2d6-4181-8914-b033fc824f40", "comment": "Malware payload (Mirai)", "value": "e479df8ae80ded3f76d735f9808f401ce58cb8eaccbd7771a6fa79f5f1ea2cef3bca295a49fd0ceb85dcfc0cdac4f32a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381407, "uuid": "5380f4fa-5257-4c25-bc96-68b806f7317f", "value": "T193F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381407, "uuid": "2be99c0c-c464-43db-840c-a621600b3626", "value": "3072:dUW6GNyt6hMwYh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVyt1LSuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652381407, "uuid": "757d546e-6012-4bbc-af47-020dd9fa9c0a", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652381407, "uuid": "8d60d6d3-44c2-4450-8100-bc385f0ab055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381407, "uuid": "5e742fce-f897-43d2-9c97-c732067bfe7c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7614311-d1e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652353247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353247, "uuid": "9171a9f9-fe8d-477f-a272-a8251a4a55b3", "comment": "Malware payload (YellowCockatoo)", "value": "8db4b8b179762278b7f9e1b2d1d48e51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353247, "uuid": "1f940d2e-7b8e-44f9-a2f9-1f9c8334106f", "comment": "Malware payload (YellowCockatoo)", "value": "19bf8549f0670fee95a305e2ae5b20992ed985593fe221d463bbf5271afffbb4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353247, "uuid": "77c11e5a-49aa-4454-9b5b-fdab3526335f", "comment": "Malware payload (YellowCockatoo)", "value": "2e314ffebc7abfca9dae65935b9ad01fd66a3076", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353247, "uuid": "e89d3973-b61d-47bd-b976-a12cc5132a86", "comment": "Malware payload (YellowCockatoo)", "value": "7b9ada19718f76a3f89a6201db7e2fb518a6b7eeefbc7c621c5db4bc6777c59265232b61b5707c1d78fe8f25602bee03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353247, "uuid": "a1a048d1-4cb2-40ec-a95e-681822c9df1d", "value": "T1D9D46820379FDD6DDB2C16E9739B2324872060FFC5B28F8E69A150B5CA19A647D0C2F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353247, "uuid": "27124413-e61b-463c-8f38-583aa4e84ac7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353247, "uuid": "17ee9e22-4826-4c54-9c0d-de87fe1a68f8", "value": "12288:WBVACCWdY/KvzArEh/ScafG0S4Jrz806euvd:GFW+GEM/JkdeuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353247, "uuid": "ea261f70-90e5-416f-8153-491687dcf2c3", "value": 648736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353247, "uuid": "5cfd6da3-c576-40d4-b656-cba11dbaafb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353247, "uuid": "217b8b64-ed74-4be6-a5e6-7510fa782c7a", "value": "19bf8549f0670fee95a305e2ae5b20992ed985593fe221d463bbf5271afffbb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fec194-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340098, "uuid": "fd3abe70-6873-4a12-a9b6-ee2161b269f0", "comment": "Malware payload (Loki)", "value": "eda9b73de6a05c0f227ca888ecdb7e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340098, "uuid": "48117d8e-ace8-4bba-a3b2-1c4be56cae40", "comment": "Malware payload (Loki)", "value": "1aadfc0d778b0d7bb238840a64991ea77998ca45c480280ed3945ecd2d29649f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340098, "uuid": "6c177738-07b2-49a8-9d04-2f29686aae12", "comment": "Malware payload (Loki)", "value": "9b407c23a5824cf8391a633f83cf7f31c1962d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340098, "uuid": "5f309f41-97b8-4039-83df-f006ff9a882f", "comment": "Malware payload (Loki)", "value": "3f8b1746fe88bc8689073303ea7e30522a16b0f03bda80ee1e046954ccbeaf820e46521e85b04c4269567a81014b88b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340098, "uuid": "03255d2b-ff9b-43ee-9849-c9bb23a8a01a", "value": "T1FEA41224222893B2C9BE1B71CF7E50DC63B42F625EA1D70FAC8279DE817174505A25BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340098, "uuid": "8730341f-1b41-47a5-8559-4c46bc6ef3d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340098, "uuid": "b0d8c537-d32c-440a-942a-c3f9e6e82150", "value": "6144:Ian5IS6S9PXjoZ12u0knJpvrf164J21tX4IcapVfe69kriliea9k8qUe:ZIeXjo7PFnJpvrfE4JMwapVErDCRUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340098, "uuid": "6302b453-4c41-431a-96df-baf904a5ab2c", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340098, "uuid": "d8a14cba-681d-4886-a43c-bce58f32eac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340098, "uuid": "a811c1ad-d517-4fb2-83b0-5a708fec939c", "value": "TNT Consignment number#AWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb54b777-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652340342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340342, "uuid": "c1bfe33c-2d2e-4bd0-b3c0-123146a4b5dc", "comment": "Malware payload (GuLoader)", "value": "0347b27843d88f73fdcd4dadb95549ac", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340342, "uuid": "cef112da-4692-436c-96cc-ed3561156943", "comment": "Malware payload (GuLoader)", "value": "1ab3aacaa62faa6a83173e9191972d427aab92f33c527f6964f141e21c930e67", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340342, "uuid": "4b25a407-92e4-4dcf-b063-bef2a047e228", "comment": "Malware payload (GuLoader)", "value": "2a2d6bcd2d83833d501b9695921855e1992f6ec8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340342, "uuid": "7f0f044f-5a0f-447d-a69b-0574d67e046b", "comment": "Malware payload (GuLoader)", "value": "8a50ba92b036d766b4df1021572386575ff69c6a27216e321f949e16c958d4417c25f4e6d8c480f4802a3cdc700d2735", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340342, "uuid": "60c41f06-1e98-4efe-b993-f4d55ca058af", "value": "T1A544769245B1AFC8D1F839DFCB0D8620B2009D99A2D7F54C9AE211BD7FC72DA531B294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340342, "uuid": "d1667239-c8e9-469b-a454-7ad880cfe8db", "value": "3072:UCZ+vnIxDSTz1EGYdx3VyZcd4B5RYe/aVPC1C:UCZ+vnWOtPYdLyDRYcaVqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340342, "uuid": "db386fa5-3bee-407d-9300-3a17317fe962", "value": 256870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340342, "uuid": "28501caa-7c97-4e35-9c13-454beb2958dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340342, "uuid": "1c6b7fa1-26f2-43cd-8ae7-7da393c55036", "value": "PO-19903.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793cbe0c-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337654, "uuid": "ecbfb5db-cd2f-42a1-b76b-ddf26064a53f", "comment": "Malware payload (Gafgyt)", "value": "1044c88604e21655493cb1a7ffe58ba5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337654, "uuid": "d8aa18c6-6925-4ec2-bbbe-7663b575a601", "comment": "Malware payload (Gafgyt)", "value": "1b0556299fe12e3cac4f0b6e9b340fed3005fc3dbd72b6bc537d0b90d54901d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337654, "uuid": "12b04c5c-dbca-468d-bf53-417fa15a72df", "comment": "Malware payload (Gafgyt)", "value": "b1a746d42f80a23eba58c3d10c27fc0282e7be9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337654, "uuid": "d13fa63e-1bae-44f1-8daa-4cef42e29b84", "comment": "Malware payload (Gafgyt)", "value": "a50117eb3df4771957195754fefb5b9e4400c034ccb3556e4340efcdf927abc760d7991aaa480244168b86679d59f2c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337654, "uuid": "f9b1134a-a78f-41a2-b752-2a425990f30d", "value": "T1E2931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337654, "uuid": "dba27364-3af7-4c63-a5e7-357d941b9006", "value": "1536:EIkg9VQPAWlMTEb82Mm3xDKMsF0rOLcvWNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQBMTDWWFGWNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337654, "uuid": "ab9b394e-b00d-4fd3-905b-591353058dba", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337654, "uuid": "1a263a18-da2e-41da-8bef-c2e6cb8670e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337654, "uuid": "59c68b42-4a15-4f77-b2b1-3306d0234f8d", "value": "1044c88604e21655493cb1a7ffe58ba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587f47c3-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652341895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341895, "uuid": "aaa4d4ee-3e61-48ec-b3ff-8c45092205c6", "comment": "Malware payload (SnakeKeylogger)", "value": "c086a56afcedd0de2ffc81b884e1ab4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341895, "uuid": "f9751536-2d6d-429c-9b1c-26f758807e55", "comment": "Malware payload (SnakeKeylogger)", "value": "1b26fc626d3f89d9dada3fbd2f5f6651c4df5fc6dbd91f877e0b01c086fa3d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341895, "uuid": "894c866a-ff2e-4102-a407-e7e101b3f8a8", "comment": "Malware payload (SnakeKeylogger)", "value": "d02fd749d2877ab4a027ee81f1c5184bcedfcf12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341895, "uuid": "2e9d178e-dcc9-4290-86c8-d3acc6350486", "comment": "Malware payload (SnakeKeylogger)", "value": "02d7980e49d345b807d45ff892b3fae786b37ccfb83ab8cdd2f6010df69f2d6c9a3802d56c98ba6ba579715832331fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341895, "uuid": "2df3f8b3-3c5e-4763-beaa-c807f76bb898", "value": "T128A40245B26BEE26D54E0AB6CC9401CC5370AF43ED13E79F6CE875988A733D218A174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341895, "uuid": "7db0cad5-3b0d-4ce1-9ccb-a32af993881f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341895, "uuid": "ce102785-b57d-4950-bb67-85d76a879698", "value": "12288:SM59UONNcnk9NlKfqbj4dlZXNeGmgOZHAQpjn2Rk:Se2WakrlKyozZXdw552m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341895, "uuid": "3a55a847-2572-4c61-8850-0bf701276058", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341895, "uuid": "8b818da0-ef5a-40dc-a8a0-4c4b98d16019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341895, "uuid": "1a0f37e6-0f91-4fba-a572-d133ef30f3f0", "value": "Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5b5e2d-d229-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652383514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383514, "uuid": "52f530e2-724e-4dd2-ace0-91cc84c8030b", "comment": "Malware payload (Mirai)", "value": "2061a267af57c6c1b802633cba97abfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383514, "uuid": "dcb44c22-cb76-434a-9263-48d1d8b8f913", "comment": "Malware payload (Mirai)", "value": "1b2c4991efb3abcc5fc3b4b1a58eb622ceb4e634bf4fc6990e54546ae08a9560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383514, "uuid": "ede5b6a2-e641-4cb8-b3a7-6bcf442f4bae", "comment": "Malware payload (Mirai)", "value": "6407efebf232f7c467c96bea99a64c1cc2313f7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383514, "uuid": "9aed1a34-84bd-46b9-8257-1c73eb257b0b", "comment": "Malware payload (Mirai)", "value": "6e445c7873cc5dd12bcd691404384cc001bb4ecf05b60b15bd24707d6e09882a4c7609b7a8768ad8fcccaa6854078aed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383514, "uuid": "33ef5230-3ace-481f-97ba-858272b70cc8", "value": "T1CE73B70A7E329FACFBA9523447F78E11AA5833D527E1C685D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383514, "uuid": "4d7df669-203f-443e-bc2b-cd1abb97cc86", "value": "1536:3IHb8FMv77EKQHlyZR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMy1Fa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383514, "uuid": "f56fdd7a-aa23-4058-9002-956f897b89aa", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383514, "uuid": "6f9219e3-4135-4418-97e3-873827aca7c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383514, "uuid": "11b0cd3e-35cc-4a97-bee2-bf1e8b6c5920", "value": "2061a267af57c6c1b802633cba97abfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ca41c1-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652366261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366261, "uuid": "988cd3db-bd69-428a-bcbf-9b3aca245a25", "comment": "Malware payload (AgentTesla)", "value": "e77d4495f195e1fe3700564afdbb7866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366261, "uuid": "91a355df-cb3a-4b52-9250-42e4a4f29769", "comment": "Malware payload (AgentTesla)", "value": "1b92179e202ed1aad78190a5f285b4afd4b4e0fe4d4c0f8c0f5c720a46c1ace2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366261, "uuid": "afb43642-2331-4f4b-9e68-eec109b61aab", "comment": "Malware payload (AgentTesla)", "value": "cbc041f2c72f018f33adc122d89eef4e6d963a5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366261, "uuid": "4e30909b-55ee-4788-a3f3-92ab58c2897d", "comment": "Malware payload (AgentTesla)", "value": "eb712f7505ba4ceb3eb94f2d15742121ee7589b3b789238b508c31f8a738a0aa33357e287f108124fcdd73a9ece20bfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366261, "uuid": "89d2f2e4-e514-4937-9d5c-f88dcca523d5", "value": "T1C2C4122932F89B22E67E4BFD21A0301923F5652B3112F79D8DC561EA5EF1F140B09D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366261, "uuid": "50fbe756-0e61-4789-9429-d56745e72935", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366261, "uuid": "402fdd06-3c8d-4a21-98eb-839b7549c977", "value": "12288:ozVXpZvqrLUOsH1+/w4fFtMgdI3WyXJmjYtre:I5dqrLtsH1+ndSZmKhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366261, "uuid": "47910e41-2d25-4e36-a1db-8fcf9f019a61", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366261, "uuid": "440363b4-b835-47bd-a421-22abc471812a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366261, "uuid": "3c0c89ca-7240-4ec6-8473-ec91331b89ee", "value": "EXP 22-13-5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9874507-d1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652353707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353707, "uuid": "168019b3-1d2e-4cc2-9185-7c20f6e539fa", "comment": "Malware payload (Formbook)", "value": "8e4c3121afd64b194e0ef813446010d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353707, "uuid": "81e5e5ea-232a-4a4c-a09a-80037773a816", "comment": "Malware payload (Formbook)", "value": "1c1acd7471717abab1e6d0916a6896239210c8fc6ef2baf0b902ca4fd13e0ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353707, "uuid": "7d7b82e5-02d8-457c-aabf-9752196ade7d", "comment": "Malware payload (Formbook)", "value": "8bd07d7a650eef058129f3c8d216abe5979b852b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353707, "uuid": "62479553-86f2-493e-b880-afe39a676ece", "comment": "Malware payload (Formbook)", "value": "a21baaca6dcc5e16187d825f2347210d5a160394140376dba7823c8950cb93c8e8b581ac2e014be12acaf9d5872eae80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353707, "uuid": "71997397-de6b-448f-a1ca-ae1a4c8d57e4", "value": "T128B47D8AD0019C62F8334BB92031D97973A76DE56DF42D9925D07E633AF7093A83681F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353707, "uuid": "9b2e877d-0d0c-4daa-b7a6-2b930e551113", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353707, "uuid": "aa2c5790-454b-46fd-ac22-b795979bbfcc", "value": "6144:BOtIvttHOUjWGa+VvcZUwU6hfvIgVu55zhL9jyZt07BC+fwgenP30+D831inyr:BOct9VjWGX+UH8H8vxjp7BCiwgM34wnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353707, "uuid": "806d11b3-032f-47ca-b56d-aa3267da03ba", "value": 513960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353707, "uuid": "cc7bbcf6-13b8-4a19-b5f4-70b53052acb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353707, "uuid": "bf2674d3-d62b-42a1-a62d-78be9e6bdfb9", "value": "ORDER INQUIRY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274b53d6-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340094, "uuid": "fdf359aa-d4d9-4db6-8291-a1c8cd01c892", "comment": "Malware payload (Formbook)", "value": "40f359559c9e278d04419512254ccb4a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340094, "uuid": "18d07839-3688-405a-9614-239cd0f03ac8", "comment": "Malware payload (Formbook)", "value": "1caa4a4e077cc954b65893bb0c11413afcaf185046d3d27277ddc2e9526a849c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340094, "uuid": "b8d8c6e1-f6c3-4119-8a64-5c402a6aca37", "comment": "Malware payload (Formbook)", "value": "08b0b44caf0fa9e19dd43417e89bfc6c8494c1c0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340094, "uuid": "23e50e03-afc5-4a9f-92af-862bad175497", "comment": "Malware payload (Formbook)", "value": "08f8a091a6c8e5475b8682101412a80cd13f45af744ecf2bf9f3d31409f9d341abd39c5598af43b559afe8eadecf751c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340094, "uuid": "6975a2b0-fe6a-41fb-93f3-4b87470aa9b2", "value": "T15F55F157E3D7FA71E6ED52BA86B1DA3C176E74A29069B7497B405CCC29213038928F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340094, "uuid": "95282ace-5405-4e4f-838d-4963678d9ae2", "value": "7e569b564dba0b34119990efd3d9dfc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340094, "uuid": "5793a9a2-80f5-4732-b569-422f3a951290", "value": "24576:EnnncnKW2MGX1RXVMfN/0q0QnbhlEMFN/iNo8+66Kaqm:LKWZAUb7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340094, "uuid": "54109526-b6e0-45cd-a89d-0c57dd8f35e9", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340094, "uuid": "3aa8c212-83b9-486b-baff-62164626248a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340094, "uuid": "46615136-dc91-4637-bca3-0db154494b82", "value": "1za109t4043832979.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c06f52-d20e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652371980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371980, "uuid": "87f21e41-9808-4a6d-be72-24aa5040add1", "comment": "Malware payload", "value": "fc2b1836b1cf905bb8e76a5f0c6b2613", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371980, "uuid": "40c8793f-60b3-4693-ade9-614f916438a8", "comment": "Malware payload", "value": "1d3217d7818e05db29f7c4437d41ea20f75978f67bc2b4419225542b190432fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371980, "uuid": "38d537f2-fb37-4ddc-b1a5-1dc383b690ae", "comment": "Malware payload", "value": "2d4d3986404110e8274ee19129238c170532c948", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371980, "uuid": "69bfc0ca-3fe8-450f-8a3a-b199fdfa9490", "comment": "Malware payload", "value": "1e01eb2d2d6162ee02d0cb1b6327fbd0968c416bbae9143e0c4e9cad129a52c7ca5baaff54cf48bfe9f3369218da969e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371980, "uuid": "b57e59a5-216e-4f13-b1dc-dce7a3ad5c29", "value": "T139C4E14073EBD841F0BE5B340838C1560B32BF88766DEFAB6E59325A4E761E4095AD37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371980, "uuid": "9b58e433-e441-4bf8-95f2-7e6b1fdddb88", "value": "d747d486ec47bb0a5f5ff4c5c0f0e14b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371980, "uuid": "ba1ce0c8-5603-4ea0-8043-3bd4072404b5", "value": "12288:fz9UnLdlUyS3xYo5hN0FpnmF4EC0aeSttqSArkn8cJH:fz9ULUxj54p2bC0bSiSAw8cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652371980, "uuid": "33a12e2f-6f4a-49a8-b1b3-1ee2017ef102", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652371980, "uuid": "d962ef2d-8177-478c-87e6-6f7e179f52a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371980, "uuid": "33716415-0f5c-4a35-84b8-9c142e744bdd", "value": "1d3217d7818e05db29f7c4437d41ea20f75978f67bc2b4419225542b190432fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05be7d6e-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652379551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379551, "uuid": "b1be8585-09bb-488c-b1cb-ee6acaa22a0a", "comment": "Malware payload (AgentTesla)", "value": "aac8a4d7d113a1e25236abbbbf5eff4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379551, "uuid": "f2875019-57d6-4d82-91c9-5ebf76566d05", "comment": "Malware payload (AgentTesla)", "value": "1d3ebdbb6ace93618d8ee0490798046e2af4e3429ab73b9ca9fe8bc6c657e9fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379551, "uuid": "ed29fe1a-7441-4169-9ad2-7aa92164c3e0", "comment": "Malware payload (AgentTesla)", "value": "01a56a849d58e9d50cd7aeb08b4b4d11fbc6c582", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379551, "uuid": "58668dad-c29a-4d84-8f3d-ed04f9bd343c", "comment": "Malware payload (AgentTesla)", "value": "5aa04de88b2157b789e69d980f0c4ed3e62110f46b9baebb33bab19ddbf1aa32f8b4ec4d6f1f199b5490c3b548ff72ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379551, "uuid": "c2bc18e3-4cca-4b70-8615-9f438b3e614d", "value": "T154F2392AA09C072CDB2AED37C3B2462123F49D8CD625DD1F58677EC62E737E2DA15418", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379551, "uuid": "8ee02a27-2902-412b-b01c-f7e77f8b8158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379551, "uuid": "7f1f641c-1faf-40e3-9f4a-fa3279fb7b3a", "value": "384:7cFS2eQMfEKM46CrdbobgbveIrBYBlN26P2z54xInSj3ge0GI1:N2eQMfEV4tGbgb8InSj3gY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379551, "uuid": "6ccd3ed0-0a09-4fbb-84af-92d1dc8cc0b0", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379551, "uuid": "e3d9c19d-5a71-48c2-9b8b-3719f1c924e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379551, "uuid": "a9eed40a-194d-4aa3-abb2-93dcbe1dd373", "value": "Halkbank_Ekstre_20220512_082357_541079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530f65dc-d1cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652343174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343174, "uuid": "80dc263d-db61-40f2-868b-89c8f08da2dd", "comment": "Malware payload (Loki)", "value": "661d85ed787ccc3508d2f92f631f5e1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343174, "uuid": "8785e689-769a-4eee-9446-e068e72d40ef", "comment": "Malware payload (Loki)", "value": "1de2822a0cb24fb21e63f7947634b9599f1301982d5d9cd0db9f51630724924a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343174, "uuid": "b5da3d89-20c3-416d-b384-bd7729c75a0c", "comment": "Malware payload (Loki)", "value": "2822bac7a9daab23ddaff806f69fc3f9ab33dd08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343174, "uuid": "c46848d8-6ed9-4eb2-b193-76f4d4376f1b", "comment": "Malware payload (Loki)", "value": "9e51255ca212c9adc970d4ed613755a510b088cb047a3ff46d8be6ccfc0d8f0a89341ec0e36af5ead4ffc08894113c17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343174, "uuid": "55218f1f-b639-4a20-906d-fd5a07eb8996", "value": "T1A8C4011CB3FBDA22E16E2F37E4F614140779BD49A063D34F258C124E6E1279A0D45BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343174, "uuid": "e9822573-ff0a-4b4d-92b6-9e7f588995c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343174, "uuid": "edd9f038-308d-446f-b3cf-3c7256425840", "value": "12288:mVepUp1e/XOos12DdRPlIHSvmnULfAlWR15iiqhfTG4tJUi7xxXRp:mVeO7YXOos1S+yvGU0lWR15O5N7xxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343174, "uuid": "c56c02a2-e3b1-4814-945a-29376ac644d3", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343174, "uuid": "381076e5-e2ff-415e-9260-2465cb379247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343174, "uuid": "233c0546-1e04-45f3-8225-abb502618743", "value": "661d85ed787ccc3508d2f92f631f5e1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d80200b-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340668, "uuid": "c5deca15-a467-4bc0-8532-e75ef5bf2aa4", "comment": "Malware payload (Loki)", "value": "9c7c29f79aa00398bc5ae6ab5e8c0e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340668, "uuid": "6521aee3-72eb-4c47-b4fc-a6e64dfdb942", "comment": "Malware payload (Loki)", "value": "1e1eaa51dc055269238537f9eab9b186a0adc9f033314e9d445684ae175cf8b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340668, "uuid": "dcba1eff-1a50-411b-895d-37f97027ffb1", "comment": "Malware payload (Loki)", "value": "b7ce7d3a983f79135302803f7dba83b774c009f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340668, "uuid": "31c468bb-3beb-4faf-9218-356302fd9923", "comment": "Malware payload (Loki)", "value": "f75b37081d7dd9b22f2588d2e4e02ed185ac7277fe1b0834f3befb4c762af1dfc54ae46870f6ced4b2b20cc1148f8367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340668, "uuid": "1d634fc3-7eb8-41ce-a813-716f44595946", "value": "T18A0412011354C133EAA2E3332E37A7258DEFF72295F4650763501F4D3AB67A1AA0DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340668, "uuid": "0ce0e11e-96c4-4add-9765-d567a0460105", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340668, "uuid": "8a17500f-c327-42e6-87b7-98c406571c1e", "value": "3072:LODZGPEounb1tAEO2NF2U69h0R4feZ2QSvVwwfyE1NTAJvECykU35:LOtIO1tjO2NFA9h0Rj32Vwwf91GFxP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340668, "uuid": "9367db50-c18a-4225-8b01-9e9b41676aa8", "value": 182689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340668, "uuid": "a97f147a-5d5c-4fe8-8902-4feff0bae0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340668, "uuid": "c9bfd6de-1734-40ea-8b87-e07132f3eab0", "value": "9c7c29f79aa00398bc5ae6ab5e8c0e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7414b4d-d1f5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652361488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361488, "uuid": "c54fb15e-42ec-4eb8-abf3-5b794976f23a", "comment": "Malware payload", "value": "f9f4781143095980fbfc36a4a5425a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "testing", "colour": "#4DF59E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361488, "uuid": "f9bc4d63-95b6-4b63-bac6-259be87b3a5d", "comment": "Malware payload", "value": "1eefb6fed0e0d5db0b5179fd75fffbdf7254947bb79c5c0a40b31f4cba66589a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "testing", "colour": "#4DF59E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361488, "uuid": "4c6f9b63-fa57-4ab2-ba6c-88c09927910f", "comment": "Malware payload", "value": "975a548144efb3c887db5a62ac45de3a7b0e64aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "testing", "colour": "#4DF59E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361488, "uuid": "ae9ae008-69b6-475b-9ad0-c281ffdb9af7", "comment": "Malware payload", "value": "b3ef361973c89e007d8adbcdc3555d0afa18a08d5ec410fcaa407162144819d87b5bbf5d8dadf28d4fede61d7255f703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "testing", "colour": "#4DF59E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361488, "uuid": "d943dc63-9a0f-4c58-96c4-80243cab0be1", "value": "T177451250A344D57BD8684C72B8EECB19C0217F103AA5CD1666FD3C4EFC7A6C96492EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361488, "uuid": "2e8273c2-201d-4327-8a28-29e10897cfc5", "value": "3bf7e320aa8a82a5ee7c605130a7e20d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361488, "uuid": "63695964-b10c-4e6a-86e1-04c3afaa16a1", "value": "24576:yeoLkFYvlvFqsAzTt3W/bg9yDQT6sB8vyS1fQOIjUT7L/:cLKABdABW/bYAQZS6SBs8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652361488, "uuid": "a3fdb47f-7448-472b-b29d-6117f265a314", "value": 1209624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652361488, "uuid": "3341342e-0db8-45dc-b3a4-19c05cba5cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361488, "uuid": "11e034a3-b11c-403f-8bfb-2f3e3dae031f", "value": "ISL_Light_Client_4_4_2116_42 93200170.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff8f8bd-d20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652370603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370603, "uuid": "5e7728eb-4dc0-4ae8-91b1-d871ad2dc1ee", "comment": "Malware payload (Mirai)", "value": "04e03fb45c41d19d034f90b32a717730", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370603, "uuid": "4651674d-3138-4780-9522-81e0c5308175", "comment": "Malware payload (Mirai)", "value": "1f08ba2e1564e574fa29b16a51d558e456c223ce6e62b2bb14d50a46497b3c75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370603, "uuid": "e16a730f-d077-4b35-bea6-bde0810d8f29", "comment": "Malware payload (Mirai)", "value": "39580ae0c30fa448484c4630184d65a71d7fd567", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370603, "uuid": "1ce9a09e-46dc-48d3-8aa2-691056a26219", "comment": "Malware payload (Mirai)", "value": "9efbaf94aa62b5b2564b8f8b62adf7d3f29fe7978ccc62e0f43262abeca58754ad45cc62c6177f9e9ea3d37091ce6142", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370603, "uuid": "603fe122-854f-49a5-b65c-c1a359dc6760", "value": "T175B2F10DB77E0F86D2914336631F036FA717787F4A5EA28009BAA5AC9710C9AFC34D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370603, "uuid": "1d4c211f-166a-45b5-995a-64619fa9fda2", "value": "768:Yc4VTqxufVl9M3E4YVZDM1YIxywkNMgT1X:Yc4VTqmVqJdxB0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652370603, "uuid": "fdabcca0-b847-469c-89e0-405162483485", "value": 24756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652370603, "uuid": "311aa619-bfbb-4465-bd92-14321db3e89f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370603, "uuid": "95477958-2fdc-424c-8119-c0e766538c2a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429e55fa-d1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652347441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347441, "uuid": "b13052ea-50b4-492d-90f9-7b2c2d1aaa15", "comment": "Malware payload (Heodo)", "value": "6807db7b849a00a083b330be0d0d9d9d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347441, "uuid": "86704b6e-2017-48eb-b9a2-4892b504027e", "comment": "Malware payload (Heodo)", "value": "1f7ad07672321c79b12cfee51e7d7369049307b7a8a742eaf5b7f0db70c56d54", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347441, "uuid": "d51efe48-3e87-42d1-ab9b-c2e6f9b96787", "comment": "Malware payload (Heodo)", "value": "eb6490564ccde3b9317a67518d1a71ffe8d406b7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347441, "uuid": "e6b114cd-67a4-40a4-ac22-c1b877959724", "comment": "Malware payload (Heodo)", "value": "8618525f93c7d16331f61466623a46fd9ac83b569dd673f86c11fdd55d07ca6871f97bf4bca82c114537394a485b309c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347441, "uuid": "fae7de50-d387-414a-8aad-5b97bd2f2c06", "value": "T13AF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347441, "uuid": "3e0cd80b-b79f-4ffb-98b1-ef1c5bf3b28e", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347441, "uuid": "c71c4d1d-d584-427a-b13a-4eb107c24bac", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSLjNwgraKRT61cKGNx:S4DzZKnH46RGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347441, "uuid": "ace8ff8a-78ba-4f08-abd3-18791b07ef1c", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347441, "uuid": "f6ce500c-e16c-41c1-8651-ff4b37d02f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347441, "uuid": "da2ea183-89e2-4153-a140-f49f055b8249", "value": "6807db7b849a00a083b330be0d0d9d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec221e4d-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338277, "uuid": "91691615-c2b3-48b6-968e-8916b5b5ab3b", "comment": "Malware payload", "value": "78fe9593019a164db2171b215dfdd6eb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338277, "uuid": "364fc6e6-60fb-4ecb-8db8-b91f58733639", "comment": "Malware payload", "value": "1f9f8faf40981f022384d79e2aa27e21c4190795f3d7064811a29ef66da87048", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338277, "uuid": "23fd4c3d-dfc2-4c50-9813-672156619549", "comment": "Malware payload", "value": "847e4b6e0968a34e03d1aa939967c56e6f76cc53", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338277, "uuid": "930ca060-4b94-4eb6-8538-759e5b23abcb", "comment": "Malware payload", "value": "f98a19d78348605f3359ba0ce67c3584d78f3652c63cb991b1d51d2b5cfaa68e7ef8b4c7a6f93dd553d6f99a1a4096e4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338277, "uuid": "b6210f5c-a860-4251-b078-88603193e20f", "value": "T147067C23B6446A3EC06B1B3E5937A3949D3FBA7169229C5B1BF4484C8F358403B3E657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338277, "uuid": "a6c4c644-c4b9-468a-a681-b8a1359678f8", "value": "49152:8BG8jfa60iP1OH7CS2OrNsmBlX6IIWIEvQG4+Q6UTv449VHFYLEA:/8jfa6V1hgHvm+Q6QZ9NFYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338277, "uuid": "acf4e82b-bb2f-495c-933d-a7ded2e45cf6", "value": 3702272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338277, "uuid": "c69b4701-40b8-4592-91a7-e790b832e063", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338277, "uuid": "b2715d41-a8cf-45cf-8a95-dcfa5ec81e37", "value": "Arch.EndesFactFecha0905.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f597c30-d228-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652383003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383003, "uuid": "794ce90f-f337-48a7-85d5-f91da9ce56c2", "comment": "Malware payload (Mirai)", "value": "c8d6dc4e4a2f764fd393f29caa4e2f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383003, "uuid": "c5c73863-06f7-4b82-9b97-9a953dc9583d", "comment": "Malware payload (Mirai)", "value": "1fa4570a36c50a7bfbf238f16278ea62eea537eeca0ce8a8fe3c15b8109cdd9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383003, "uuid": "409c1358-8bc3-4d76-becf-dd676149b420", "comment": "Malware payload (Mirai)", "value": "ea45f1cab3ae62e97b681b2a28eecafe3a80433d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383003, "uuid": "8f21325f-565f-4ca7-8f28-d20ba5b93dde", "comment": "Malware payload (Mirai)", "value": "b81b172841aeb0ea70e73384c391457e07c6ed6b7d4597c8f037011ee7aa3b270dc708c6bbff9346106d5b58a84b0075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383003, "uuid": "a489ecb5-1b79-473a-a1e4-6e8ba84599cb", "value": "T105832A9AF400DEBCF88BD6BA41664D0EB930A39016920F377767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383003, "uuid": "dad42d41-aa0b-4849-b394-9f211ffa5b9e", "value": "1536:qLf0+QM5PHyVwi7f2ZUiEy+DlOo7GL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fs+DMJSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383003, "uuid": "28679714-ebe7-4674-b34d-8678233be704", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383003, "uuid": "9a7adc38-cc35-4dff-ae78-bcb46ca64288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383003, "uuid": "d1f26ae5-a6a5-4c8f-bd30-1b2dd8c44988", "value": "c8d6dc4e4a2f764fd393f29caa4e2f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9b2ad2-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652340750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340750, "uuid": "1be16c2a-965b-47b3-85f8-b566dfdd6963", "comment": "Malware payload (AsyncRAT)", "value": "b6dd845783ee203570dd1406f5b7c342", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340750, "uuid": "e9cc9ba9-4eb9-4f86-a478-c66dfd561747", "comment": "Malware payload (AsyncRAT)", "value": "1fb959f018b9de5a58581f6e0e2c3534b22b5f67b90ad30f7a49711777385a3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340750, "uuid": "e290ce08-56a0-4c8c-95e1-178772fee9fa", "comment": "Malware payload (AsyncRAT)", "value": "d3804a6dfd1f719901ed850182e0b189872e2d09", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340750, "uuid": "fc59dd6e-e988-4f68-86f8-24e37029e386", "comment": "Malware payload (AsyncRAT)", "value": "86d891aa0cf1c3fc6c28d2be4af9e39691411c4e8226ddd34ccb803180c90a0b3f7cf044ae62d007031b6279bc416146", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340750, "uuid": "14f69d03-2a74-43e4-8a8f-5456ddeec57d", "value": "T13474C0866BBCA929C57D37B18A55A51082F2E0CB91BEF35F4882B1D913727C05FC17B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340750, "uuid": "49f6cd93-7446-4d63-831a-578b2c9a7034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340750, "uuid": "78a7d055-3d65-4fe7-aa99-383bde3e19a2", "value": "6144:6ETMfpi+RMivwBCC6FlQtqTgTg9NGgV7/CMfyqhIx1trnV/thHVD:6KkRwmjQt+TPbV7CMFhIx1Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340750, "uuid": "0b41e34c-5a7e-4722-aafe-28b784dfbf56", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340750, "uuid": "9d68f419-3a68-45eb-a083-66a221dff379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340750, "uuid": "849b8068-7f97-4163-8299-bcbdbaf85664", "value": "b6dd845783ee203570dd1406f5b7c342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9387bff9-d204-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652367763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367763, "uuid": "660624a4-1096-4c10-acdc-7047e00d4f2c", "comment": "Malware payload (AgentTesla)", "value": "6c510957c26db484e750d3834eb7a071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367763, "uuid": "dbfda5cd-520e-461b-ac12-41139cb899da", "comment": "Malware payload (AgentTesla)", "value": "200a8761ad54a3eeb3039a37d654f3be76efcdd5a51b1f6f9f4b9584dc998e1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367763, "uuid": "47afefbf-71de-4d67-8428-cad644d168bb", "comment": "Malware payload (AgentTesla)", "value": "8addfedd831f65e85bd9bb7bc27f04a69d45dcf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367763, "uuid": "a3d1fe06-3b10-4c27-9663-94c5aa230a7a", "comment": "Malware payload (AgentTesla)", "value": "544b9411f3fb4cdd76777cbac464615c50363e4299674f4adadfdcf8f2da99fe008667ca516e5a3687d171359b2a948c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367763, "uuid": "99610dae-a873-46d9-ae26-b5a8e9c52833", "value": "T1D9A4F1192AFCBF32E83D9BF50A107A04A3F756779270E3986ED6B4C310A5F4485A0E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367763, "uuid": "a57bc8b9-a48f-42c1-a938-24c3f0af1771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367763, "uuid": "94c27f07-c902-46c4-81b2-106de2385f1b", "value": "12288:wPqSSSrsBhphNyXk8ejoPo0sBwT/BIxdSG1rfUPeAXa6:+UBhphNN816U+jU2AK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652367763, "uuid": "a1c21997-f9a3-4dfb-92ac-75d75b971bf6", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652367763, "uuid": "75a422c5-2e96-4be8-8ed0-092c1da61bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367763, "uuid": "4794b2f4-2953-46ad-a7c0-3cfcc6e90eed", "value": "6c510957c26db484e750d3834eb7a071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b009aa43-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652379408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379408, "uuid": "c9d8401d-743e-49bf-8712-44750de32923", "comment": "Malware payload (njrat)", "value": "17f8fbfe9d647d5354827d081112874f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379408, "uuid": "8e2bb8dd-3492-4fe3-990b-7d5a1743ece7", "comment": "Malware payload (njrat)", "value": "202cb2eb623ccf7ae33494a8a98f172baf69098ffede6d483f468b8d7820cc94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379408, "uuid": "01fa63fc-3b3f-4450-b5b2-108ccc0a5b93", "comment": "Malware payload (njrat)", "value": "266a8a38a1d241aeb5696af218125bebd95b91eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379408, "uuid": "d1c94b5b-55c7-4d08-ba7e-d269f8b82b9b", "comment": "Malware payload (njrat)", "value": "11066a1e06e76a609cce93fda6465638703f2dd18c1ec9a4b0a508c3393786d669bf4c5338c57fba5126dffbfd9cfe3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379408, "uuid": "2aded321-f683-474d-9638-8bceba7d30c6", "value": "T1FE033A4D7BE1816CC5FD157B06B2D41207BAE14F2D23D90E8EE664AA37636C08B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379408, "uuid": "7d6aee6c-15a1-4f03-8a80-a8695bb59806", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379408, "uuid": "9feee412-944c-4022-8711-4a6b7d02a279", "value": "384:yqdMiLtBndznNCyMGm5savhjcGmTbhrAF+rMRTyN/0L+EcoinblneHQM3epzXGNy:zzRNRMGm5tJ1mXhrM+rMRa8NuYEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379408, "uuid": "89a9ff11-a8f1-47ed-9e10-d03e26d9c099", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379408, "uuid": "b5ccc235-6e0e-420c-8465-d80189435a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379408, "uuid": "a1b56eeb-7248-4d2b-9b94-17bdc313584c", "value": "17f8fbfe9d647d5354827d081112874f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c61349-d232-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652387633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387633, "uuid": "a5175393-55e1-4934-9af3-702e804997f7", "comment": "Malware payload", "value": "c2102a5db711cf89b1fc6208676f2100", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SendSms", "colour": "#D3D0B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387633, "uuid": "7db1a79a-7df2-4eba-a6a7-a67beb8b9c75", "comment": "Malware payload", "value": "20736d1c51fa0479691e3a2d8fba3ccd2d195fcf7f73b870de743b561384121f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SendSms", "colour": "#D3D0B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387633, "uuid": "93f53bba-8e30-423a-bd4c-e6b8033ec662", "comment": "Malware payload", "value": "160698aeac9bcbf66e4c54cd081230b21b72646e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SendSms", "colour": "#D3D0B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387633, "uuid": "e635b058-aa64-48ac-b4ea-d483ff42884e", "comment": "Malware payload", "value": "58ebe3f6c886238088840b8ca74bb8900b62fb521730d57642c1d856468d86d21c6f683fd95033293beb797e1ee3ab8f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SendSms", "colour": "#D3D0B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387633, "uuid": "459da008-8f41-49e7-86df-8afc6a145759", "value": "T1B754F147FB89E856E63BC13667E6461378645C40193AEE33570BB61C0E7398CCBC6B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387633, "uuid": "4f880bd0-b58f-4dca-97d8-7a7eaaccb68d", "value": "6144:9KqKcRsDN8P9M03pHK9irHUo6G6HOG6IAI2f8:9KOFNKM/IOGkIo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652387633, "uuid": "aee97636-8efb-46ca-8354-af35999c3728", "value": 297827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652387633, "uuid": "c417ac1f-6af8-4772-b2fe-1b7c59100d61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387633, "uuid": "ed0c7c25-1570-4fe5-be61-0b6b8df05613", "value": "hushsms-v2.7.8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7caeb4aa-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340667, "uuid": "feeaecc2-34f8-44a9-baa2-7fc8b1c3ecf1", "comment": "Malware payload (Loki)", "value": "0707fdefc009742f2b71bd74f94f541b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340667, "uuid": "1d86fc0c-8373-471c-9942-8cad9e503406", "comment": "Malware payload (Loki)", "value": "21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340667, "uuid": "e430053d-faef-4aea-8521-d1d1716436fd", "comment": "Malware payload (Loki)", "value": "97f281579aef9feb7f7f13f08d12add1004b05c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340667, "uuid": "1c552064-91dc-4294-8e3e-57fb09beff33", "comment": "Malware payload (Loki)", "value": "644660d77d5a3ddb05be25c86cf54e4e6898638009faad5bde38dfcfb703989a929993a2f59f224c4126aa7e004c0456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340667, "uuid": "0d02a847-9cf7-4021-9fbf-1b60df4910bc", "value": "T174040201B5E4E017FAE73B314D3B57264EFAD91220B5422B57443A2E3DA5393EA1FB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340667, "uuid": "03833a95-5455-414e-a74a-2130d6f62073", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340667, "uuid": "d696cd6a-cc49-497f-b55b-2570a0f07eba", "value": "3072:LODZGPEounbuwAxZW8cecaVaHEbwKbTgCtdHpSgb4DUG8KfM4FB:LOtIOuwATxceaHQbTgySgbfG8KfM4FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340667, "uuid": "ef8790f9-bc04-4637-9fab-a0113e87d423", "value": 183170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340667, "uuid": "c1087fe7-553e-43e5-b58c-966af70ff1d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340667, "uuid": "2c314d75-5447-49dd-8f32-c337c02670b3", "value": "0707fdefc009742f2b71bd74f94f541b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958e1a5f-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652349298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349298, "uuid": "5559ecb3-09c4-4fb9-a4de-ea6342e5f77a", "comment": "Malware payload (Heodo)", "value": "91bc9cf06efd47f95bd4cdc82bff5f0c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349298, "uuid": "49b858a9-824f-4840-a7f1-f995e778b775", "comment": "Malware payload (Heodo)", "value": "218865e4fe9157772ff3b33ea20f7efa8def2897695b12bb9a1d60538edbb0a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349298, "uuid": "34029b10-5deb-4d95-965f-056550124d7e", "comment": "Malware payload (Heodo)", "value": "a60ba59c762b69621b8c7a21e03d9dc5b2ff0a4e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349298, "uuid": "1a3f16ee-3a2c-4ec6-8819-e7ae4c35d0f3", "comment": "Malware payload (Heodo)", "value": "1f6123e5668d5c1b99b77da15e88402d0984265d7cde7527e3013e2cba7c8d145d9639c7a680167c19ab3458347387fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349298, "uuid": "3d62ffb6-959d-44ea-8e24-4dd4f515e820", "value": "T1CEF47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349298, "uuid": "bb09e8e9-eda0-4cb1-8064-2004eceac312", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349298, "uuid": "b281bc2a-1b58-4f56-86e2-d961160c0ad4", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSOjNwgraKRT61cKGNx:S4DzZKnH4LRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349298, "uuid": "cbcbb3f8-d210-4b9b-9771-a909a94bee71", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349298, "uuid": "278f2fc2-8c1d-4118-bc6f-8b0b076318c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349298, "uuid": "94f605d7-f4ae-45af-991e-7cda0128711e", "value": "91bc9cf06efd47f95bd4cdc82bff5f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c4cf7-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652374085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374085, "uuid": "4116c6da-8de1-4333-8508-761fd1ae8cb7", "comment": "Malware payload (Mirai)", "value": "9871ca0e15df4665fc3587d7c506e39c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374085, "uuid": "9ecdb1c1-8a15-4e7b-a528-872d2db68ff2", "comment": "Malware payload (Mirai)", "value": "21efb926636a7582e1099be456005955a14f631e7848944d3b461f84994c3bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374085, "uuid": "bccbf6e5-65b0-42c3-a560-6c957b7eab6c", "comment": "Malware payload (Mirai)", "value": "ed2e772bc834420f569966db3f9f1f356dde7fdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374085, "uuid": "f788d8c5-9c90-45de-be1b-af19e9acb8aa", "comment": "Malware payload (Mirai)", "value": "94db183c3eac03bbc2d3c798845bf784eeccf20cda3915a5ad6df49ed378016b36c12c288203f17962965fe85efc2c16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374085, "uuid": "7ed8cf13-d7ed-4691-942c-fdd061a3c6d7", "value": "T1F03329DBB4029E7EF48BE67A405A4D0AF53122C11193172373BBFC93FE32154A952E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374085, "uuid": "7c972d62-e9c4-4bdb-8fd1-1016a286afa7", "value": "768:/vSPF+B8oMC+uR1PQxbJR/gFHxHAEuR8L8v8b974VkfXEBfvob4V:/668IDI6FxHANR8L264VkfUBfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374085, "uuid": "5da8d9ac-4de9-4231-9b4b-ce8a1354fbab", "value": 53544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374085, "uuid": "5ad862b0-39ba-4f20-bbc6-2b811bcd87bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374085, "uuid": "10d1d92b-9ff7-4c3d-862f-4f0da9b6695f", "value": "9871ca0e15df4665fc3587d7c506e39c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5593216-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652376947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376947, "uuid": "d3b78f06-8469-4179-b83d-fc54f78d530b", "comment": "Malware payload (Mirai)", "value": "ee36c4afb59a6c3bcc5856a1af5946ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376947, "uuid": "8294df00-cdea-4a25-8764-64d35118fbd0", "comment": "Malware payload (Mirai)", "value": "223ce32992b7acc151bfe83c453581e19b98a509cb1ce7a7c81156d23a303387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376947, "uuid": "e1f2e6e9-99b7-47d9-bd54-90a60ca3fc56", "comment": "Malware payload (Mirai)", "value": "1bbef9d11561f56cc73218e678ca6c1f275dd03f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376947, "uuid": "06afdc66-149d-47f4-b02f-9e2974c82544", "comment": "Malware payload (Mirai)", "value": "9375b25c66b306abbbbf28deca9c8103d897229a4184317b9e7aab4c0a7281d1769d299bc614541606a12b6daa95f209", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376947, "uuid": "54b7af84-abc7-45fa-aa76-e9eb4dfd8efc", "value": "T192C32B05E5508757C2D3137AEB9E865D37331BE493DB33215A34AFB82BC2B991E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376947, "uuid": "16369ee2-2d94-483b-8b9b-d591374a2d02", "value": "3072:Q/3OhB+hkn0RaNGaXa8binDMIpOeWj+m1QOY54X3cn:QmhB+hkKGGaPinDDWj+m1QOY5e3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376947, "uuid": "9d81d906-32a8-4399-bcb5-36e303766fe1", "value": 127857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376947, "uuid": "ca59942c-eadd-43d1-b042-ba909a6be2f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376947, "uuid": "9d6cd24b-3053-4473-b82b-1e1534529cb1", "value": "ee36c4afb59a6c3bcc5856a1af5946ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ed0821-d1cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1652344152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344152, "uuid": "7e92b1df-f111-4724-bdb8-a9852f578150", "comment": "Malware payload (Nitol)", "value": "7e96c0632de6e78c0c131f8959225b4b", "object_relation": "md5", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344152, "uuid": "41dddf69-ac84-45c9-9b7a-088b93174bc6", "comment": "Malware payload (Nitol)", "value": "22ccb77e49e84ac54df52f1ee1b991b3f8f4ccd44ff9269bd5111e7a800aaf39", "object_relation": "sha256", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344152, "uuid": "67d82a66-231d-44bd-85af-d4d3445a30a1", "comment": "Malware payload (Nitol)", "value": "7d83a4a642a368afef1a2a01e97fb93c2b4d0411", "object_relation": "sha1", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344152, "uuid": "3325de12-dc2d-4586-90fc-40dfb288c90f", "comment": "Malware payload (Nitol)", "value": "95e9537c449e6e2a7c7b2f0a49050e981aabc64ec38844434b9119ac36f7641a8025231d0689031293c5928c9e7dc8ea", "object_relation": "sha3-384", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344152, "uuid": "5ad94a51-aa1f-415a-8a2a-fd9a8ac401bf", "value": "T15DB33C6A99D30D63D505973086E325F32FB82CC738921B3BA7D59D6C28962C453B4AFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344152, "uuid": "1424ecca-db2f-4948-8a0f-2d8c730f1fdd", "value": "6b41b49cb60c6234a51830ad22997a9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344152, "uuid": "f9a62aac-3a17-4a91-a08f-a89eeb9267e4", "value": "1536:g0Ywk9NNLXZsKUvwwF3R1b1yt3CniV/s5gqt5jSETmu1kC:g0czLpaBR1b1yVjVU5p2Equ1kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344152, "uuid": "176fe8b3-ff88-406f-aced-06a396a95291", "value": 111816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344152, "uuid": "0e1e4719-fa7d-4d84-8020-7c5c3941baed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344152, "uuid": "01882a55-865a-42a1-b81e-8cf438ed9c33", "value": "22ccb77e49e84ac54df52f1ee1b991b3f8f4ccd44ff9269bd5111e7a800aaf39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c56780-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652338048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338048, "uuid": "6672712d-004c-4ba8-8630-242e34dd7ed0", "comment": "Malware payload (AgentTesla)", "value": "5f2920a556f870f35f5609c53e0c1d0a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338048, "uuid": "9a8fd111-3148-40ab-8a61-6f17b60dea3d", "comment": "Malware payload (AgentTesla)", "value": "236e5b7ca445462a27cea2f125c98d1b2db93c1d3ecbaadd4bbfe2c402247769", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338048, "uuid": "0150aad7-9176-4e41-9eac-12ed0588eabe", "comment": "Malware payload (AgentTesla)", "value": "3c9e4680e0289f0d41cd72f9270a2e58dce84fe3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338048, "uuid": "b9a35237-43c7-478d-b5eb-7a01116906f9", "comment": "Malware payload (AgentTesla)", "value": "bb7751514ea1ab5c4c676d0f379461e8435f70a0a36b762d05d2ea12ebc51f5c4196513579f0d55d8f1f6bb0cc103d3a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338048, "uuid": "cd26c590-d7ad-4bff-b35e-2418db3a01d6", "value": "T149B423C0B1D546931E86B18061E0E7BD0C4BAABA9D6EBD9CCF4379F6540ADD8E41F603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338048, "uuid": "7663fc66-c8de-4ff6-8e09-6a7be62146c8", "value": "12288:qXHL9hYqH+PimTz0h1GMjkMgcJNcqEKZ3Gk/D7cWZ2f:qXL9SqH+L0LGMoMg3tKMk7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338048, "uuid": "0e33ad04-008f-4457-8598-ed1b9ea5bbef", "value": 518823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338048, "uuid": "5eb51c7f-ce97-4b83-88ae-33f4c18ced9f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338048, "uuid": "2ca0021e-a2e8-4ae8-8ecd-a5c733042fbc", "value": "ECU.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad917809-d1ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652357499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652357499, "uuid": "7a44b9df-80df-4b4e-bb49-f3d9f6fb829d", "comment": "Malware payload (Heodo)", "value": "679d7aa7b8373f42e380e08581092f32", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652357499, "uuid": "08a47769-6f72-4014-bef2-70b2b5cde4a1", "comment": "Malware payload (Heodo)", "value": "23f794cc8a7022ea9c31ea6dbb8a6235d805b60b52a837d538dc1be46c1ce468", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652357499, "uuid": "72e91c87-107d-4e1a-a1a5-9a63731995da", "comment": "Malware payload (Heodo)", "value": "620027ac4f1ab77136a598a66e5de6504e873215", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652357499, "uuid": "e627338b-1082-4f60-a16b-50535d775bc7", "comment": "Malware payload (Heodo)", "value": "ad66528e596a902684a052ea7a0099b8e6eebf0d877b82525d91121a1bd92f72bf6e3bbc3a80d4ab6b37b9868038bebf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652357499, "uuid": "ac9c5cb6-c43e-4ea1-bfff-b80b429b17be", "value": "T1A203834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652357499, "uuid": "2142f616-1d4a-4b85-872a-1f0bdf0d705d", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAg:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652357499, "uuid": "91a5b35b-f12b-4c74-a872-9a1c23e0d978", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652357499, "uuid": "1735a724-3e7c-4415-ab28-443aec7cdfcd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652357499, "uuid": "706ecc2b-d16c-44e7-b2d6-6aebea64265d", "value": "SCAN9265_0005.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dd7154-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652345855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345855, "uuid": "bee55fb6-42ef-4cbe-ae5c-6c16b27e1b13", "comment": "Malware payload", "value": "ee25ea170828c7111c536d48f469f516", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345855, "uuid": "762850a7-56a9-4d63-8511-0d3c7f6d85e4", "comment": "Malware payload", "value": "24222e97f8ae400850533cff9f26678b80b2df48c17a56904f33091a56379163", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345855, "uuid": "8b6c71f7-8ba3-4403-aa67-c3bbee4519fc", "comment": "Malware payload", "value": "ddead2c2e125f122be3abec722bc3540bb27521f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345855, "uuid": "6c2c1e46-a150-4020-88c7-117d47dc3b51", "comment": "Malware payload", "value": "c09a63613e62fe6e07d3054a39ae111f1f6bc4582a7aa49549b8de7b347936fb115f187fc745253cfdc4be2dd79c923e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345855, "uuid": "6669fe96-201a-4e0c-82b0-22d95343b382", "value": "T1C57405B6138443A6E1C44BD0855E720F21F6D16735A82589EFF32DEBBC29ED76438272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345855, "uuid": "ec187658-4632-45d5-a34e-6415341ecece", "value": "1536:H4LaG68+OHLBdjelL4goAP7FTRubySSksvYFcfiueXA82nqBcQxfJ6fB7kSOWO99:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345855, "uuid": "1e7eba6d-632c-4419-a535-d917b0299130", "value": 349432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345855, "uuid": "06a6c497-9294-4dc1-ad00-fabaa3d61545", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345855, "uuid": "94031988-eb6d-4f87-8f01-e3d457ae8876", "value": "A.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420cb3b8-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652399409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399409, "uuid": "3ada04c6-8c7e-4964-ba85-f81c55d03afa", "comment": "Malware payload (Mirai)", "value": "ef88c5a203c03b2edfa119b30d41031b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399409, "uuid": "d6898eb4-ed34-4a22-9965-4829794cc1df", "comment": "Malware payload (Mirai)", "value": "24d0ea98d633db96d1cd6c5e1c4cfca0bef0e5b6ba2509c21c432872e8c40eef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399409, "uuid": "225bfede-90f1-4a7e-ad7e-56ede1526944", "comment": "Malware payload (Mirai)", "value": "b186de7ec5e179e95a712b641e49defe59e17fd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399409, "uuid": "561ed30e-2973-4901-9529-e61b66c1d730", "comment": "Malware payload (Mirai)", "value": "f8966ffe10103f2290aa65affc5ba4e5fcf1ed1f3a15bd3649fce8e259d1476d42a0fcd7b3772269f81e57175d753f2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399409, "uuid": "d22f9639-3aa9-4cb7-836b-aa6f212538f7", "value": "T123934B85BC41A622C2C9127BFA5F028D375513D8D2EA7317CD249F6073CB92B0EA7B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399409, "uuid": "f2923cd1-2cf7-4cbe-b8c4-b67cd22fbf21", "value": "1536:mN045agr8SLdxf7yHkiuBcwROD8nvTSeY2p6ujnRO1j6s4VI3Mjv75:mN045agr8OdVyaFbbjY2pFs8zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399409, "uuid": "3c6556f8-bae5-435d-9d7a-7d623f238d22", "value": 92920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399409, "uuid": "0a1084e3-dc34-47f5-8a8e-34dc2ed5f8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399409, "uuid": "91ffe5e2-bd6c-4f22-ae47-4af417aaa046", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c2344c-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652337217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337217, "uuid": "db04c702-d0e6-4c21-8964-b6fb5d62a179", "comment": "Malware payload", "value": "ea7f92ea00308d8c94e91f36124d3fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337217, "uuid": "ec5a6bf7-33cd-4c61-950f-b1b743b4a42f", "comment": "Malware payload", "value": "24e6ec7f3896ecb39f4ea242a7071f1805e9cbd58add8a39fad1b4bbac1a164f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337217, "uuid": "8a2a7069-41e1-4cc2-b94c-f401643a67f8", "comment": "Malware payload", "value": "00d843becf491d39b2a0c187933fdec3d2cd6a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337217, "uuid": "23e8eea3-d0cd-4af9-9450-4d15cd03cd91", "comment": "Malware payload", "value": "d8adf283ad7093b8ff1904d676e697b017bc2fa36f7d9200dd0b46212b273b9f1b96930f136f9632d7b020a94638eb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337217, "uuid": "f32bb8ec-dafe-4b68-84d9-dc1a30d0d807", "value": "T11C1633760AC68C72F5BB297CF934375077681214CF0F9EA70BC2F89BE76019A6291B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337217, "uuid": "6d062eb0-fd1b-4c0a-8da7-5c65cb093afd", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337217, "uuid": "3dce1a2b-cab2-4f4d-b60d-4e40bbe801a0", "value": "98304:aS+JcrhT1gJvD+JoSHE1do5wt3UPoFDe7HeR4U:jlGJvatMdfFBFDe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337217, "uuid": "5842dc40-ee47-44d6-9708-4bea92b94023", "value": 4221440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337217, "uuid": "88919699-3199-4a59-9a23-76b62d69d018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337217, "uuid": "64ee2ce1-4863-408b-b1f4-42f4b9335943", "value": "ea7f92ea00308d8c94e91f36124d3fba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02842179-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652344327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344327, "uuid": "a38384fb-9b40-42f8-81bf-4d0a4467d980", "comment": "Malware payload (Loki)", "value": "b2f075e56e759d2151c56599cf1a6930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344327, "uuid": "8978082a-1e2d-4dee-88ef-7c98cf93a9a0", "comment": "Malware payload (Loki)", "value": "2506b2a02661090a54c83c345336f60cdf5bacbb344b40a9de074b2581b7b442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344327, "uuid": "8f31e230-dfc1-427d-bef3-5a09feb87631", "comment": "Malware payload (Loki)", "value": "5c0ec4f0832a11c61708063dacb01ac3203a118b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344327, "uuid": "ba19a16f-cda4-4b67-a3e3-b59340f16238", "comment": "Malware payload (Loki)", "value": "cff0a31abdfebbcf11e3ae09bdd5b792f7a76202547c56c2696ff60224229c6ce0bd44fb71b81d432d847e539369d808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344327, "uuid": "0f34f7ca-4213-47d4-b75e-3ccb109085b5", "value": "T193941214B23BE922C11E8F36CDE141CD23759F079D23E65B699A32AD573378608D0B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344327, "uuid": "73bbc367-d060-41ce-b5a0-a6049c03de6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344327, "uuid": "d2b4bbb8-145c-48e4-8983-20f06157af32", "value": "12288:xVzTK4EOl1bxGwjkjcoqPSnxL74tqMLpV18u1isorr:iXcNG31xvrW/1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344327, "uuid": "bbd262c4-1d84-4835-a1aa-485b29006947", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344327, "uuid": "2421909c-798a-41c0-a56b-22e7512b9305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344327, "uuid": "314c1961-9cd1-4db0-8404-ce3307286b93", "value": "Doc 2245386.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb70571-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337633, "uuid": "0232003c-4409-43b9-9e06-7fb5ad6692f4", "comment": "Malware payload (Gafgyt)", "value": "12da05beef9e09a47dd290e64d46d99e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337633, "uuid": "9777cf46-d5a0-4000-9bcf-469d6f154d30", "comment": "Malware payload (Gafgyt)", "value": "255dc7b1fc8ad08bbc98a54fa02d1294ad70620f4d492471eab461f623a2855d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337633, "uuid": "5f3a299f-0433-4244-9641-c7af1268c12b", "comment": "Malware payload (Gafgyt)", "value": "d6e4a7bc336c7479129cc58cad5bd1e78471b225", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337633, "uuid": "d9f9d139-043c-4885-aa08-ed8db014015e", "comment": "Malware payload (Gafgyt)", "value": "c922caf67ac249fde68dd0d3c63e84cc55e450bde4b6eb2c77e37a523460cbcc4ea834e09a85e5e88788a06b7c3fdf25", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337633, "uuid": "127bc8d5-272f-4fed-8c2b-349ce941ef30", "value": "T17B836B23A651C6BBC0875AF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337633, "uuid": "1591cbe3-a3c8-4516-8c0b-44fc23a12809", "value": "1536:eB7cH1LhKlBqISVhuzdPQq0aJP9sWtjG7ew3nDuWgf6UmoIYuOVje+ZNne:eRMhKlcduzdPv0o+QK7eknDunVmrYuO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337633, "uuid": "5fc9b40f-268e-45a1-a84c-ea9888071cd4", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337633, "uuid": "3ab85e88-ad2c-4db5-8bab-715cce0e9b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337633, "uuid": "981eabd7-b00a-49b2-8030-17a9394642d1", "value": "12da05beef9e09a47dd290e64d46d99e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1719f828-d228-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652383016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383016, "uuid": "888e0116-5084-4e07-9b6f-2a24d606c28a", "comment": "Malware payload (Mirai)", "value": "5b0897df4d4ffc49c1d0a6e00c10b3cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383016, "uuid": "ff79f08e-2ad9-490d-aad0-a10ec086a97b", "comment": "Malware payload (Mirai)", "value": "2573663b8cb4b53589c8f380a27c3faae853c9b692b08cf745ca77902b636a5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383016, "uuid": "1162f943-1f36-4e23-b48d-6ae71689c489", "comment": "Malware payload (Mirai)", "value": "2408ddf50a3c98f76da1f236005f489981546a84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383016, "uuid": "e0473033-6911-46a7-8120-90e5aee2fa7b", "comment": "Malware payload (Mirai)", "value": "830120a4033d8ca34c4e0c6ff09ac372000a6d3426470710f19ed18995430d27831c2bc70ac62cb0709b126182bd972b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383016, "uuid": "eb919af5-69e6-4979-9b5a-0dc0e224d411", "value": "T151735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383016, "uuid": "ca382b42-1e3e-4299-93a2-90778cac7292", "value": "1536:DNpp9RXI1vgi0uvQ8zomz7KRyxOReqpNiSejOjNfXM:Xp9djCnomz7E2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383016, "uuid": "bb2b39bf-9f08-4ff8-bd97-436b80b05353", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383016, "uuid": "9fd93173-b560-421d-aff7-34297b0e63c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383016, "uuid": "38ee6454-0209-4ad3-8ae4-612e653b9f87", "value": "5b0897df4d4ffc49c1d0a6e00c10b3cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49dec97-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379388, "uuid": "5e264711-31c4-49a1-841a-46f36cdf25f4", "comment": "Malware payload", "value": "2f48b6809de0acce42e377d8b2fd5049", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379388, "uuid": "f157b7bf-05ae-4f26-a369-1df80850cc95", "comment": "Malware payload", "value": "259518a496109447b034617a355134c82def13d7987ff0c787865070af2707c8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379388, "uuid": "3b0bddb9-b6cf-4845-8a8d-82e9dc20e823", "comment": "Malware payload", "value": "1d4a5799cfb584042de5b662e4c8f4b32621e394", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379388, "uuid": "738005af-e75c-42d3-be40-2f6695dc5349", "comment": "Malware payload", "value": "5b91535b08d6ac834c70b611c4884ac530b7cd0f4abf8b5a573cd06c4448fa59f9e0e935d4dd64bd906891e6771d8b95", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379388, "uuid": "94288b47-c1e2-4eaf-a0e4-b082649d389e", "value": "T18F9204872FD8F977FB6F22370B5D53A2D6E7AC5336019026294D32E80E794486E41E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379388, "uuid": "22ccd1df-c62c-4c9e-9b25-baed107b1064", "value": "384:7Q1MOIASa2LMDeDggAOj7gi2RCtK1rI+FSdXn:7qMOGRQD2gQX0EG5FkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379388, "uuid": "f5598d95-6b42-44d2-a724-88d6810dce84", "value": 21016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379388, "uuid": "1d3cb777-075f-4b0d-850c-090f72a63448", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379388, "uuid": "aedd2aa1-d201-471a-88d5-a9f4e23817ed", "value": "Invoice-Transfer Details 13052022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4916de9d-d1f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652359908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359908, "uuid": "f6ccb694-81fd-46f8-bc6b-52e16ce71f64", "comment": "Malware payload (SilentBuilder)", "value": "332de1085f32d14db440ca2c32f09513", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359908, "uuid": "bb04e4e4-4b94-4528-ae0a-5c7b11ab88c6", "comment": "Malware payload (SilentBuilder)", "value": "25ca037303bc4ec3460eda415ffecf9c7692414208586c0bb30daf8a72f86fbb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359908, "uuid": "21cdaab2-9741-4a98-800a-33d41d9b599e", "comment": "Malware payload (SilentBuilder)", "value": "75a3be9351d3810e11e821800409a64d17a64c09", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359908, "uuid": "a39e3fa4-83ff-43fc-8ad8-32a4619d8a10", "comment": "Malware payload (SilentBuilder)", "value": "7f03a9725c4805b66ba02c0496cde32411f5c0f89f52e267b7b55b2dbe3e84afa71e8e99a48905bcfea4079f46657c47", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359908, "uuid": "52f1fbd1-59b6-41f9-af51-66f01e08f9c8", "value": "T13E03834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359908, "uuid": "870b4f28-742c-4980-ad73-8874d042062a", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652359908, "uuid": "61b0d195-ad0b-4f7c-872b-2606e39c7cc3", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652359908, "uuid": "da4950a8-17de-4035-a644-357ea80f67de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359908, "uuid": "441714fb-8275-40f2-8f23-1f923614b82f", "value": "UUJ0106845874097292093.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c394e337-d1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652353671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353671, "uuid": "f15b64f5-76aa-4796-8138-e44db9d29f5a", "comment": "Malware payload (AgentTesla)", "value": "c1720841e17b7111f9dd538f478ba4a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353671, "uuid": "1352b7db-a5b6-4d52-9378-611ca10c9a0b", "comment": "Malware payload (AgentTesla)", "value": "25ee98987e54687b0057624735428aa76020c90f86af8a8aca40c300c914a3a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353671, "uuid": "38914642-24ce-4d33-b521-2961e39329d7", "comment": "Malware payload (AgentTesla)", "value": "5363287701792036a7c553fbe4a622064b43a95d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353671, "uuid": "19f436ea-cde5-48a9-9380-d24708bbee4e", "comment": "Malware payload (AgentTesla)", "value": "99a1e414b14d76a0e67180dbe72f2c5caba28294acd508288d279ec1e6439654ca1ed01c0fee14c0d89a81f9bc946688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353671, "uuid": "a8f4954f-745a-4e35-b1e2-069f4df56b65", "value": "T139C4120633378923E5A9463BCDD510DC67B0BF079C27DB4B28E53586AA337DA4E81A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353671, "uuid": "6b8a6839-6fdc-4014-aeb7-a3ed587f139e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353671, "uuid": "94b1915a-fd1e-4672-8e0a-0295f121fd53", "value": "12288:mykCoOAjXDM+yzmtrpu001xlSzTCDgEM+i6v73ceIqTRGl7D:A/NX1t404OT1zKYeIMk7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353671, "uuid": "eb17a483-1f28-43b6-b2fd-c2c2e1d83a54", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353671, "uuid": "bbecf40d-9418-40bb-afc7-8e7516621f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353671, "uuid": "c09ae8e9-be4c-4049-9b7f-7e96383f2079", "value": "Purchase-Order_excel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0778443c-d1ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652342618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342618, "uuid": "41b436a9-3c2f-4968-a693-f1daa40d03fe", "comment": "Malware payload (Mirai)", "value": "c80ef6ed00edf2b8145018b71fccf77f", "object_relation": "md5", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342618, "uuid": "d8c4372d-fa4a-4ab8-8f0d-ec9625e3c628", "comment": "Malware payload (Mirai)", "value": "2684c02ad85a92e0563c09b6ca3645b095e0138270d552509c2bdffbdddf2d2f", "object_relation": "sha256", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342618, "uuid": "34d12bed-632a-4bb7-9e1a-bbd65f700849", "comment": "Malware payload (Mirai)", "value": "3902207b811161cf5f07ea5e674083bec5ae5bd8", "object_relation": "sha1", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342618, "uuid": "8677111e-fb1a-424d-b2ff-88532dcd7670", "comment": "Malware payload (Mirai)", "value": "c73a7680dc6ed9ee27f1aec2c9cd48523c346775e0186dfe1e8b811313256fd04ce3386d9c508c180f1e7a50220e2f18", "object_relation": "sha3-384", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342618, "uuid": "319001ab-1b59-4329-9fb9-07630305a3a2", "value": "T13A23930ABF604FF7EC6FCD3745A81B45349C640A22E57F756A34C828BA1A54F46E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342618, "uuid": "21a7c2a8-c52e-4e26-975a-10d59822e762", "value": "768:xs48Vs3tvORlTC1xUQ2ATOPxeLe7zeh5OIzYEXiznnYDt:xs48VsdvORVCbUHJeKz65jzqnot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342618, "uuid": "eaf688fa-816d-4754-989f-f5758a69a8a2", "value": 46856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342618, "uuid": "c9847c3e-692d-4e04-8254-1cd0eaa17ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342618, "uuid": "0daf9569-8f15-471c-ac73-495661d711f9", "value": "2684c02ad85a92e0563c09b6ca3645b095e0138270d552509c2bdffbdddf2d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35ae5b4-d242-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652394472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394472, "uuid": "2bb77c8b-dc77-41cc-9ae3-e8cdfb95c259", "comment": "Malware payload", "value": "b3294f8313f7ddbbe4701d4d54285f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394472, "uuid": "725041ef-c5d1-44ef-a5ca-19dd851a9cf5", "comment": "Malware payload", "value": "26aed97270e8f626d65badd5b2f8266a329276580aed3febd6afaa4738c949cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394472, "uuid": "38a2e129-3d0a-4941-a7d7-f36a5a4e81c3", "comment": "Malware payload", "value": "34418206eb8f7a9bc20b14a7a58789af80622457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394472, "uuid": "7b6257ab-37b5-4fb9-baa5-d60494957f25", "comment": "Malware payload", "value": "b8503b17d3737b2ad5a10ae757a58c3f80941d84575e9022aea4e9842ef3320847a46afdf3b2f8f103e761739ddb0ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394472, "uuid": "01ada846-606d-4242-bd1d-994c4d55ec1f", "value": "T158E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394472, "uuid": "236f3165-707a-4f85-b881-2d53518439a2", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394472, "uuid": "95def993-da9e-4db8-85eb-88760c8cc61d", "value": "6144:mkajLyaPIvW1TFpvzYNB1MCB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8X6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652394472, "uuid": "8727d138-177d-424c-b3bc-713b47e3dbc1", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652394472, "uuid": "454d05e8-ac43-4e5a-81ff-0a86cdb9b60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394472, "uuid": "fdd25a5b-59cd-4249-aae0-0096d3461165", "value": "b3294f8313f7ddbbe4701d4d54285f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da48f417-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346837, "uuid": "cdd38c77-a207-44a0-af94-d17e01a2c690", "comment": "Malware payload (Heodo)", "value": "5ffc2f8ef67ce332fa4321aec608ad48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346837, "uuid": "68be014a-ec25-49ef-b269-b29a2113e8ab", "comment": "Malware payload (Heodo)", "value": "26e678c8077ebc02ac08f7dfc5f75b588966bd3216502327cf775fbe432b12a4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346837, "uuid": "2396c27a-b9d9-444d-a442-660b097ae6c1", "comment": "Malware payload (Heodo)", "value": "8bdd477cbbf366f9260c3b2c80439ce7aa59d7ce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346837, "uuid": "60015157-2794-47ca-98d7-f0d8d692510a", "comment": "Malware payload (Heodo)", "value": "38d97b385a012fe4d9299d915dbbd638866d7ae1962f13716c3f289de69701f3b48ffbad8b62020cdb05aa7b87b49eac", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346837, "uuid": "9a510d7b-19ce-4c4d-ab43-be39ca823397", "value": "T170F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346837, "uuid": "a73e8905-37e0-447c-a3d2-b1b2fd046a18", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346837, "uuid": "cbe723b6-bcd2-46bf-9f98-53c70a7cef21", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmS4jNwgraKRT61cKGNx:S4DzZKnH4dRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346837, "uuid": "bb216eed-e3c6-4f52-aff6-cb645851329d", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346837, "uuid": "1b6601e1-d551-4960-9c29-e49ee03ed3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346837, "uuid": "a8c6ec67-f6e7-4160-9743-c11b7d978ed2", "value": "5ffc2f8ef67ce332fa4321aec608ad48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d1e0ac-d1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652352607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352607, "uuid": "407a54bb-8106-4fb1-ad59-e52947d9805f", "comment": "Malware payload", "value": "bd2d10b67a1034a9c926c2aae65fb68f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352607, "uuid": "0e531a0c-d96d-4643-ad69-f24b6e6bc963", "comment": "Malware payload", "value": "27df42866fb21c178665f0a49b173f1f8b31f4ab61eb07b4edb86e1e954305ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352607, "uuid": "1d7b53f9-8852-48f1-946f-86de1bb0a2f9", "comment": "Malware payload", "value": "8946be9106d77ddc5eb4285ecd37079586830368", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352607, "uuid": "3331a5ae-6cde-4ecf-a612-a1ada24d4ca3", "comment": "Malware payload", "value": "b96a7197361717fe864bc4815cb39d74b453a336ca4f15bce251b3d45f129145712752d897b0d9f83a87e102125eb94a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352607, "uuid": "948ff109-5982-4688-829f-14305bc4e86b", "value": "T1E0530110CFE5FF5DE1E16531D83F888260797AB8E2CFA25C55507E776C021A226BC35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352607, "uuid": "308c22ba-f38c-4307-9e25-0d52aac4f259", "value": "1536:uY2yILytWSggz8XGxbbvZD8w1poXsO82EgmFZDGKD3EY3No:qyILytrggz82x3ZQw1pSsVvDD3EYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652352607, "uuid": "7108d051-5f57-4010-8dce-cde8c8356db8", "value": 64568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652352607, "uuid": "1e15b184-af10-49d5-a5d0-4e370d4a6f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352607, "uuid": "9455303b-6370-409b-8888-cb734fc34b9c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f5c98b-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652337270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337270, "uuid": "4b34bd83-7754-43d2-82fb-93af0de9780a", "comment": "Malware payload", "value": "2be4cba59cf9e4e0ea0ca3d27dc1ce48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337270, "uuid": "fdd7dd2f-b068-4bb0-9b86-f5c32113b088", "comment": "Malware payload", "value": "27df4a63c80cda5fe053fe672fbc327bf268d8656c354099f004e41c3b95fb52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337270, "uuid": "337300fb-7247-421e-b2fd-0b39c73061bc", "comment": "Malware payload", "value": "9fe40bdbefea9284b8e7b85712a4fde9dfa24136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337270, "uuid": "71f5bd27-216f-45f3-92fc-df1bc3a33d46", "comment": "Malware payload", "value": "524037abee0a74b1290d462cc4797dacf6fc0a9579313b5201a40ffb67a5a7d66847066c3c047bc3f1ace50814371763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337270, "uuid": "3f340bb2-a6b6-4a1c-a2b0-3304b175bd38", "value": "T1C30602BD6648339CC01BC4394933FC46E2B5561E13ECD9AAB5DB7E803BAE414DA46F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337270, "uuid": "41e689f6-95a8-49ad-9d57-43e07c26a6c6", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337270, "uuid": "e6e47ca0-a0e9-4928-8dba-bf18486a71d0", "value": "98304:jne6W/AKEkCGz7FTuYTK3PUgkngBdgoY:j2pCQwP+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337270, "uuid": "fbed5890-2770-47f7-a337-68afe3f3a44f", "value": 3656704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337270, "uuid": "3200fca8-3b82-41a3-b616-c18e4618c69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337270, "uuid": "38e4a735-95d4-4f0c-b65e-c256aee4121f", "value": "2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ec4d06-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652377476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377476, "uuid": "c28f4c51-a050-412d-85fb-46130ca98802", "comment": "Malware payload (Gafgyt)", "value": "bd9963fd14494664c04e4b0f2b0569db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377476, "uuid": "65034c59-83f2-4ae4-817a-fed371416240", "comment": "Malware payload (Gafgyt)", "value": "284a85d4c17d635d3f2b06f7065901d4593d7f4f30d0d0e8ff78d64fbe21cdd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377476, "uuid": "516a1705-3ca1-41b8-9872-29ae3ef08dd4", "comment": "Malware payload (Gafgyt)", "value": "77a37d06cc949d890f29baa7c556b4d7b4b3f961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377476, "uuid": "638ac7ed-0b02-40c8-8e85-71d0e1942d9d", "comment": "Malware payload (Gafgyt)", "value": "23959582d659145524d400f3a86d94f42fe1c57e14df955c707a62779f06b05f36c4509bcf36748f71ddee11140d04a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377476, "uuid": "1ee14510-490c-4ec1-8640-eb4b923b2445", "value": "T18CD3941ABB619FB7DC1FCE37059A8502158DD18A12D96F6BB2B0C52CE78B84F09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377476, "uuid": "95c7c3f9-6fa5-496f-9cf3-e87080b62dbd", "value": "3072:YAuYzODCO5+n8Qlq4V6rmW+eFB1Dy1hR/:P7ODh+F6rmW+eFB1Dy1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377476, "uuid": "98fcc422-6699-4973-931f-7195b8e4cf4a", "value": 133704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377476, "uuid": "9726ff57-e8b8-4767-b797-fe89c05df130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377476, "uuid": "c0887099-b311-457a-a4a7-da882b4850c8", "value": "bd9963fd14494664c04e4b0f2b0569db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea50ee65-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652377787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377787, "uuid": "6ad3ed72-4f9c-4cc2-9266-d73bdec96636", "comment": "Malware payload (RemcosRAT)", "value": "a106ea4c467deab981fb2f9aa7770782", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377787, "uuid": "55f42663-e9cf-479b-a25a-b5f603e72e58", "comment": "Malware payload (RemcosRAT)", "value": "28cc7fad9913c87b3e22aba973bc7c68c21fb8ff30529a2eaed230135fd586b5", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377787, "uuid": "db30be00-f8f2-423f-b3d6-b5c7e876b14d", "comment": "Malware payload (RemcosRAT)", "value": "11ea54f2e92886374e862f686f905bc008b2d6f9", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377787, "uuid": "dcf4480c-54f7-4a5f-98cb-f6dbf2bb6d0e", "comment": "Malware payload (RemcosRAT)", "value": "c1e40932e54a83ec3574e386f0fbcb4d7cd421ff13bb0234cf92786362d454dc1b920c75544e48b12e0790c3f378dbf1", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377787, "uuid": "e56f1eee-fdba-49f4-bb61-f517111e2ca0", "value": "T13C0561CB3AF864213175399FEB2FF9DAC3BFD360B219F39D10940648A5E2A11D8D4562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377787, "uuid": "463f53a8-ba52-47a3-a91a-d040cc2f1efd", "value": "192:71MMMMMMMMUMuXFchbiMrBl0QD1rMMMMMMMMM+MMMMMMMkPv1+MMMMMlIMbMMMMx:zh31v1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377787, "uuid": "3495db2c-0af5-4d27-a585-82716f5f1d58", "value": 821950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377787, "uuid": "13e27ba4-996b-4148-a360-82326da325ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377787, "uuid": "e11d124a-df62-4636-941a-8727daeecc00", "value": "Report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7b55d8-d1b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RevengeRAT)", "timestamp": 1652333204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333204, "uuid": "fa34f2e1-42bc-467a-91b4-7f5021223fbb", "comment": "Malware payload (RevengeRAT)", "value": "c8aa6223ca40f85c1ae6fd9024aab6ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333204, "uuid": "8d85532e-c074-4aee-9f1c-c4f8c19c4041", "comment": "Malware payload (RevengeRAT)", "value": "2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333204, "uuid": "d6b8d224-07e9-46d7-aa33-3dfa10d1c4ab", "comment": "Malware payload (RevengeRAT)", "value": "895469c785046dce30badb4de957f5f89657ba0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333204, "uuid": "214e70e4-046e-40ef-913e-db07a16c4a25", "comment": "Malware payload (RevengeRAT)", "value": "f3fcbd6d1be9b2e6c7b6f9a5112a69eb56282dbae3573882eb56c59639f24f11da617c98b9c54b16114dc91d8fba9fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333204, "uuid": "6262c792-013e-4ad7-92d7-89b4e7e3f25f", "value": "T1CAB4F103F9D185B3D52109321629AB91693EBD301F148EEFA3E8696DEA350D17734BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333204, "uuid": "69bb1bb3-fffd-4274-aebb-4d642fec0689", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333204, "uuid": "f8f39f4f-cacc-4026-9567-72e949e23761", "value": "6144:VdRVzSkGTxSLD8uq5CaOPs47bhqUdIT+trBfkjmmoa/n8N8+EySSl7O0QebuT13w:VhqxSLo5C1Ps4XhWT+trB8jxoo8ErQuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652333204, "uuid": "cb5af7fb-42b9-4f51-9b08-be7af09cdebe", "value": 513113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652333204, "uuid": "9d3925e5-3439-4cc2-8b15-6a1aedc650d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333204, "uuid": "898fe327-687f-4085-9adb-4155b061ce35", "value": "c8aa6223ca40f85c1ae6fd9024aab6ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d58a29-d196-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gootkit)", "timestamp": 1652320278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320278, "uuid": "9ad9af88-84be-4dca-acc8-fe4e4f409bb0", "comment": "Malware payload (Gootkit)", "value": "6dc8a035e2e4ffacaf767e736146ed74", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320278, "uuid": "9b6d2179-0e16-4631-a181-ed0cb9a4f5c5", "comment": "Malware payload (Gootkit)", "value": "29d2101d18d0892ac9416b70ecf5a95fea136177926cc437ba3d0bae7c506244", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320278, "uuid": "30a6404b-b6e7-4e64-81f9-af5f2a2e531a", "comment": "Malware payload (Gootkit)", "value": "ee9e1cf73488bc673e70a53ac6a855fc35ffede2", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320278, "uuid": "e0d08783-06bc-4750-9b17-4a52b2049666", "comment": "Malware payload (Gootkit)", "value": "ff88e8c02d235196b78af611097b9b19d7b885b2a68f15000b99cb444d62c687949dc9ad84032b621dc01b6f29f6ac44", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320278, "uuid": "36206902-1f22-4b6d-9ba4-4f358f16275c", "value": "T1C98312C9AE0A89C4F72C1DE93E1A5347093B32F1FE2E8A525706064C3C52D9EC8DDE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320278, "uuid": "9141f6aa-9ed4-4370-ba07-521647df33f4", "value": "1536:7ntQ0gIZlRdFE+8C9OWi71it2dNM7euvbeMeGyu9xmB7rNne7ksuaPLj5Twj5fUx:7Mt+/C1F0KuvbhejuCB7rNWZuGLjJu5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652320278, "uuid": "0e61d278-ef17-4ba9-8008-c116904a7e23", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652320278, "uuid": "70e7c8c3-b23f-4373-8ffa-7b10a46f0685", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320278, "uuid": "961fff54-a52a-49fd-a958-c2508c3cbc16", "value": "what is the main purpose of partnership agreement(46297).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fc0ef8-d233-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652387865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387865, "uuid": "fbdc043a-7fed-47a3-b34b-88845a1a90b1", "comment": "Malware payload (Heodo)", "value": "d245e27e773b6909e39c96b012a0d1f5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387865, "uuid": "e2a69c0a-2e08-4d01-861f-20fea6270aa6", "comment": "Malware payload (Heodo)", "value": "2a0279f182102ad550220f1128a3382aa0085f768d69b8e3111c1d0c56f5ed89", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387865, "uuid": "ffe44877-b95d-4dce-9d87-eacdd47ba17e", "comment": "Malware payload (Heodo)", "value": "67a55ce3c523ad4189e839b90bbec277bfbdee47", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652387865, "uuid": "07b5cd19-0d4c-4351-900a-f05dbbef81cf", "comment": "Malware payload (Heodo)", "value": "06edc9e6e50b0f2bfab53acf1183c88a942cb1d4043225671665cc9b18eb786f337c13531add440876427174269a5957", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387865, "uuid": "501b0b57-8d3b-4793-bb89-ebb2627a7b3e", "value": "T10BE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387865, "uuid": "820e7245-dc1e-4024-bf6b-464917f53a79", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387865, "uuid": "ca324395-59b6-4831-9455-42f3d2dd9a02", "value": "6144:mkajLyaPIvW1TFpvzYNB1MlB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8a6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652387865, "uuid": "9052f503-d0ad-4ddb-824c-07096de41eb0", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652387865, "uuid": "9abcb9e8-4271-4df7-bbde-2c3f38a9f1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652387865, "uuid": "c8caeb98-8907-441a-bfb0-6ed523a09eda", "value": "d245e27e773b6909e39c96b012a0d1f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed1b82e-d1ba-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652335919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335919, "uuid": "12b9e6ee-ee7f-4657-a714-f27b21c33f79", "comment": "Malware payload", "value": "d346a54d61507adac944b61539bde6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335919, "uuid": "d13a69a3-8d37-4948-9b98-ba079d4b0310", "comment": "Malware payload", "value": "2a3493913b3be215927ca464ff826dd910c017edd9795c1ed9464bd90f66664a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335919, "uuid": "a8f62cc6-0e60-4984-b560-b44d1de8594d", "comment": "Malware payload", "value": "a04cff2819b26ba37ce8642359a150d33766596d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335919, "uuid": "87d60d93-e1f8-41fc-925b-fa2825e57a22", "comment": "Malware payload", "value": "c8e6b1555250028fea031df6ef465b0877190d67a729f0067964f6a088531865142fa8d83525d740340424afab9cad86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335919, "uuid": "30ff2bae-55ae-431b-b415-77f6f68b7d3c", "value": "T1C9858D983294F9DEC817D175CA685CF0AB207C66C32B820B90173D9EB97D683DF215A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335919, "uuid": "c0c881a3-8ac5-42b5-a119-d3d469f2adf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335919, "uuid": "30296079-071e-4184-92ee-8fad66ec31a2", "value": "24576:KZ219IXmcuYfwffqlO2FOa6MzL5ZDVD4jUsQQIEc6q1pe1f8Zdau:Ks19GCYcfcBWMlFB4jUsQQ4zGf8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652335919, "uuid": "ee66c0a9-d353-47d8-9e55-9c21ef8ec07c", "value": 1845248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652335919, "uuid": "cc6954da-b59d-417a-92b6-1dbd0acbe3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335919, "uuid": "fee0d7c7-fc8a-4773-9555-675d030523fa", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fab3e51-d241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652393956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393956, "uuid": "d8fcb672-79a7-4eac-bcda-60088d1c1592", "comment": "Malware payload (Heodo)", "value": "d3a1cf993e30ac823ed274669bea53bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393956, "uuid": "c24aebc5-2975-4b23-aba4-159fe334eff2", "comment": "Malware payload (Heodo)", "value": "2a4ac2ee56314818f60702ee5fdcbeb523d2fe71d0ac9d1a74063e8c4749c0d6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393956, "uuid": "6e52a937-0882-4d5e-ae1e-cb300a229287", "comment": "Malware payload (Heodo)", "value": "6ae898d6d5365721013fbf42677942213caebf35", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393956, "uuid": "7e4b1460-9b46-4a5c-8178-60ebc08a5bfa", "comment": "Malware payload (Heodo)", "value": "f10b04060eb595dc03e2e484d5198608c200aa9e187cfb54564a5f4d383db8193a12ef55c86f0604298899c196930ada", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393956, "uuid": "e592ef70-d1a4-4c48-8087-514e649591fd", "value": "T127E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393956, "uuid": "5b03c0fc-5356-4de8-a2d7-b593aa58edda", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393956, "uuid": "4929957e-8a34-4888-84b3-dadd487ca58a", "value": "6144:mkajLyaPIvW1TFpvzYNB1MoB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8N6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393956, "uuid": "0701b716-e974-4c28-a3e0-ba301fae012e", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393956, "uuid": "eb7ebe31-dc8c-4133-8b82-5bf3eee6ee37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393956, "uuid": "06d7fe73-63c8-43e4-aaf9-2e1baec7fdbf", "value": "d3a1cf993e30ac823ed274669bea53bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ab2e8-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338329, "uuid": "ac8f0ef1-49ee-432a-9291-e805639af53a", "comment": "Malware payload (Formbook)", "value": "b5cca9a0d4517e73fa2bb17c9f77f164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338329, "uuid": "be31980d-3b4c-4da8-ab43-29d8ab5b47a7", "comment": "Malware payload (Formbook)", "value": "2a54f922d3496201e6a737344cbf6cac0c1803a59cf4ce3111c831c32e1ce863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338329, "uuid": "1186031e-377d-4bfc-b381-5cbfb023592b", "comment": "Malware payload (Formbook)", "value": "5c654175925084aa0440be0fc54fe81fc52b4c38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338329, "uuid": "9a73c3ff-a7d2-49fb-8a1f-add0c5e07087", "comment": "Malware payload (Formbook)", "value": "0ace1f12748e14b951b68f3c74df1f4afe471c6d7f148bf2c4909b3dfc0ce0e0a12ee4752bc21bc8127ebde398733422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338329, "uuid": "0efb4e32-51dd-47a4-9b3f-b785b10ae223", "value": "T168B4D04753C4F928D1BD3374FEB491A047F0A2CB5A36935B458581F5BB21B8D7B812B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338329, "uuid": "6abd6be0-9f61-4069-b6ca-bd1e51ce7207", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338329, "uuid": "04bfb9c9-3bc2-4c6a-b2e9-5a2cba7eeff4", "value": "12288:xkKkRwmjQt+TPbV7G/2Q3Aaz6ZTleAlRH5i:xkKkRwmjQ4TPb3uA00leAD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338329, "uuid": "6d050acf-d36b-4495-8c43-9b74cf9eecdd", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338329, "uuid": "688f7733-c199-4972-9341-98b26334530c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338329, "uuid": "ebc3f4dd-5fe4-488f-b52d-53176e3a3075", "value": "Photo_0987jpg Photo_0987jpg Photo_0987jpg Photo_0987jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f19d90b-d1d4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652347167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347167, "uuid": "daa4f91c-55b1-4b06-8f02-8b93834c8b23", "comment": "Malware payload", "value": "2cf09341b87d20404a6d824305ea5419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347167, "uuid": "b347416f-8942-494f-8a2c-eeb24ac5c063", "comment": "Malware payload", "value": "2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347167, "uuid": "e8d1e317-485f-4fbb-8159-034ea35ebc0f", "comment": "Malware payload", "value": "ec9de894d7cb09ed3940db31dfc7a39cc1280acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347167, "uuid": "4f1ab2cc-52bf-4d6c-8ffb-65c6fbedf53b", "comment": "Malware payload", "value": "eaf6886d5e1dd21991332792f36a9ad624be596b62bbf70e40e1f1621ce3c577fa17071b52304a870c13c22cf8e2ee03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347167, "uuid": "35f77828-326b-4fa1-b0a4-e83e59e35638", "value": "T1B905BE9872D0B5AECB07C93289545C25A9203C67439AD20B6CC736DFE9BD69ECE041F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347167, "uuid": "b8b90cd4-bf7c-4dc0-9bd5-d42f704fc30a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347167, "uuid": "3f6d4205-a54d-4177-bff3-993f8f50a96d", "value": "12288:cWRXIfWktOMzKcDOGjBTu2KSgaLfqGC7vh9KBYhLWWZ0u9zfLWt6l/4MKOC6ZEKA:ciXIfWcKwj9wSgajqh7J9K6hLPSu9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347167, "uuid": "a39242c0-c3c7-466d-8d07-9a1db67e324a", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347167, "uuid": "2340f944-0a9e-43af-875a-f5db2e5aaa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347167, "uuid": "9f875d48-d8a5-497d-93b9-b034fb12ffcd", "value": "EXPORT INVOICE.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd08cd58-d21e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652379054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379054, "uuid": "f42e7712-0e81-40fe-ae94-2fa287279818", "comment": "Malware payload (SnakeKeylogger)", "value": "d546fed530d17e2abe8e6e09eff6d1ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379054, "uuid": "f4d7a48b-1718-4ff9-85a2-cb6067d6a484", "comment": "Malware payload (SnakeKeylogger)", "value": "2b2f6601f7875e7cac343b21c89ad5bd095bde3cefd23d8709ee2740a6d6c590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379054, "uuid": "573e06bd-d181-4b3f-8dbb-c125a2e125e0", "comment": "Malware payload (SnakeKeylogger)", "value": "46282c3d02ab734c1945f548fee9cb0b5257aa4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379054, "uuid": "017a67a1-51fa-4495-a777-3a5c93023ce0", "comment": "Malware payload (SnakeKeylogger)", "value": "a3baf8970188c30cecf3c8f882bf7b1fde332c059ece07b3acfdb0ca4f46ad0ede4eb89a1711da8a2bea6cd3f5e218f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379054, "uuid": "11263bc9-6ffa-4d00-be8d-e4812fd0c6da", "value": "T19FA40212B2679A22C56947B7DDE581CC07306F079C23D61B1EEC729869333E74ED1A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379054, "uuid": "91f5b216-3359-4191-99d6-e59bd6de9610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379054, "uuid": "5cca8c5a-1ec1-43de-bc72-9633c740eb3e", "value": "12288:ECkdqoOvzopB1ljrB0wBlvcfuMRQrofS:E/dHP9F8uMRQEfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379054, "uuid": "80ac87ed-9f0e-48b5-8caa-974529a1aef4", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379054, "uuid": "20c7b1e9-76c8-4d65-83bf-d4ac943b30ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379054, "uuid": "ade1948d-bb4a-4b9d-a3d8-d151c156e879", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77688de6-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652341087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341087, "uuid": "ecc4ebab-699d-4210-a3fb-94eca4ce9249", "comment": "Malware payload (AveMariaRAT)", "value": "daa5044b5aeb897081b0fc2a6ac74e94", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341087, "uuid": "30149c2b-c36d-4768-bbed-25d98e6f9c36", "comment": "Malware payload (AveMariaRAT)", "value": "2bdd798ffb987a7447b1886509658e7143dbeb63103aef0b5c705014726ceb92", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341087, "uuid": "13cafff0-3d41-4ae4-b2e7-51ceeb7b742f", "comment": "Malware payload (AveMariaRAT)", "value": "a5dc15f9515f9dc86e565991823807610e91a4bd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341087, "uuid": "4d894134-6e57-4ef7-b2e4-9b38a0bb7363", "comment": "Malware payload (AveMariaRAT)", "value": "2f4d7e49015ec38fe021c4c2fd38177f100534d4fb4f5122834b05870f3c9952d6db57b38994af5bd0a8ef2dfbf527bb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341087, "uuid": "1b5cc743-bbb7-4047-9b52-99ec79923889", "value": "T1CD05AE23B1D0C437C077D9B95D47A6A46839BE142F78984A3BE91C788F38AE1393D197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341087, "uuid": "a47e6a1b-8ae5-45b8-8032-9240d09ad0dd", "value": "018a80c00aff107bf9538dc2e44950b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341087, "uuid": "cb9f60ce-6d04-4108-8d04-213487d480ee", "value": "12288:PDVMCvQQIQzSswvpYTT4GhvcQLGSzX9GyT8ipYdaQHOJ0qKcFxilF0uFC1Vv8E:PZpnUpyT4G9cQxxgirOgFNY0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341087, "uuid": "6f18e834-373f-4b63-8668-b864701b2dd2", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341087, "uuid": "9059a10b-9fe9-459c-ab60-5d1c678566b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341087, "uuid": "24f8982a-b4f3-4e84-b445-5cbcedf79fef", "value": "INVOICE 0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef52418-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340268, "uuid": "f9c31267-944f-4980-b272-821f85bd93f9", "comment": "Malware payload (Formbook)", "value": "44513b713624ce7c18c9865eda2ae820", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340268, "uuid": "8c6746c1-cfa8-43be-a7d8-e555c624f994", "comment": "Malware payload (Formbook)", "value": "2c1f7f0978626db12ac76acd5c10d55d13976c43483baa257e8bd59c337c0b69", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340268, "uuid": "12cc8938-2393-4a06-821a-787746c9724d", "comment": "Malware payload (Formbook)", "value": "ea1fd8087cff0cb8f0d244e8031a54c1c9c82e6b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340268, "uuid": "f3d18f01-9ba1-4653-b04e-e378d93e3e72", "comment": "Malware payload (Formbook)", "value": "f9b37221399862173cd1991dd05c75aa3464e7f388a2b62e87758c2fdb511ed17f2d9192e60ae1d543ea1086cdfcbfab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340268, "uuid": "8ddc4f87-4d7b-4634-80d0-c779ac35e925", "value": "T12B55F157E3D7FA71E6ED52BA86B1D63C176EB4A29169B74D7B404CCC29213038928F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340268, "uuid": "03afe504-1f02-49e2-a678-964ead42cd38", "value": "7e569b564dba0b34119990efd3d9dfc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340268, "uuid": "b6926458-b2f7-484a-9015-f5823120d6e3", "value": "24576:CnnncnKW2MGX1QXzQfN/0q0QnbhlEMFN/iNo8+L6Kaqm:xKWDQAUb7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340268, "uuid": "2794d06c-efef-4150-bf91-cb4b52b4cb8a", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340268, "uuid": "c3223ce7-52bd-432b-94dd-751cc68d8935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340268, "uuid": "d2c1399a-3a3b-437f-8fcb-e014b44146dc", "value": "AW904824083731.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caa9b89-d203-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652367161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367161, "uuid": "def0306c-b969-4faf-aef7-db87c0ebc15b", "comment": "Malware payload (SnakeKeylogger)", "value": "661f91a638e6066a78c3029c2ea799d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367161, "uuid": "378b34af-ceb7-4e28-a2fe-c51d9dac1a5c", "comment": "Malware payload (SnakeKeylogger)", "value": "2c77a865f832e36bc7b53301038b19df158927276dec8e6c9a002f88a8065912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367161, "uuid": "948cab61-eeb4-4c60-80f6-05b5195f16e9", "comment": "Malware payload (SnakeKeylogger)", "value": "9c93a17d1bff4ac0c2ac5e878e0ae80926f9ce54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367161, "uuid": "145fec66-1680-40fd-a4a9-d38485095be5", "comment": "Malware payload (SnakeKeylogger)", "value": "4cdaf83475954f7e53193afa3a7209f735c1fa7a93d5f2a55abf103d4da82a67f3a3f26d92506e0feec8da0543062b36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367161, "uuid": "c9ee6179-b904-49e7-b485-eead7646cd47", "value": "T14073E8253EDB4D11D5F7DA7F5CC2AE308E5EB2CB58328A7EB4ACC21CA5462408D6E01D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367161, "uuid": "a0f9d6d6-33b2-4164-9911-b9ed3d78ee34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367161, "uuid": "a74e1b0a-0687-41ba-bdbe-7f71ffa1b764", "value": "768:zEBgsQyo5dOsQAqDmv9qXttYFSLFk56Bm+o/8R:4ndcdOzG9wtPA6kBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652367161, "uuid": "7d790b46-f30b-4d20-ae30-a6684ab23806", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652367161, "uuid": "0b128363-485f-4c04-89e5-0bcca21b0a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367161, "uuid": "07154c1a-1721-4a93-bfcd-65ccbc292294", "value": "Swift_transfer_advice_$690k_USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bcd771-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379387, "uuid": "3d4f5da0-78f5-4ecd-bce5-3950464b1127", "comment": "Malware payload", "value": "4bfde08e895076a05f0e003313c5b5b2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379387, "uuid": "073e346c-ce38-418a-95a4-4cef1daf2743", "comment": "Malware payload", "value": "2c81c28c950ca64011ae3d78c98d722c2b032bb5505719c52b2012c04caa1c97", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379387, "uuid": "0380b0a2-eb78-4698-bde9-a92cb61d5029", "comment": "Malware payload", "value": "c9c5e3c5c3dfbad2ee7bbe1d1b8f53b9305d9eb1", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379387, "uuid": "b9234e89-9019-4568-ba74-a4a703c7e25c", "comment": "Malware payload", "value": "6b20b744b42d1a7f0827da0742ca873a9bb5e5777547c2ead8b9cb36d9230aee10af135bc3c3b2eefec49ef04fa84d8d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379387, "uuid": "5da58d74-cace-48bf-9b66-f02625d2b310", "value": "T11B04029B39AAB16CF79B8B7119CD51ECEE1B9F44EB51A022D450320D7D3202B47D0BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379387, "uuid": "72ea1b73-08a0-413b-8911-e40651b54977", "value": "3072:JGOioi5TCjI1L2RSAUx/KIqe9e17PayjOrd+W7ChwPKpS60GoK4t9hqU9QbLkaJ:kqI8RSA7e9e0rrdfC+KPos/b5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379387, "uuid": "3e1c76ff-0b59-4aef-bf72-988850370567", "value": 188552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379387, "uuid": "b53b995e-1f65-470e-81b5-a65f8d852664", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379387, "uuid": "dc4bfa19-52ae-4327-b54d-6e084628cf67", "value": "308RFQ-Signals SAB.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce20c649-d1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Blister)", "timestamp": 1652328348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328348, "uuid": "f5acf550-74bb-4309-89dc-f9d7fe46fe70", "comment": "Malware payload (Blister)", "value": "1b33c1f232b2ed68ac108519caa2d35f", "object_relation": "md5", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328348, "uuid": "7058ad33-aecb-4ec2-9669-1f9f28305614", "comment": "Malware payload (Blister)", "value": "2d049f7658a8dccd930f7010b32ed1bc9a5cc0f8109b511ca2a77a2104301369", "object_relation": "sha256", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328348, "uuid": "3862a258-bc23-4823-b411-c1b26fb5672b", "comment": "Malware payload (Blister)", "value": "f534e15bbc104cafab80f954ba30f12de87b0f48", "object_relation": "sha1", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328348, "uuid": "09d60a88-3b96-46b3-8899-8f71022bd666", "comment": "Malware payload (Blister)", "value": "6561c84f640c4cdd503fe4753f98d693cc3b0a0a9e26ee4aecff325a2ab1313af2b0b8522d7c4192b3b1ded4de243018", "object_relation": "sha3-384", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328348, "uuid": "64aa5f9d-7e6c-4e8a-b193-b9104a4552d8", "value": "T1CBD49E232EA71636CC4BA075A0BC63B5D7FDD8B9C36F577659B0D3316AE1180E624B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328348, "uuid": "dabe42ec-040a-4b83-88fe-90683230e312", "value": "94de5773e8ced8d2906298c9cc253c07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328348, "uuid": "df6cd825-087c-42c5-9569-86ab499399c2", "value": "6144:g8ATpRWnC2z5mMFeKt5SGuAeidk0+NeV+tBtQMnKM3k7u74UJMHnghrkj9:gpDiiaSSvKQtUsbFnxj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652328348, "uuid": "7df26c72-93dd-4417-9363-7116d1d6dce3", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652328348, "uuid": "c82ca276-513f-42d6-9e08-c99d8f611ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328348, "uuid": "3151f623-ef74-4918-89f1-d46f52003022", "value": "2d049f7658a8dccd930f7010b32ed1bc9a5cc0f8109b511ca2a77a2104301369.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86183987-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652349272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349272, "uuid": "4fca6546-2f74-48ce-89d0-41870d79051f", "comment": "Malware payload (Heodo)", "value": "54db9c7ddcca18fd8d792104c676de00", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349272, "uuid": "b81b2677-8cb4-49fe-98f1-e7d80233939d", "comment": "Malware payload (Heodo)", "value": "2d171b079e2e8339d50373cac6dbc083033b1ade4debab11c7f8dc6dc60326ef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349272, "uuid": "0c14a103-25d3-49f2-af9c-beb37ad9468f", "comment": "Malware payload (Heodo)", "value": "0c8e4fa8eb4e97efefe9cce30b01d80f8856eb06", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349272, "uuid": "c980014f-4808-4357-95eb-f1a1ea50faca", "comment": "Malware payload (Heodo)", "value": "daf99e7dd334c11053709d65a7e55c43873769ce03077e7cac4a94a90e91f40fdc68a5391c1638bd3dac722d08d7dd83", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349272, "uuid": "bc179047-26c4-4401-b3b1-5914280119c1", "value": "T17AF47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349272, "uuid": "9577a7b1-cf2b-44e1-ba57-95c766dbbcdd", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349272, "uuid": "d9c5972b-af51-4d33-b407-378040426b69", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSZjNwgraKRT61cKGNx:S4DzZKnH4YRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349272, "uuid": "ba4d8196-c0b1-4b81-a243-01c0020a9524", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349272, "uuid": "1fdd6130-903c-4417-a196-6d9f2e490d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349272, "uuid": "e7f8e47a-9150-48d1-af9b-186b0b5963a9", "value": "54db9c7ddcca18fd8d792104c676de00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26249380-d1b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652334938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334938, "uuid": "8221aa4f-cbdc-40e8-bfd3-2bbf7d7cf985", "comment": "Malware payload (Formbook)", "value": "0714c998a2c274ae9d77970654621ff9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334938, "uuid": "abcf48da-86b0-4c51-a5ab-a18a539f62e6", "comment": "Malware payload (Formbook)", "value": "2df51d9d32427e74bc81f7cda526c3d070a3573c47f56e557a874d18f937c95e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334938, "uuid": "06071878-e6e1-44a2-b66f-45d0847efdf6", "comment": "Malware payload (Formbook)", "value": "dc7abadff7ab2b97c3f227b272b18e0f9c4830c2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334938, "uuid": "8b823b04-b499-4cc0-9f40-0992ae66b2f8", "comment": "Malware payload (Formbook)", "value": "ccf1cbfe9cbd23fed96400d2d4ee288f961bc90589596a5b93289f95737a9be2682cac44a291d8dbd059996ba17e6658", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334938, "uuid": "f9af22cf-7f20-4bfe-93fc-c8afa20a48b9", "value": "T1DF3533BD8EBA49BD871402830E9689FEC5F8344488D931DE0CB56E84AD377BA2FD7115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334938, "uuid": "e6111fba-5ee6-49d8-af40-59613139eb1b", "value": "24576:ywawBhEa8sZONNO2iabzQhNYGdLNbJdAt90wpBISpR9PF:yYBhn8s4HgNYwW90wMSp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334938, "uuid": "bdf65850-9510-442d-a083-6224166f3fcf", "value": 1140254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334938, "uuid": "30d904cd-03f1-43be-8874-63db39a28b80", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334938, "uuid": "d0914999-a7c5-4f4c-8038-4f475c8a94f4", "value": "Photo_40389589jpg Photo_40389589jpg Photo_40389589jpg Photo_40389589jpg Photo_40389589jpg.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b6ca4d-d19c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652322957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322957, "uuid": "a3f6e874-0528-4d50-90a9-9869d8fd920d", "comment": "Malware payload (Formbook)", "value": "38bb52be5f33531c14022cc2d6c124d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322957, "uuid": "edfe009e-69f2-4e4b-97ee-0ed228d22d29", "comment": "Malware payload (Formbook)", "value": "2e55e2c67fa00e3e955098409e3ee4037367af854f657cbbc83d5931b4355c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322957, "uuid": "140a5d69-bbde-4330-970b-68fa8a35258d", "comment": "Malware payload (Formbook)", "value": "cd85339b1c2f4ef2e9267a5ccbba144b3673329c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322957, "uuid": "878e024e-c11c-441a-a878-ad1aa0f2ffe0", "comment": "Malware payload (Formbook)", "value": "6bddb0fea1e091993c9ed94f57edc6fc7f1fe64f35b38a80204d63938c760a9507ea11d8c2ab074e57c838f7cb4488af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322957, "uuid": "bc377314-19ef-4653-af97-0080edc5ef39", "value": "T1A6E40228B6FAD622D0BE2F36E4F5606507BAAE09A137D30E21CC534E6E137970D54793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322957, "uuid": "3ecfb4df-4333-4ba7-b5de-02ca7cba9d8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322957, "uuid": "71b25f43-3ac1-45ce-b89d-3c68f9b72568", "value": "12288:xpUpPnLEhXVdfU4M9c+PvaFaF7G7cXQH3z4yvAi1nkxIhclBaezq4HrtPdlp:xuRnLQ4lYFadKXVI5xDlcNKZdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652322957, "uuid": "0ec62747-8eca-4e65-abff-b1d274bf8d06", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652322957, "uuid": "700b01d1-6e52-4fdb-b00f-a3191f4c74e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322957, "uuid": "e920d03a-09de-440f-8fe2-5bf2149ffd5d", "value": "38bb52be5f33531c14022cc2d6c124d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4fab70-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338302, "uuid": "c2a357d1-d5c0-4374-9260-7434928d1a23", "comment": "Malware payload (Formbook)", "value": "378cd1d3b3ffd67fafa3acc07b262467", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338302, "uuid": "a2cd075b-19cc-4f3c-944f-6f6db469a09a", "comment": "Malware payload (Formbook)", "value": "2e60c0b9ac427df11f51daeb5f5bb4d1dd03706e44c342f4c4ad39357ee57056", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338302, "uuid": "da9c5f22-1a7c-4454-a22f-9e2521bce0fc", "comment": "Malware payload (Formbook)", "value": "81f4a4fed96a43cbb4b6a4ba917485dcdb299990", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338302, "uuid": "e748cae1-ca04-4dfa-a146-2c7f02ac41a4", "comment": "Malware payload (Formbook)", "value": "12c33c640503464a0b3adddc2e27b1ca2d4ffb97b4ad2b54f818d049d11426db519896d64bec0773474e50498e0010ff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338302, "uuid": "7175bd73-d969-4b18-98d3-6c57dedc143e", "value": "T19C8568F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5552EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338302, "uuid": "7ba7587f-2a3c-4769-b826-5770b4c437c2", "value": "12288:IQ3jPsVsRQPVIQ7mlZueEjfmeIcVW8j4oMeiZBncu3wGz:HjkuWPxYwehenVW8j4odZuxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338302, "uuid": "a55465a7-a2bf-44b5-be24-3096fcc01aac", "value": 1730874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338302, "uuid": "221c1bda-7050-4882-80eb-35d101be62fa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338302, "uuid": "b3405239-c495-494d-a4bf-359811de6f46", "value": "Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d98b15-d192-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652318959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318959, "uuid": "e9a3555e-7ce2-45ee-9fa2-30688a5ea6a7", "comment": "Malware payload (Gafgyt)", "value": "a422eaadb15b4d5caf3a22dc8c8ac11c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318959, "uuid": "e1d2536e-5064-4da1-8335-0841299c5592", "comment": "Malware payload (Gafgyt)", "value": "2e84cee1f0d6949791ec125fbfea3ffe9b7364f7bb185bb290506c2b39102071", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318959, "uuid": "ca22d01b-716c-4095-a314-6824b55ab790", "comment": "Malware payload (Gafgyt)", "value": "23e309dbb9e1d72a6ffbc239cd54448aed19590a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318959, "uuid": "d7d86f0b-0fe2-4345-b020-cde559871ac8", "comment": "Malware payload (Gafgyt)", "value": "440c69504028535504397b3389473efc9212d782dd0a30fe3260b7f30a396a6ccd367edb86c21e5d7008dae490b28be4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318959, "uuid": "6aa32b8e-4721-4122-bd1a-06a1497c9e9d", "value": "T1B722A5B38D7A2F18E64CC17172229E386767C525EA4B5FBE112A8215D007DCCF20A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318959, "uuid": "65b84ded-7f9e-40f5-b1eb-ace5174628e9", "value": "192:HKnqPr0uYdVse6FbaZBBdXvgDU/C0qB3da7Pga714Rm7CACmbQgFUNCutlQ:9wuWdX7/tqBKxLIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652318959, "uuid": "646dd997-856d-4c52-af0e-97c71a9304cf", "value": 9940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652318959, "uuid": "b3021a1a-1d54-4141-b95b-9c951434b4c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318959, "uuid": "4e745a39-29d8-402b-9990-9834968e054a", "value": "a422eaadb15b4d5caf3a22dc8c8ac11c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f62649-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340629, "uuid": "7d22cef6-2d8d-4415-b00c-7c89df302683", "comment": "Malware payload (Loki)", "value": "8727321276f756618f961727765b792c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340629, "uuid": "d186b9ab-651c-4328-81c3-313020a13528", "comment": "Malware payload (Loki)", "value": "2f09e405b151f6b622d7c5fe91acaca861f3162ca65043eeae7e923ca8aa850c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340629, "uuid": "bb2772f3-ec26-45d8-b4b2-417f1f7cd351", "comment": "Malware payload (Loki)", "value": "dd969fedc02d081c945a9658ef39bffd22562e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340629, "uuid": "da7b323c-f16c-4afc-8216-52db3dd30885", "comment": "Malware payload (Loki)", "value": "d01ea6891d36d49bee64c5d6a34b3f5352c81adb28f9ddcfb91c05fdce70e2446c30110d8e277d03d8ed8d4fad6effff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340629, "uuid": "f45b2452-ce9e-4768-a912-9c675a2c1003", "value": "T19D041210BAD0C8BBDE22BB330F27672A0EFE4613586457430B987D197C66742A70F719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340629, "uuid": "a197bf86-75a2-44d3-a4d0-a5f41def9725", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340629, "uuid": "21dfc80a-d1de-42f6-a312-f1ca23160d16", "value": "3072:LODZGPEounb6/Iumf70Fgv6FT4IjJ3z1v3OyLi16Ch3vk1x5ci+:LOtIOSlmf70FKwJ3JJLKnh3ecz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340629, "uuid": "3bf9d64e-60a5-4413-8b92-9b56cdb0e1e3", "value": 182714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340629, "uuid": "f413cf28-f4f8-4083-a5f7-5ebc1a6c61d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340629, "uuid": "ab1e60b7-f5b2-45d7-a758-aaa8f0c760e5", "value": "8727321276f756618f961727765b792c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a289b4-d23c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391981, "uuid": "372c87dc-ef8b-46f1-8965-067347939aae", "comment": "Malware payload (Heodo)", "value": "639a966663bd913fcce08357f88ecddc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391981, "uuid": "b23ac1c5-805b-4c6c-a54e-490021707e30", "comment": "Malware payload (Heodo)", "value": "2fd35fb0848207f8b7de0a61c2dc0f20df78ff502d46b35b04b0751a6a02cdc7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391981, "uuid": "99ff0fc3-21bd-4e02-839a-26383f58295f", "comment": "Malware payload (Heodo)", "value": "71c416340d16555c1cc7df2f6dd5877f74da53e7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391981, "uuid": "8181ba7a-c649-4122-8a52-58c3acf8b75f", "comment": "Malware payload (Heodo)", "value": "241091eaa6ad51b942f0666a459cc228cc3184b3a8fb77f49e81a5e9c729556d5a4235fa118b3a7309df16cc9fc88f22", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391981, "uuid": "aaf5b17c-8483-4798-ae15-435b2589ff41", "value": "T160E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391981, "uuid": "299676ab-fea3-41cf-ab8c-d1735e0b8f61", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391981, "uuid": "4763ee53-c879-4772-8330-8d967389e2f1", "value": "6144:mkajLyaPIvW1TFpvzYNB1MtB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8i6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391981, "uuid": "d23db0af-adfa-4d62-affc-9c9de5312308", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391981, "uuid": "c42384ac-10f8-482b-96ec-bf9512fd2f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391981, "uuid": "0e8d0513-0089-46b3-90cf-1ba06e182303", "value": "639a966663bd913fcce08357f88ecddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8762fe-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652374171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374171, "uuid": "91b23d7f-2a5c-43a8-8bcf-335c4c8492b1", "comment": "Malware payload", "value": "831bf9b6f20c8d38d07fe8b00e289c34", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374171, "uuid": "ec134e79-6188-4a11-9f0c-172ca63ed6b3", "comment": "Malware payload", "value": "2fe7a63c5f4d16a91da1d8e58f01d1264610113935738de38b1d59288a17abb9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374171, "uuid": "fbdfe27e-39f5-4522-b490-2bcff73a3f28", "comment": "Malware payload", "value": "214ae25cd5a5fbebdcf0e9e5fc00391f857393da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374171, "uuid": "5f5ff5c6-4418-4e83-87ca-c539318d9c43", "comment": "Malware payload", "value": "f8df47daa8b5f2a0b56aadaf1bd084bf72146466840222a688f63e0a20993dd4bf27ede60171f1f14ac6823ec651ebeb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374171, "uuid": "8dd35251-8bc7-472e-8ecf-68191e2909e7", "value": "T183623C1032A0DA9BE1458D358CF6EBEB3371BC4A9DA1434B3285BB6F1C79712C58B745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374171, "uuid": "92382de5-c088-40ec-b15c-a86259570543", "value": "192:DhjLLkWYq/jkKD5Mws/Db1kdlyD0vZnJgtR4lDIt37Npz2:RLoWP/jkKFMb/DJ2oMS/4lUt3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374171, "uuid": "855e81c8-ef7a-4219-bf14-e0e9db30c19d", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374171, "uuid": "832837c5-af0a-4bec-af19-bdd9a0d1b359", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374171, "uuid": "2c6d406b-c55c-4fba-801d-78e933affd9f", "value": "SecuriteInfo.com.Heur.31214.25136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e05bbb-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652349267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349267, "uuid": "2518ae30-1bfa-4296-9279-c983ef80381b", "comment": "Malware payload (Mirai)", "value": "f37d9599ef3b495c2896fc625409608e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349267, "uuid": "31b726f8-80dd-419f-b912-92bac6b0fba7", "comment": "Malware payload (Mirai)", "value": "300d7b00b5c59708ca171145cc90d76b2c451716c0b6a27ee3cc6fdecbd6465e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349267, "uuid": "f053bc1b-9efe-493f-ac1d-eaf583aef70d", "comment": "Malware payload (Mirai)", "value": "a8b9ededd88cd16ef037c289ecd2a1b2dd37cc4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349267, "uuid": "bc1df5a8-1b9c-41cf-bbeb-9c9af42ea4fb", "comment": "Malware payload (Mirai)", "value": "269c7faf073ae217a353b73fe9459cddcb7303556389899ed22f6901871d491e074c95f0b311e0a4027b21bc93e62988", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349267, "uuid": "80dcf370-41b1-4931-8e62-ade1b2ef9834", "value": "T19B732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349267, "uuid": "c8c2b310-5206-41a0-bbbe-60b1c645db8f", "value": "1536:awW0PKt9cwxjQ/NIXIdZzN3TD8Utia84GLf84Eo5WOK+7c4R6yN:awsgTdZzNXFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349267, "uuid": "4f9cc5f2-8dd6-436a-986d-212aa16740eb", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349267, "uuid": "ff3e4eaa-2c19-4411-b400-71214eec556b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349267, "uuid": "99f7ddc7-9d64-497c-93d8-3528bf4d6cc4", "value": "f37d9599ef3b495c2896fc625409608e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440a9ac6-d22c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652384810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384810, "uuid": "645d2ba2-b5a6-4514-8105-c8d04948c5b0", "comment": "Malware payload", "value": "13ce74e1b339ca95cfe5a8872a578e33", "object_relation": "md5", "Tag": [ { "name": "grandoneiro", "colour": "#01CE08", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "tetrade", "colour": "#7F8993", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384810, "uuid": "52e232bd-793e-4157-9fa2-ca2097a8400c", "comment": "Malware payload", "value": "3074ab91ca7f5bc9dbe39239626721695b9a6b4323cd5813eaefb75d2cde89b1", "object_relation": "sha256", "Tag": [ { "name": "grandoneiro", "colour": "#01CE08", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "tetrade", "colour": "#7F8993", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384810, "uuid": "8270cc54-16b0-49e4-9861-65cbef05d6e6", "comment": "Malware payload", "value": "b58ecc529c7326f88aa983ccf1a24e577c09bdf1", "object_relation": "sha1", "Tag": [ { "name": "grandoneiro", "colour": "#01CE08", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "tetrade", "colour": "#7F8993", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384810, "uuid": "b2188468-2ec6-43a3-9cd8-d3e0bcc9a01f", "comment": "Malware payload", "value": "893d1861a5c1d572ef335de9cee96034d159b5f5f31a1f92617a8fd69331445bc3ba00b95df4750214283a5e84f0b3cf", "object_relation": "sha3-384", "Tag": [ { "name": "grandoneiro", "colour": "#01CE08", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "tetrade", "colour": "#7F8993", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384810, "uuid": "b0a80a7a-c9ec-422b-871f-a19fb0b528c0", "value": "T1E8567D52B2C9663ED06B1E37493BAA44983FBB612912CC1757F41C8CCF356807A3AE57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384810, "uuid": "2607ef4d-ed71-4cb8-8b85-afab812e5cd8", "value": "98304:Qoo83zISlDUyehoX3He3gb363y7E5p3gCOYDA:QyIXypX3cr3y7E5WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652384810, "uuid": "cd3f025d-06a3-4564-aa25-fcaf117d5778", "value": 6450176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652384810, "uuid": "3cde75e6-dba0-4adf-9752-5c9bfdbae444", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384810, "uuid": "c2b8d779-9d3a-4152-a9ce-f6e5201ebbfa", "value": "ComprovantePagamento.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9118429a-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340701, "uuid": "c9610c0e-52f0-463d-9c44-ed7a5a9b98cc", "comment": "Malware payload (Formbook)", "value": "5db33e540fe77ed38e5fda411984b1dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340701, "uuid": "f5cb4401-1d09-4ef2-bb10-392d6315b612", "comment": "Malware payload (Formbook)", "value": "314655f5b6f2f40bfb4ad5bce1824e0aa3e4f1c104201e163ae27781076dd228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340701, "uuid": "25340a8c-f0ed-4d32-895f-b1d601f79f9a", "comment": "Malware payload (Formbook)", "value": "4f7968e957a62acd3285168c6cd661fcc64f998f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340701, "uuid": "8b3a3689-f75f-4c64-ac2c-3dcb0ca05305", "comment": "Malware payload (Formbook)", "value": "445ef4f7fd79cf0b5e12bead7285917ed15d5f96a4299c7877b26b60c1b9050ec8b49cf6e4dc5894f6dfd0cf12b7e516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340701, "uuid": "406ecc44-0cee-4131-b6a2-27faf734e79b", "value": "T18B341204B698F5A7E0D6CD336CBAE7279FEED4201454A61B4B406C9CFC62782D61F386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340701, "uuid": "b851a1ff-0c23-4a7e-8b3d-6bc8e28fe271", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340701, "uuid": "ea854e8f-a9ce-4990-b924-8f0dc8c99191", "value": "6144:LOtIOWMMc3tmPrJVkjMvhdTh5auueztwB+IIw/rgOTw7IwD0mIOeXIStAv:LOLKytmz+MvLThAuu+tmR/rgOUcU15eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340701, "uuid": "a050d91a-531a-4f8c-a4c7-57ac3c3d16e4", "value": 251065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340701, "uuid": "500c09b2-7985-4a47-ad31-f724999fb7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340701, "uuid": "ce01273b-56eb-4057-986d-20794e85c03d", "value": "5db33e540fe77ed38e5fda411984b1dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329bb400-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330235, "uuid": "96afd28c-0491-4e04-b242-93e9ac204579", "comment": "Malware payload (Mirai)", "value": "cccba430c0273cf92cb3bccc5f9d85d5", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330235, "uuid": "1eebf1b8-68ee-4183-83d5-f9381f3ffc49", "comment": "Malware payload (Mirai)", "value": "314d102eb54c745478af7061cadd13eb85dd98d33ce9639e42da5103f7623f9d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330235, "uuid": "4fa06302-b3ca-417c-9efc-85b0f82f33b8", "comment": "Malware payload (Mirai)", "value": "7c9648fb6ed37a897dad8ef775b544a1d796b4d7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330235, "uuid": "c902a646-7af8-4af3-b655-cf43719cdf0a", "comment": "Malware payload (Mirai)", "value": "a991b50c36abd8d9944ac96140c722d459e68be0bbc5da56e1196654108d2d90266c475c3636399c70195bf2992d4caa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330235, "uuid": "06a67210-0dfc-488a-9b9a-f03d3b943ce2", "value": "T157A39D66CA762D26D125A5F0B0B0CB7C5B23D85891C75E9A946BC365D087ECCFC093BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330235, "uuid": "74e18a27-485f-4711-b2ac-e0e2c4c75736", "value": "1536:FXSIYUzIiSekukmpmgJ1aEAB1NGGQZL0fjKA+8vi7SOLtZfCFSCbLWtE99y:JYDjluvIgJ1rU1NGGQZL0fGAPidLtZfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330235, "uuid": "74b3a177-db1f-4d50-9ea7-cf91d34be043", "value": 97704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330235, "uuid": "9a94d808-e04d-4c4d-8da8-ba31e84e6f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330235, "uuid": "7efbd85f-1d9a-49cb-aa63-abe853e0ea53", "value": "enemybotsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef95ad01-d191-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652318526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318526, "uuid": "14335152-8131-4b4b-862d-953eabd00a0a", "comment": "Malware payload (Gafgyt)", "value": "8847652d738f346bc7df482749f52ddf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318526, "uuid": "fd8c58bf-f479-4619-8456-8b60b8fa0581", "comment": "Malware payload (Gafgyt)", "value": "31aa49e1cec5fa41199421c28b4e44f2be588a2dc83a004e26a3a1c2ea0f866b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318526, "uuid": "c352afc0-c862-403d-a16f-577eba86b9ad", "comment": "Malware payload (Gafgyt)", "value": "0a159ebb802e0b454e9b251aa7c4c15efeab5c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318526, "uuid": "a6b2dd0b-171b-416b-823a-a5ee10bb6c92", "comment": "Malware payload (Gafgyt)", "value": "03df21473334af174b58602995c4d721fb01e47a309336e1bfa4448e37bfb71d722e925ca4c493d1c5fad19ca2168986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318526, "uuid": "ece86d72-0b77-450b-a6b9-ee2340f23f87", "value": "T14472F839FF431E27C495C974A2E7422C76F9421F58B54F2A3C620E9DEF80D8896436B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318526, "uuid": "ddd851b9-d678-4788-8b8c-d7fafc540f76", "value": "192:Bt6to9htRe+4q/TZ/nKqMdf387uZVUCyu4P0eB6kd+D2rrPllTTTo0GB6QzhR41C:36to9htRl4qrxnKNDFU+pQI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652318526, "uuid": "3c4dbb1f-1fd0-471d-9c9c-ee860be8ef2f", "value": 15996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652318526, "uuid": "76ad7fea-f7ab-4f2e-b9c6-0db438d03a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318526, "uuid": "c82a85ea-b9fa-4648-974b-580f4fe6587c", "value": "8847652d738f346bc7df482749f52ddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc60347b-d197-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652321124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321124, "uuid": "96780dfe-9c57-47d1-b472-0a72d3428d5a", "comment": "Malware payload", "value": "5dc59f2643b1fc8864d6fa4a2390598a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321124, "uuid": "a7ae8bc2-5a44-4f12-ad24-5af6e1d96eec", "comment": "Malware payload", "value": "31d6c34d2734c97dbc41370078430833381cca51ced68d664897b16bfcc2b84f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321124, "uuid": "94c770d6-ccda-48c9-ad95-6ab12e0080be", "comment": "Malware payload", "value": "338093792664b97a9fef547619090635c6e4a403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321124, "uuid": "b7127d5a-d841-4e5d-ab62-f4cda79cade2", "comment": "Malware payload", "value": "2e7514568265965272f0d0c265efd7d73a4ce5d360f2f6680bb30322b728f665b2088ca2b11780076f11aac509500956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321124, "uuid": "c30305c3-2d5a-46ea-aa50-62b08995fe5e", "value": "T1A2059F12F280C53BC163D9B55C67A2A49839BE113E38DC962FE85F74AF34AD13935293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321124, "uuid": "ae74dc81-4933-43d2-a48d-05ec821da752", "value": "018a80c00aff107bf9538dc2e44950b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321124, "uuid": "e7dc2ba6-ba33-4e22-85f7-25ea8cc036ee", "value": "12288:PDVMCvQQIQzSswvpYTT4GhvcQLGSzX9GyT8ipYdaQHOJ0qKcFxilF0uFC1Vv8E:PZpnUpyT4G9cQxxgirOgFNY0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652321124, "uuid": "d11d21a4-5950-477a-8762-118223f34bb2", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652321124, "uuid": "762b4453-efff-430d-8cdb-22727162e8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321124, "uuid": "ba7ea43e-5ec0-4895-9d00-dd133c3ae912", "value": "DAR21174045.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f0ce38-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652379423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379423, "uuid": "700ebc0c-d6ee-4d8c-98ad-59f788f172b1", "comment": "Malware payload (Loki)", "value": "0dc4b6813848ae29ecfbdcde854124d6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379423, "uuid": "44de6512-3e72-4004-9e35-7426933c8fcb", "comment": "Malware payload (Loki)", "value": "32a42baca43672e738197a6e50a0fb4fc6e2aa16ccafba2ffe990b9605a1e210", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379423, "uuid": "50e56618-654f-49bb-bc9a-c43ca60942e7", "comment": "Malware payload (Loki)", "value": "09df4318a2d7fb975dd1d9d10ada85e10731c0cd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379423, "uuid": "5ae76a74-958f-4cb6-8eb5-49d7da420bc5", "comment": "Malware payload (Loki)", "value": "b794febba7001d3606187dfd12e33f8bcb47c65076fb630d999a1309642249e36a5af568feedc94e9210584ee8dce54f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379423, "uuid": "9c3dd817-ee15-4c9a-9301-acc499b60ad4", "value": "T1CC0412C051DF9501E508E6379B41FFEB7EA2ED283BEF369D24073685597C240AAB0B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379423, "uuid": "e9bd7d8f-893c-4502-be96-12fb63058147", "value": "3072:xzDhXvVi+AOe5hR1+D3zuHtBCesG9Lo/iE6/MEj3ions+:phXvVBAX51EzQBCesu0qEHE7iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379423, "uuid": "97501c25-82b6-4034-86df-87ff569e9ded", "value": 188232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379423, "uuid": "aa5cee91-8c96-4bbd-9056-84251785d2d3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379423, "uuid": "73561abd-f3d5-4680-833e-951727459a7c", "value": "PO0975.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e5613f-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kaiji)", "timestamp": 1652340795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340795, "uuid": "cfc95a90-0204-4ede-a2f8-89c49769f3b8", "comment": "Malware payload (Kaiji)", "value": "db6ebebb41c1d9ca0a52a8edbdf5bc3f", "object_relation": "md5", "Tag": [ { "name": "20-239-193-47", "colour": "#5BEB56", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340795, "uuid": "9ebbc246-3e0c-46b3-9d9d-69840a41e884", "comment": "Malware payload (Kaiji)", "value": "334f529ab1122e2e9be61f1748dbeabaf04172dd9d79cab23e4a819b6fc5a643", "object_relation": "sha256", "Tag": [ { "name": "20-239-193-47", "colour": "#5BEB56", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340795, "uuid": "4527ee55-c668-468b-ad46-a8dbfb246a9a", "comment": "Malware payload (Kaiji)", "value": "fc5fd98a547e1aee079eb515a5d055bf517e5ad6", "object_relation": "sha1", "Tag": [ { "name": "20-239-193-47", "colour": "#5BEB56", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340795, "uuid": "504d4ead-0bba-4871-8430-2430c283093f", "comment": "Malware payload (Kaiji)", "value": "05bf3897ceb078901ca75332e0cefe2aecfed6a29c58c0f91c0579276ee715532b6f4949b18d6820044f03dbc1cdb05b", "object_relation": "sha3-384", "Tag": [ { "name": "20-239-193-47", "colour": "#5BEB56", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340795, "uuid": "b23b65d2-f0f5-4e7e-9c07-5ea059a1f9dd", "value": "T1AAD022C400020878AD156D2330EE0280FACC29EB9CC1FA01F6C438E0808CF097965E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340795, "uuid": "a36563c6-520f-4580-9771-867ceb76f439", "value": "3:TKH/JOnQzanFCKl2f0F/bZWLz9CRQZJbZWLz9CRZ1Od6jRhw2TsFz:IOnFflE0F/dWLzU2JdWLzULhjnw2gFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340795, "uuid": "b6c66a7d-ab7f-406a-be28-0b2b5b8ff947", "value": 201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340795, "uuid": "b89551f6-cd6d-43f3-8415-6f1e700121f5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340795, "uuid": "852c8203-2ed3-4f0a-89fa-c34e3ffb661a", "value": "kele.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c98f573-d1f8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652362410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362410, "uuid": "cf053f03-e224-405d-b36c-a37e8f77ea5f", "comment": "Malware payload (Mirai)", "value": "9f1ab5bac64c46e7483ed3156b526162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362410, "uuid": "5bf96a44-19ce-46c4-91df-d087fa9de36c", "comment": "Malware payload (Mirai)", "value": "335fe10c08e9220962651cbeb9c853a23e509be64d7b6018d2f01361d4961771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362410, "uuid": "ec93093a-77fe-4ea1-99d5-3213bf8f15e6", "comment": "Malware payload (Mirai)", "value": "fcaa5fecfdebe2ecc0b3cc555b5d42de1b5a0be2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362410, "uuid": "d96706eb-e9e8-427c-bf0b-720d28db302b", "comment": "Malware payload (Mirai)", "value": "cdd43867c56d84467ce6ddc3acb44cc78df0b0a93097ff34bab73f95b3180a9b9c799db8eaddc6da396eff109690c61c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362410, "uuid": "57b8d1ab-c58c-4196-8da0-a31469f48173", "value": "T1F563F9827C81AA3AC7D017BBFAAF109E3350ABE8D1DA7253CC154B5176C650F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362410, "uuid": "5abcd5cd-4604-449e-a85b-155b5b217b94", "value": "1536:rvpMPHug5RlFyZS/l+UAuYkpzg0FS0ykFShYceZWYCNqxtM:rBMPHugc0lFSKcwcUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362410, "uuid": "fc5af02c-ec33-4372-8211-97f4e2840328", "value": 70872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362410, "uuid": "a191c18b-4011-4a68-a953-5eb01291b5cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362410, "uuid": "38fa880c-bcd7-44cc-892a-4fc4265131a6", "value": "9f1ab5bac64c46e7483ed3156b526162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcd33d7-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391540, "uuid": "dc3c8c9d-228f-4783-b452-21a3b59c0d92", "comment": "Malware payload (Heodo)", "value": "47e75973e7297920751fbd951c0a7c98", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391540, "uuid": "8a9d975e-a4f3-4bbc-9871-94b85165379b", "comment": "Malware payload (Heodo)", "value": "3399e4a1908ef2692a238d7763d9d5a0244baa8fe9b586ea9e7af73a2a06d1cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391540, "uuid": "dfa84a3e-5496-46c4-b4bb-cda2486d9f11", "comment": "Malware payload (Heodo)", "value": "11d1a0e24410808aa050332cb0bbf072b42593ae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391540, "uuid": "547fe125-02a3-4bcd-837f-04ac00d61c37", "comment": "Malware payload (Heodo)", "value": "aa74985f2259145aa3303c5cbdcc63a9a0dd6bde7b548980dbeecb7531190f2266876d6b1c562a9f3250f121493eb65a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391540, "uuid": "0c48ac87-2cb9-4f8b-a6f2-c573a0ee880d", "value": "T1D9E439022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391540, "uuid": "ce82e2e0-3899-46f7-a36f-6e4d75150695", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391540, "uuid": "e797479b-35eb-4d95-9a96-8b761f4b05f5", "value": "6144:mkajLyaPIvW1TFpvzYNB1MkB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN896nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391540, "uuid": "c609fdb0-2dee-4d7b-a23e-8646615feb7a", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391540, "uuid": "addb27a7-c11e-4a38-898c-2ed7626e7583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391540, "uuid": "29b95521-d4a9-4eea-bd5a-e723c72b0f75", "value": "47e75973e7297920751fbd951c0a7c98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266d6a58-d1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1652364144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364144, "uuid": "8a346217-599e-41f3-871e-880b09ef8d5c", "comment": "Malware payload (Gh0stRAT)", "value": "6921a3af26a155f7dffd7197a12dc9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364144, "uuid": "67372cc3-15ab-44c3-bad1-e326e2250366", "comment": "Malware payload (Gh0stRAT)", "value": "339aa1fac2ed0e82d692029b11949abbe5aacad7bb382582a29b362dd663098f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364144, "uuid": "575337c7-2530-4209-9e2b-36687282252b", "comment": "Malware payload (Gh0stRAT)", "value": "20b04fd1097b4d853955969e06265ac15cefc9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364144, "uuid": "cb180b7c-c64c-48eb-ba45-44addd3c1600", "comment": "Malware payload (Gh0stRAT)", "value": "13bbb00db6e6950cdeb6119a76f824e9af1ea0fc09ba482ff914319fc029922f5b23f78df8209b67a653199245922265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364144, "uuid": "ed9809f4-495a-4490-bd73-bb46437c503b", "value": "T1D5B533A3047155F2CA5F0BB895A6F8297729254E3A795C3333E6B78D1B860A031FEC31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364144, "uuid": "2667af7f-d063-40e2-99c6-a29f304ff149", "value": "beaaa16a0a795285521587491ccf44ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364144, "uuid": "43047cc3-511c-40b9-b4bd-b67c3559559d", "value": "49152:m3piV+fbO0ZKWUJl/MId4QSmfSHkKHGxiGKcp0fLhiS:m5iV+fqE0/SmulmQop01i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652364144, "uuid": "68963d98-e29a-46f6-86dc-467a26c645ec", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652364144, "uuid": "61c9ce2e-e2cb-47ad-a2d7-c6a8e14494fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364144, "uuid": "b2dea43b-ebf6-41b6-9f60-2fb8a3e8d347", "value": "Please like me for nude photos.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9a49cd-d229-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652383589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383589, "uuid": "f444045d-8815-4da8-a4cc-db8489ce1e33", "comment": "Malware payload (AgentTesla)", "value": "91bfba6c3ad1aa7a3769f92f7593c475", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383589, "uuid": "c21c25d4-987d-4616-988d-bb872ef2a512", "comment": "Malware payload (AgentTesla)", "value": "33c82240bd5a535b464e23f9a9ef570349cbab76a5cd0d50f35844e6b3a93e89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383589, "uuid": "12ca1521-8f73-4f6e-94ab-f94f0916714f", "comment": "Malware payload (AgentTesla)", "value": "7fb20df11df5346263d7c85d7baac2fc9865af43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383589, "uuid": "b297422d-fe3c-48bb-b0c4-e65d6c3c556c", "comment": "Malware payload (AgentTesla)", "value": "58c9081e4de3f765a5b3699dcfe54a437ef740ccc1becb144ad08360570a602b2fd3ebaa149cbfeb370e8e3b26a57810", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383589, "uuid": "a60f85bd-c3a3-478b-8975-af6b3bf3241e", "value": "T14C03B4127F989D20F7E3B67EC5B6E5141258FE26A4B2C70A30B6F307293731A8E32154", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383589, "uuid": "c0ff98a6-bcf9-45d1-a3b9-9ab1f16493df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383589, "uuid": "c31943e2-f73c-4f8b-92aa-f42e048ee552", "value": "384:rtJ/e2kyujvYv3rGYkvuwgT5Kf0b7bbL7CuF+73sU6fyRT66gdQspO:rtRRxyvYv3rGbMT48bW78lfyRWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383589, "uuid": "630859a4-f82a-4969-a254-084c389df645", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383589, "uuid": "a69e2e47-1c22-4476-b755-66d73e3fdcc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383589, "uuid": "29265919-b12c-483b-b731-c74589cca949", "value": "QNT2037610177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc621e1-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652366651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366651, "uuid": "d2cc58a0-e660-40bb-9884-a0dcef38a05e", "comment": "Malware payload (SilentBuilder)", "value": "39b4be42a1c76b5d790056766d0df418", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366651, "uuid": "207499d8-db44-41b3-b8eb-80d59086923f", "comment": "Malware payload (SilentBuilder)", "value": "33ceba10438e029f4e465bce1f2cdd4688e153288a0384cceca4cf313b05ab2a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366651, "uuid": "704b0761-f9a7-4726-b2f2-fcad3851ecf4", "comment": "Malware payload (SilentBuilder)", "value": "0805f1e975b11a4cc3d6d6e9e40700cfb24967cb", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366651, "uuid": "aa524f4e-e16a-4121-be3c-a8929070027f", "comment": "Malware payload (SilentBuilder)", "value": "ae8fe4d7e14750bb4823e422e5bc2427b0b3c13a40513761200ecabc96654e06c9c213d2b5551c823671e8b7c0f29d92", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366651, "uuid": "c54a25de-0e7b-4a2e-aada-f5d4b39eccb7", "value": "T14103834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366651, "uuid": "e5fb8783-b0f4-45ee-bc25-cec0ed88977b", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366651, "uuid": "92332c64-c3d1-4afd-8296-f7d3a48577b1", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366651, "uuid": "e63e9016-521a-4b57-b486-8989862ca35e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366651, "uuid": "d7f7bbbe-1c1a-4769-a27c-efe835ee83f5", "value": "gescanntes-Dokument 2022.12.05_1414.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2150fa57-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652345667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345667, "uuid": "0522c34e-a1a5-4b2a-8249-102d622f91d1", "comment": "Malware payload (Heodo)", "value": "212e382421f0e876b8af4f47b0b3a15c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345667, "uuid": "fc9dd86f-219f-4ea2-8fe6-cdbe5d314b02", "comment": "Malware payload (Heodo)", "value": "33f96d0298195d90e572fc780680de187c5346d6e5ebee969241df7c1cd46a8b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345667, "uuid": "0655cb92-fdd6-4bd6-939f-a1d9505458ec", "comment": "Malware payload (Heodo)", "value": "85e75eecb4555670560036d2868b7d5fd16b9ea2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345667, "uuid": "c99bb056-cfcd-4e81-93b4-e060cf4949e7", "comment": "Malware payload (Heodo)", "value": "4a5e2d9f6ac2b393cc553cee55d20078e3c57d6123d38c7816e9af77ce61e2e7d2b832a136b55ac308fa893a0080bd3a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345667, "uuid": "5c824b32-9188-4c4b-a5e6-f50e031e7610", "value": "T1C6F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345667, "uuid": "83940a2f-73ae-4751-946e-4991cc102e61", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345667, "uuid": "d476ce51-d830-4199-b85e-16b72877a7d4", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmS8jNwgraKRT61cKGNx:S4DzZKnH4dRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345667, "uuid": "072f503f-a260-420f-ab84-8317d744f03f", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345667, "uuid": "df76368d-fa70-4ee7-9b76-051028d474e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345667, "uuid": "c7df03b7-1c9a-4aca-86fe-306abbb15aa2", "value": "212e382421f0e876b8af4f47b0b3a15c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ae3f22-d1c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652339372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339372, "uuid": "1def3b72-c818-455c-8939-354982995d8c", "comment": "Malware payload (Formbook)", "value": "ed56e2d1acea1fe103e4d72866909e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339372, "uuid": "69de10ff-671d-4522-8819-cd40908c7523", "comment": "Malware payload (Formbook)", "value": "345642b76b3a499884c227983fb3a9f9c9ea9078b34cd577ee674d260aa1ccf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339372, "uuid": "14c8fcf7-1d23-4939-b1fb-cd26747a03f7", "comment": "Malware payload (Formbook)", "value": "9f5d2096ff2ddc4c92ccd23199c623f4c2f7bccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339372, "uuid": "28c37e71-7f42-4898-b397-ee1e4066eefb", "comment": "Malware payload (Formbook)", "value": "beb2da8d9f0033cb91df6c6fc7666003399330ff39fae0f80b833c320963b89275db6842a14cd8b53b49ccbf924a01dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339372, "uuid": "d7eed27d-4c9d-4373-bfcf-44d7c2668878", "value": "T130B4222A5678A336CD7F0BB2CD2868EC43B5AD16DD11F3132CA4B0ED063DF564861A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339372, "uuid": "00e60eba-3660-41ce-83a4-588639872b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339372, "uuid": "c9324f91-d445-4528-9cc7-129d2078ebd5", "value": "12288:gIjoqjRdtVr7TEeEkLzDV2DGSYJsj6UhuY3UCCe:gApFdbr/ETkLX0Gk7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652339372, "uuid": "a1101374-10d9-4eb1-a808-817024b73156", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652339372, "uuid": "bfed923d-ec81-458a-a5b4-084307a27e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339372, "uuid": "73164f76-50bf-4f5d-b1d2-12d9bfc10faf", "value": "invoice.doc1545122022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d81d379-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652363405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363405, "uuid": "6f649292-4094-4280-a34f-767821193f49", "comment": "Malware payload (Mirai)", "value": "e38830b80748cd73f9af7f29b21f69f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363405, "uuid": "d54fecb4-e131-4e64-b266-22b59494eb85", "comment": "Malware payload (Mirai)", "value": "345e0ed8beeb13a5015d85c04e1503f029d18d52964d2902906b2231eeecece2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363405, "uuid": "3491cac5-af42-46dd-9939-255543bf7e6a", "comment": "Malware payload (Mirai)", "value": "8b3721f7c1a16d682dcf29c7d51c7d1a95b1b810", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363405, "uuid": "e15f73c8-25d9-421a-8126-351a0f7bdf23", "comment": "Malware payload (Mirai)", "value": "bd4ea024cd620524b0a2853ee4698c3eb12acab875b0b6cc5fb9a60e1f7e394d045ca46f161706fe85926ae88a1ab2d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363405, "uuid": "69eec70a-a37d-4c7f-b862-12b69e2569ce", "value": "T1EDD2F1383B4DBAF6C7305B35D8FD89044BB643B8D9DB33B2A398A0E560D311195FA116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363405, "uuid": "8377b263-8503-458d-9bb1-df6d7b505f88", "value": "768:mlVfftwcIfDdOFl8xOkJEZ5fFgcGofs3UozK:gftwckDbOeEZMcGPzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363405, "uuid": "b4970a2b-88ee-4bff-a10d-09568a54ef63", "value": 30380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363405, "uuid": "f88f530b-5508-46db-997e-0b2ed3ea4ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363405, "uuid": "fb04abcc-9d85-445d-9533-26c502268ff9", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037a1fd8-d1ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365374, "uuid": "28a69c1d-693e-4652-bee0-dcb58a8f12c0", "comment": "Malware payload (Mirai)", "value": "8acdc88da785c739227389ce1a1adf24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365374, "uuid": "87d8d2ba-9609-4e34-b8b4-a22d6105a9e8", "comment": "Malware payload (Mirai)", "value": "34a2c2443bae20df4808ce1b056c734e998e93425cd3f1c3582fadbc8c42adfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365374, "uuid": "f2f12dea-3203-4bb4-98e9-a5fa343182eb", "comment": "Malware payload (Mirai)", "value": "ab356fcc4dfc534a446efba37b7d9c860c7e8196", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365374, "uuid": "a9badb42-3c0c-4956-8939-52c16bc206cb", "comment": "Malware payload (Mirai)", "value": "9f45c17b4d1fc6d603276743a9258050021c103f36bf2e4316e5c8a65a21fff8ff64055d58dddae50bf02cbbd9c5f058", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365374, "uuid": "9f41a6b8-06c1-40c3-b933-469ff7b2d4d6", "value": "T19BE2E18E8ADE5ED1D9C1B538209E03FA2D64F18277AA4F942F6419C4A62F50AF64F434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365374, "uuid": "b08da9ce-b504-4348-9864-4910e05006c0", "value": "768:KOjf8ZlAOHXN5+ei47EQHpBVUNlyyMop6yG6E1aoHqvhjWP:T8vAgd7lOBMw67WrhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365374, "uuid": "e0c1dcaf-4e7b-497c-a90c-ff1ced4d80ad", "value": 32508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365374, "uuid": "372f089d-278a-4bb6-8875-5ebe5dcdfcf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365374, "uuid": "3b551afd-32fa-48b0-b904-bfd749eb69e7", "value": "8acdc88da785c739227389ce1a1adf24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98331967-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317950, "uuid": "c8f76338-ca47-46cc-b20d-e37ee69f4421", "comment": "Malware payload (Mirai)", "value": "6ba72f6988b09cb8bf2eeb8284b74133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317950, "uuid": "c3de1a0c-aa22-4565-a274-80cb055a23d1", "comment": "Malware payload (Mirai)", "value": "36d07b9f5fddcd57aa7f4441a2f6d7f8d18f8626999eaf5571c5878ad6a66dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317950, "uuid": "a147122f-3c8d-433e-b991-79e24a09d8e8", "comment": "Malware payload (Mirai)", "value": "02f4e3f238a2125eb5da4133b67a598a25f8fe09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317950, "uuid": "7967707f-9057-45bc-8d71-770df7d41368", "comment": "Malware payload (Mirai)", "value": "3c1b01944d33f6a0790c9ff4ba20ae4a24ffcc7792a60f039b2d72159a05fa063c7b5c3bab740975e655e638277a043a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317950, "uuid": "8702a9fe-2b0a-4b6a-aa41-1bc86bf20dff", "value": "T16B734C94B8009E7CFD0AF6BA85264B0CB92133115FA30F27A767FC973DA31A85D56D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317950, "uuid": "d85b15ca-3e5c-4d2f-be5f-e2ac5683fd32", "value": "1536:jTmSa/mjkvJltC8ruMT/jxYF4C1IGLbLuwq2fKM9B8IxYJi0J/:jTmSa+jeH08ruCLO2gfFKym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317950, "uuid": "7c9eb467-046f-41b9-9a91-0fec77c1ca5c", "value": 73844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317950, "uuid": "57c59983-f884-4573-ad31-601f44b77cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317950, "uuid": "70c3c5b5-3fb0-4cd7-aefe-9bdb8c196c3c", "value": "meihao.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493fb9aa-d1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652352606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352606, "uuid": "966539e3-071e-47ab-9070-00a1be62fb33", "comment": "Malware payload (Mirai)", "value": "b587fb979c28061bf040df4778f77759", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352606, "uuid": "361f318a-cbe5-4988-9f66-3b805d11e7bf", "comment": "Malware payload (Mirai)", "value": "37ad9da8c70399d8d1259a4f0fdab317431496f25c0423c4bb9e172fc561fc7f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352606, "uuid": "6667df62-0b2c-475f-8f32-ef80884895ac", "comment": "Malware payload (Mirai)", "value": "c748fc86c2930c833f126fd2e8ac4bbb49998e31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352606, "uuid": "839a406e-616f-43f4-8483-7c6fb2b6a99a", "comment": "Malware payload (Mirai)", "value": "4ed3b5caabb3686ecef98b9db7c801c1aa0a2be410e5b0052fb7c353c10887771cfcc6fb1ba0b735d5119330ecf1c121", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352606, "uuid": "8d054db7-88f0-4a36-ac56-fd64f4c76f83", "value": "T15CD2E05B701E41C0D5A7C6FABC8B7E095AA1F30B39125C387BEC5AB54461FB1872D781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352606, "uuid": "80655ba4-4d33-4fc5-8de1-092eaaf943af", "value": "768:zxv3BR1WHSKVzoE6hViDspp7eDUWu83GwSaqnbcuyD7Uryqt:zDR1t3i6VeJvSjnouy8mqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652352606, "uuid": "87103660-94b6-47d5-888e-b929640f578b", "value": 30740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652352606, "uuid": "8e31dbb5-292b-4c53-9900-03c32eaa6444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352606, "uuid": "1e5ff9c7-be05-4f7d-8a0c-cc749c88fc5d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d19e3c-d1df-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652351663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351663, "uuid": "1fcd39d7-449e-43d3-a179-dcc7f4d1179f", "comment": "Malware payload (SnakeKeylogger)", "value": "a4e4aaf59fefeedf77d7e6102b64ab21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351663, "uuid": "1fd97e72-51d6-4f2f-bf19-f408f1804a46", "comment": "Malware payload (SnakeKeylogger)", "value": "382184e7571f141ed3e438ed7a88975d09b2305f827ff6b7ac65d0d31a2455c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351663, "uuid": "30e8f50d-8c42-45fe-afa8-c56c68302e85", "comment": "Malware payload (SnakeKeylogger)", "value": "c133545bed3ddbdb0ff3a143594b11f243a19140", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351663, "uuid": "d6fe05e8-181b-4fce-9167-89081ad6e4d4", "comment": "Malware payload (SnakeKeylogger)", "value": "00b58a5530990e2963e293e7d33e8e3669c22df6cfafbffab095ce865957889b77b1bc01f5a56af007c70d20181b7caf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351663, "uuid": "6def16ed-17eb-4817-9e04-d68a5632a776", "value": "T14B652325209D3AE3D33CE2B149653C8D2717A57B1359E74BC98BA4CA9406B10C4FFEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351663, "uuid": "eab4c081-034c-4082-9659-ae936582a22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351663, "uuid": "5b3937ff-49f6-46cf-bd83-d81f462854ef", "value": "24576:UYHgrEgq8uu/t5hCSazpEiMUt7cTajswl6VH8ByF6ruFkdYkbt4NddbhwJ8smQSR:UQgSLu//hPauQ8ajsHVH8BykCk3kddFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652351663, "uuid": "deb5fea8-7cee-41d0-bd56-423f157d22df", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652351663, "uuid": "27b4c478-d2e8-4b0c-b7d2-7752a4c56a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351663, "uuid": "b6300eff-0802-448e-bef2-917752124f80", "value": "a4e4aaf59fefeedf77d7e6102b64ab21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6cb9a59-d1b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652334295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334295, "uuid": "845d4bc4-aac3-4e09-a49c-29d924b7c6d5", "comment": "Malware payload (BumbleBee)", "value": "128a0a888fd836de4e775b7bfd3b3b44", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334295, "uuid": "d6be5d92-9f7b-49d9-9cf3-29bc6407ef17", "comment": "Malware payload (BumbleBee)", "value": "382b3e5d777b656f5dc33c18f7e99f4ff98bf02082b8e53f69fe9ac551817223", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334295, "uuid": "d8edd828-55c6-4643-8fae-a1581e874a54", "comment": "Malware payload (BumbleBee)", "value": "ec75c23e860bf790471a5b675d4d7488c64f9d47", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334295, "uuid": "f84bde27-e52d-43c6-99a4-2a80f09f5c9b", "comment": "Malware payload (BumbleBee)", "value": "1d2e723cb9e862f0e7f391139fdec66eb0fbf83f215dcba6c96843366d917a771e4507d541948aa40800c849db97b5e9", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334295, "uuid": "2c1bd081-abd1-4e95-92db-26a6cffc0b3a", "value": "T1DE557DF89F9D244CD437E81995A7BD7A9B8835135B4EAFD0331BE9125276308A82D0CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334295, "uuid": "83a3db1a-32ec-4838-97fe-c14f93b93c35", "value": "66356a654249c4824378b1a70e7cc1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334295, "uuid": "f661fe52-9188-480e-96a0-fcfffeef3b1d", "value": "24576:zeUSkpY/QiQtGqK+Rc6fOdmJTTZe51eYLx1VeIFpX7SvaT+XPpy3z:iC0mte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334295, "uuid": "e1e01dcf-e60c-460d-a929-17a6289284f4", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334295, "uuid": "d32ef20d-30df-4eaa-8af5-bd3a8748176a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334295, "uuid": "dc1e8e44-33a8-40b7-96b8-b9327141557b", "value": "ramest.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eccd30e-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330228, "uuid": "3aed1526-93b4-419d-9374-30be1c9af2d4", "comment": "Malware payload (Mirai)", "value": "5b04f248b140c4b6b8108c67994f9b40", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330228, "uuid": "277d0023-9447-460a-ba11-93db8f05ffd3", "comment": "Malware payload (Mirai)", "value": "3869e9513162159412bc626bb076a9e263726fc04b0ec5781bed490cca536e8d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330228, "uuid": "cd131aee-eedb-481d-bd28-b76caf705d71", "comment": "Malware payload (Mirai)", "value": "675ba3c8355b4aa67812ecb7fb4c9babd9359942", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330228, "uuid": "d936b994-e6cb-4d7a-bd48-a2ebcbd74875", "comment": "Malware payload (Mirai)", "value": "5a2c94c776b8453dac163cefa78d8d95929aac012b0a55fbc4038505a581281c65adae6c2661cfbec0200a14cb6c3345", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330228, "uuid": "08103454-bcaa-4502-b1c5-8817760f4f8f", "value": "T102B37D42B30D0B07C2232EF02E3B67E193AF9DC132F4E2847A5EAB459175935558AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330228, "uuid": "5d236414-2eb4-47fa-b78e-11a5034feab7", "value": "1536:Ibzb/AFcxru9YGP2KdyjOAzRRhE68K/xodqc6Ehj6vggRtE99qN81:ag+IhWh2OGLhcg3G4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330228, "uuid": "b53acd53-aca4-4575-b304-3d6c8c7b7b08", "value": 111456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330228, "uuid": "b59f8e13-a30a-494a-91e4-ee0c3f521290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330228, "uuid": "101391a4-1b42-41ad-9ebc-bd4e4611e419", "value": "enemybotppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d2a638-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340734, "uuid": "fb1b057a-93a7-4f7f-b54f-7f530d10d39b", "comment": "Malware payload (Formbook)", "value": "b09f17c52adfbbf6c3e91e84a404b112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340734, "uuid": "a4c4ce6c-9ecc-4d23-84f8-a1a466ac637b", "comment": "Malware payload (Formbook)", "value": "387234df5ff2369a1a2bd25b060d5d7dd3817e07577baadd33bdf5c2dc7725c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340734, "uuid": "f8ca9f92-83a1-4962-a026-b8e6c35e9903", "comment": "Malware payload (Formbook)", "value": "898acff2b3ac3f18a90f3422b62acde8bab1f200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340734, "uuid": "6a9a35bf-9c63-4984-a1ba-fdf57e5d6976", "comment": "Malware payload (Formbook)", "value": "e5abfe25659046a5c2648848597756d684672bf49ef06f653b883026ca4ed07d28c890823a54308cbe5d874592f630d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340734, "uuid": "b655a745-5cd8-4f2a-a324-94f6e3d6f0f3", "value": "T1095422617390E267DF633272C7F62B71CEFDA51528AC5A4303112A0A7DB1385BE9FA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340734, "uuid": "f1f7702c-8984-46b9-89ec-6b0f63325bfa", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340734, "uuid": "37d468d0-bb6e-4b66-bbfe-d0d5625e69e7", "value": "6144:LOtIObNLGB4BEKZGVZ2Np1dZW7Ih+MjKsOgKUIhywD5jo:LOLpyB4BEKZ0Z2Np5gY+21R2Eg5jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340734, "uuid": "6eaea0dc-8bc6-4fbb-9302-52d34bbffcfa", "value": 289956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340734, "uuid": "6a2c2384-479f-4e68-89e3-f0e00c2f1132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340734, "uuid": "3797c509-c947-4887-a149-64553c684615", "value": "b09f17c52adfbbf6c3e91e84a404b112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4716d8ac-d1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652347449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347449, "uuid": "3dd50e96-e983-4c20-9d2f-51be7c7da1b0", "comment": "Malware payload (Heodo)", "value": "02e89ba67a5315f222be9090f4be3372", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347449, "uuid": "7f78da6a-3309-49db-b4c5-5c12c3d31b98", "comment": "Malware payload (Heodo)", "value": "387fbd46e370c60af97d06324eee03323b5967c9dce47d8be89ed074a66bc237", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347449, "uuid": "f25890d7-e866-44aa-9e10-8380d1e3ebd7", "comment": "Malware payload (Heodo)", "value": "35e31f68a6cc1f74949557cfb0865f82420dc1c1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347449, "uuid": "65788280-6c04-4475-a310-c0eacabb41d8", "comment": "Malware payload (Heodo)", "value": "0401198143506237d312aa56b6c7bd8f302da67f512a458ef3472ea48491e845cc39fb896c3f15d0832095a8f43e1c8a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347449, "uuid": "479445b7-1eb7-4cbb-8f07-680d78bc96b7", "value": "T182F47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347449, "uuid": "60ba5750-2cf2-4c1c-a0a8-7109775fd68d", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347449, "uuid": "8b3212c3-b553-40b4-a516-c967deb2b0a9", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmS9jNwgraKRT61cKGNx:S4DzZKnH4QRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347449, "uuid": "43899503-bcb8-4708-b362-fe9dcff8062d", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347449, "uuid": "8bc58c8a-15e6-4788-b544-d299f997a7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347449, "uuid": "ba535358-4139-4f3c-bc50-397b17aafccd", "value": "02e89ba67a5315f222be9090f4be3372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b242dc5d-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338609, "uuid": "144ab4cb-1ee6-404e-b25f-1875f6071d92", "comment": "Malware payload (Formbook)", "value": "bece4088b65375dedc691a405346fd23", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338609, "uuid": "f9f716ca-2e51-42bf-a2df-88704624feb2", "comment": "Malware payload (Formbook)", "value": "38ae577459ca9c000a1a5ae910e9b1768480a97aba71835caaa48ffdddc7622d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338609, "uuid": "7067a3de-9269-4055-ad88-5f03a6160235", "comment": "Malware payload (Formbook)", "value": "8460d896a3fc1adc72a28906421866bfb1d28605", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338609, "uuid": "673eb11c-a65f-41b4-8d62-4c57a34ff1ae", "comment": "Malware payload (Formbook)", "value": "54fba0dcbf74ade9f9c514c671115a5115bd72ac93a9f263f1e1d1b5d3925130bbf0e3d52e790e5af567452bf59a96be", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338609, "uuid": "43aca4b0-b03e-4bf4-8287-d8db15de30e7", "value": "T18004020737686661FD61ABFC0DAF051B6DB8CDDE894E8E422442354E42B5E1A3EF0372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338609, "uuid": "7f7c57f9-559f-4cf3-93bb-8c2ea4c0c654", "value": "3072:4eXQYfBrRuMFhB35lhGHiXY6uO+YLlq1g3USewRydrll7g5fGH/Cd/tSLs:ZbfFjThGCtF+YLQLLwcnBgIqpcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338609, "uuid": "0a0fdf92-2132-4b19-8be0-38829328548b", "value": 188136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338609, "uuid": "e789e5dc-5e24-466f-ae64-732f021dfe7e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338609, "uuid": "610b7bb5-5c45-4e37-80fe-955e820cec6c", "value": "DHL_AWB_NO#907853880911.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b212b6-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340137, "uuid": "523da6a3-c434-49ba-a6df-7dec3457cb5e", "comment": "Malware payload (Loki)", "value": "f7c17f47bdacf913c90402421cf9d4ec", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340137, "uuid": "ab2186a5-323c-48a3-aa20-0b2630dbc65b", "comment": "Malware payload (Loki)", "value": "390796f50289b51ac5df16901e1812d0ff3cc32ec6ac1a78bc0862775e520413", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340137, "uuid": "b470bb66-6855-474f-b3a7-ddd4456c69a8", "comment": "Malware payload (Loki)", "value": "b73f0f72a3ae977af4e5593c5f838a8234b1b11f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340137, "uuid": "f2c41b02-9ff2-45f7-b70a-e13755afbcbf", "comment": "Malware payload (Loki)", "value": "598d61e15df3f16aa27f3f459622d434c72efbd02f8c14a9339611df43eed0a12e2c3d17734cda7fba3a49b3221f92a4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340137, "uuid": "1ca8e129-4446-47f2-944a-d80951d9a62b", "value": "T119A40154B257C522C0AD173ACCC550DC2375AF1BEC23C7AB2DD5729DAB327A64AA034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340137, "uuid": "6b4fff28-710f-4267-8ea3-e7228913ba76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340137, "uuid": "95cf4c32-e8f5-4834-8202-c8f12fcf710e", "value": "12288:h0pVNEOrxrPSoEBGJwjF92Utj0kon9FwDnd0GdjsHa:CGCxrlEB/FJ0nmDndnOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340137, "uuid": "a97edcb8-945c-4c64-be02-072b728e4ce2", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340137, "uuid": "5b43f407-09cf-40e2-a4c3-c83da63edbc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340137, "uuid": "647b4564-bc4d-468a-a515-e32e19e987d9", "value": "DHL479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a0b97d-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363655, "uuid": "c52e77be-46c8-4f13-bcd5-e414f78c7e48", "comment": "Malware payload", "value": "3ac907236592b913a6d3e1ba39b710fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363655, "uuid": "029a3a86-2e3a-42ae-8016-3301821c3ce4", "comment": "Malware payload", "value": "3969d107a1e7d91934b88a293d33983b1ed483d911f878f3ad455b84936b4735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363655, "uuid": "745b45eb-59e5-4173-a2fb-82b50825839e", "comment": "Malware payload", "value": "ae65d9428d5a2e140a80bd3b13a776f65559b4cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363655, "uuid": "e0cc891e-4b83-4bd9-bc65-ecadb8a02936", "comment": "Malware payload", "value": "8e4c6f281cd9a8ed5c89451168cce14cc50c07c09a1890a12b7d4d1999266e9be7fe283eb90008db78897124837a452e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363655, "uuid": "6faf842a-65e9-407a-b72d-681ae1faddd1", "value": "T1EB72F70DB3E48635E5BF8E3989F252504735FA469D16EB6E0DCCA14E2C73B409920F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363655, "uuid": "c458db4f-0224-47de-a39b-08f1915899ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363655, "uuid": "ffbd358f-d6f0-447a-9ff5-c7e96e40d4de", "value": "384:t1wcbwMvxw9bQh3zoymKIewa+KNKNK0ULpUkrDStx9eV62WXlSn:t1wcbwMvxw9bE3zVmKIewa+KNKNKTyuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363655, "uuid": "97f26e47-5599-4555-aca0-1b3bb81c69e3", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363655, "uuid": "2fc9d469-7601-4cb0-b307-d86355527888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363655, "uuid": "58ce7980-a8ae-4244-974e-3c72e3645b3d", "value": "3969d107a1e7d91934b88a293d33983b1ed483d911f878f3ad455b84936b4735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428ec3e8-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kaiji)", "timestamp": 1652340999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340999, "uuid": "3f0acdbb-c929-4d7d-a3e8-d05298b9bf71", "comment": "Malware payload (Kaiji)", "value": "4fdf916ecbb47707f92fa0eeddaa1f54", "object_relation": "md5", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340999, "uuid": "54cd579b-0f5d-4c5a-8a98-86a4e826067e", "comment": "Malware payload (Kaiji)", "value": "39aace0d249bfc3a9ce2dd02f206e05b291a34371f6ade8c9c0b107ba4740d6c", "object_relation": "sha256", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340999, "uuid": "32c7ae5f-7a87-4e5b-8d3d-8616dc8b9517", "comment": "Malware payload (Kaiji)", "value": "e77b087474bfc8409b71dc042b1fb20cec3ad24d", "object_relation": "sha1", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340999, "uuid": "b14eafd1-0ec3-4fa8-815f-d9c277450acc", "comment": "Malware payload (Kaiji)", "value": "a213d47520d4fd81e85b689930fbebec43984e5000df8354714aad0e2451839612d8cb262fb9b0439fc7d6798f6581a9", "object_relation": "sha3-384", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340999, "uuid": "b9f7fff9-5f4c-4af8-af50-caf7a39f5c3c", "value": "T116263C47F85492E4C1AED230C6669293BA717C845B3023D32F50FBB92B76BD4AE79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340999, "uuid": "5ffab5be-f5fa-4865-8c01-a7b00e9bd317", "value": "49152:Y6y34QuFfpLrb/T4vO90dL3BmAFd4A64nsfJlz6NBZ1ck9SXHmzmZqaNjGJ5EXXg:+q7hi4Gz05+Ea5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340999, "uuid": "19028bc7-ca4a-4210-ba14-0615edf8bba5", "value": 4804842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340999, "uuid": "86d40e71-f3ab-485f-a6cc-b30c51991f37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340999, "uuid": "b6c44f55-e284-4046-a397-4ab47f3a61b1", "value": "39aace0d249bfc3a9ce2dd02f206e05b291a34371f6ade8c9c0b107ba4740d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e825ef2-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340697, "uuid": "a90929bd-5256-43fb-b7bd-56013d328a8d", "comment": "Malware payload (Formbook)", "value": "1fb45ed5a8de2d0818db9cc1051ccaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340697, "uuid": "0a85a58c-c966-4e08-9e0d-3ddc39e1df29", "comment": "Malware payload (Formbook)", "value": "39da5fd546b1ef1e8b72e56a95ac89f0e6bded69816ab72b96dd54c5e2c12517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340697, "uuid": "1398bbf9-2b92-45c8-ab82-155e709714c2", "comment": "Malware payload (Formbook)", "value": "97fe0abecb1ed1faedde867485de566d879a2a70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340697, "uuid": "d017e9d7-dc8f-48ee-97c1-182ca17bcd93", "comment": "Malware payload (Formbook)", "value": "004dc278c87f4e8ed4aeae6bbc1a6317ef3ea92992637e4ae46fe42f2c12969896e50115f8988d07dd825eabff09f729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340697, "uuid": "97d3973f-4bee-4030-8468-b067f4df43c6", "value": "T12A4412519BE4E043FEBB1B724A775B478FF9990848F059471FA01F4ABD61243AA2F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340697, "uuid": "6bee4400-b36b-490f-9e07-331d7802b231", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340697, "uuid": "f5b99269-0d4a-41b6-9780-513dddebb09f", "value": "6144:LOtIOOsSo2ZM9IW9fLznEgBKKol9JHMjuo3f/+y16:LOL8o2ZM9IW9nh8HMjLvGy16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340697, "uuid": "b4e52f66-6619-455d-8ca4-20cfbb9f1cb9", "value": 274518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340697, "uuid": "df3a23cb-c1b7-4a7c-aa43-0f1ddb1a3c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340697, "uuid": "0174146b-aec4-4aa2-a246-5ea25e5318ce", "value": "1fb45ed5a8de2d0818db9cc1051ccaad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce8dea8-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391562, "uuid": "fa91e5c8-69c1-4b99-b783-79adb7790f34", "comment": "Malware payload (Heodo)", "value": "4db2cae790335c217afbea5262751570", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391562, "uuid": "b2971b26-939c-4dec-bc63-03d1d8e658ff", "comment": "Malware payload (Heodo)", "value": "39fe40e52bf16f3fe25fc408f79dfe0253d4d06d49ea79d6cfafd40e78f19169", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391562, "uuid": "0b695a6f-1082-417b-86f5-f868d1f4515b", "comment": "Malware payload (Heodo)", "value": "98395fca0f38f47b9cccbc73abbd4f5de06af645", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391562, "uuid": "292365d2-8ab0-4b68-a753-a14966062e1d", "comment": "Malware payload (Heodo)", "value": "49758eb7a4368f8a121e84c65e0a46bf22c2f8952bc1eb5975efcf8f8de1a03855014e518b3bdcf0d718a00ab2a3c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391562, "uuid": "75e4f02f-1b7d-4296-9a89-73df42fd1b3b", "value": "T136E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391562, "uuid": "e93e7a94-d321-4612-9410-dd7874a1424b", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391562, "uuid": "59588079-1652-4526-8fcc-be80369bbb4a", "value": "6144:mkajLyaPIvW1TFpvzYNB1M9B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8K6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391562, "uuid": "a5ee98c3-fba6-4ba2-973c-1e1ff7496a4c", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391562, "uuid": "a3317a4e-0297-450e-a160-115a85ddd512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391562, "uuid": "e87f9565-fe40-4072-9fa8-80b1180ecc40", "value": "4db2cae790335c217afbea5262751570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d59f63-d22b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652384390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384390, "uuid": "97157d7c-84b5-48bc-b102-17552220617e", "comment": "Malware payload (Formbook)", "value": "2d017668d644aa3e51c478e7d51a5859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384390, "uuid": "e8dc4409-a793-4a06-8268-8c5dca9b6e74", "comment": "Malware payload (Formbook)", "value": "3b4412361b0652b3723aa7eef76a54c8cbf1eb22c592a4e5ad67dbb10844dc7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384390, "uuid": "a0e4fb80-8823-4599-a5eb-6b95a7fe91ab", "comment": "Malware payload (Formbook)", "value": "224d093308ec482f1192c05ec908fd86c03c1a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384390, "uuid": "0c609323-a8a8-44e3-8df0-69d0dc295bcc", "comment": "Malware payload (Formbook)", "value": "588f2b43a15754bb01bc99d756ba6080151a0800384597f9eb0235b9eb48df36a003e31da4a01e8bd76868c966169de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384390, "uuid": "4ca87558-4a89-44cf-928f-6782a92830df", "value": "T1A1C41211B227E920C1694BB7CCC561CD13716F53DE67D30B78A9326A27333D24A98B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384390, "uuid": "5992ff82-0d1d-4c03-a7df-6ba6d4bc08ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384390, "uuid": "976d43f7-e9cd-4c1b-bcd1-a4af71e4d937", "value": "12288:OxevoO+LdNdmnFpFL8QcOSmbk1BoERAzBAk5nVCF:XwTLXdYTFLDHnCoEanG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652384390, "uuid": "60ff28aa-0194-4ae5-a8b6-fcbd6a8f7a81", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652384390, "uuid": "b47f236a-bbbc-4ebf-9c97-d0fd1d7599b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384390, "uuid": "03f52693-cdc5-46df-bb15-8c1bfbaf7034", "value": "product Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e9866c-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652343628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343628, "uuid": "ca87d9be-35d9-460b-91eb-bb3b611b12ae", "comment": "Malware payload (Formbook)", "value": "d5ec1c136b0ef0b9cfb093c101742dc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343628, "uuid": "35d3f3f9-6fc9-4780-89c8-af01955cd681", "comment": "Malware payload (Formbook)", "value": "3b7797226ad94650caea53b5fbc430091fbb9346c88966b83f6402d0cd05904b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343628, "uuid": "3219dae3-f990-4ac8-929c-95370b7fc3bf", "comment": "Malware payload (Formbook)", "value": "da9168923ecf79fc8147a328d8e8b58067874144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343628, "uuid": "f55c7734-e873-49fd-a765-d790fd88a208", "comment": "Malware payload (Formbook)", "value": "de6e466f7298c1b448cb432d3caa683ff0e1eb11ec4b0a6c7b979aab705f5d82bedf9f89b886662835a5a62a293c37a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343628, "uuid": "cc67e0dd-35e9-428c-9c1e-e4acf98369b4", "value": "T1943528983254F9DEC817D075CA685CF4AA207C6AC31B820B50173E9EB97D783DF219B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343628, "uuid": "db536bfa-6fd6-4c6b-875e-0c8e3d57ff6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343628, "uuid": "1d35e6cc-a3d2-4a3e-afee-c45c82815f9e", "value": "12288:xJu02Jfxt7J0GMybRJk6/GACMG0askHk0QD5fFwO/wO1psVk0Gat5JsX4BVwIgej:7j2Z2DybRHh4bHeNNwO/wgL0G+iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343628, "uuid": "1a9ccd2c-f12a-4cf8-a6d0-b64dc5e0adba", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343628, "uuid": "9bd5cded-5eec-4cf9-8e33-fd2afbfa5f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343628, "uuid": "9a9fcf53-186a-4f6f-af78-c979463324a3", "value": "d5ec1c136b0ef0b9cfb093c101742dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b54964-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340148, "uuid": "796adf63-c67a-4d8d-a536-81f7f881e6c2", "comment": "Malware payload (Formbook)", "value": "19287f5fdb6044e8a8559f247f57737b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340148, "uuid": "d2a0241c-3e77-428f-9723-5f0af305d208", "comment": "Malware payload (Formbook)", "value": "3bd6ff50a89166d3188ccdb47fbbb5481ef7d6946e61befd29665adee8893ba9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340148, "uuid": "f40fe889-1bb8-4b4b-8cc7-2fd4c57ea476", "comment": "Malware payload (Formbook)", "value": "f2bb24916b623c0af3aabf467156dfcc68af378a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340148, "uuid": "a34713db-6dbd-42f7-8885-ed0b1c1030b6", "comment": "Malware payload (Formbook)", "value": "26ecdef75e432c661466e07cfe5176cb8fc406582f0a1f70ad612eb884b0e6e579ffc6e8794ed807edacc8922bfa07f3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340148, "uuid": "1c24f054-1e9a-4d80-9b9d-942ab1c1d53d", "value": "T11F041212FFF4124DF2A9657E69511C6C9BB6AD710BA9C001DCEAB60FEC7948090C77AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340148, "uuid": "d93d56b0-d33b-4efe-b380-08d0ad000767", "value": "3072:+kz3YHUveUWgzXrSmylj4xt8ZtivBQIx/OlhZCfEpphGC+hxDDUJ2+YC:5zfmUWKr9eci6BD/YiEpe3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340148, "uuid": "74389352-3b90-408a-a89a-9b7169382be8", "value": 188504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340148, "uuid": "72434fce-f545-4274-b4ae-6135e859c0e4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340148, "uuid": "ad6f7aa1-70cf-45d3-b58b-257319333d78", "value": "DHL_AWB SHIPMENT DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667d0493-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652343636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343636, "uuid": "cc3cbf96-757d-4a78-9f69-547a633919b9", "comment": "Malware payload (GuLoader)", "value": "d5e55a57372bcad45fbb260105179caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343636, "uuid": "dd8e51e0-32a7-4a2a-994d-6bf963aa8700", "comment": "Malware payload (GuLoader)", "value": "3c27c2aa1bc826faa65ab4038eb385cabd6db50108410e6f674d455aa1dc5532", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343636, "uuid": "0471b938-06e6-4302-8496-b9c94d0cd838", "comment": "Malware payload (GuLoader)", "value": "9b1935a927c072dd31017362ff1739bf1ea2aaf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343636, "uuid": "9228bfb0-a919-4db9-862b-d4ec850921a6", "comment": "Malware payload (GuLoader)", "value": "9e907d29ad4c27cd701f278419d93028e7ae3a3177b241a8b71f9490a36b8ff1424dc767b4276a810c147e54c531d4a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343636, "uuid": "97cff968-78e3-4aed-93c8-2f8d99e4b205", "value": "T107640144E6684D21FCBA0D3C0533D4A76974CC220879DBBB2BAE751A2BF51D1822FD67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343636, "uuid": "132b29cc-459d-4428-acfe-bb9603348953", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343636, "uuid": "b7101c94-6a1d-4b38-ae87-edbf50747b46", "value": "6144:13yztyL/0/bbdat6J9mOnuuAgo+/sOxCHBs4YIwUrJrnBpKussJ9LQu:13pL0/bbdat6JIO1Ag2TBs4YI3BnB35N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343636, "uuid": "3a4a12f2-97c2-4c0e-a49b-f5ede8d5443e", "value": 326847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343636, "uuid": "42219ba4-4ddb-4c57-9d5c-10a041ed5936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343636, "uuid": "6586c6de-fa9e-4baf-987a-5620a41f4085", "value": "d5e55a57372bcad45fbb260105179caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857e9c38-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340682, "uuid": "ea1e45ef-ebf7-49bc-93d4-e826d31c53d8", "comment": "Malware payload (Loki)", "value": "98a602591bf121ef9282ce623291a941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340682, "uuid": "ea35b220-fa9a-43b1-b6a8-16abc74adf28", "comment": "Malware payload (Loki)", "value": "3c5103c77675f880bf0922121845f60f155d06eae43f7519c4916bb3196b8e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340682, "uuid": "649c994f-d95f-4ccf-9a54-a04a1a06031d", "comment": "Malware payload (Loki)", "value": "0c54e2ccbb64815c9e981af8e35feec1efedbd2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340682, "uuid": "cf351321-688f-4e7e-944a-ddca5ab7d00d", "comment": "Malware payload (Loki)", "value": "43909bd9d7d688c73557a735e93633a5c424acfd17442bb846d9cec8e860b5f9e4d98f65345ec60943908904fd294608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340682, "uuid": "5086178d-5a9e-4c0b-9788-600e10103650", "value": "T1D40402043690D0A7F8B346339C396B630FFAC675B864862743A469BF3E73260A55F785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340682, "uuid": "6fc79edc-fadf-4574-bd59-47711a14164f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340682, "uuid": "84da9203-54d6-43fe-86f4-ce333e1134c0", "value": "3072:LODZGPEounbfVnIzpMIQUUoQBXSlhoT8vLaaajh62QOcabE5/ttbnyf:LOtIOf2pMIQUjQBXihw8zavD5xbQ1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340682, "uuid": "2e54570a-ef8f-47b6-ab2e-7a8a4f9fb40c", "value": 182632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340682, "uuid": "bc7e000d-ef8d-40c0-8efa-abc21ca0a273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340682, "uuid": "9827505e-ab90-43fc-a449-3051decb9c2d", "value": "98a602591bf121ef9282ce623291a941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47e1263-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652399709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399709, "uuid": "deebde54-cc77-4a8e-ba5e-a92008b64d14", "comment": "Malware payload", "value": "0cd3cfee55a682e04a78a7a1b1837cbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399709, "uuid": "b8bf2b8d-05de-48d2-9416-968e03a5520a", "comment": "Malware payload", "value": "3cc0f5f0b1b4d43c22b3146144f6d8af86bc665b20c20ec8fc53a4901cacc093", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399709, "uuid": "5452bf0c-f21f-4df9-a6dc-c6af5233402e", "comment": "Malware payload", "value": "e4aebec62d61daa23ded105b6387d67a87f468dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399709, "uuid": "23466684-131b-438e-98e8-c1ff96a74353", "comment": "Malware payload", "value": "6fd422682536878d32e5a95fd4aef24f5d5430b2c3f9032d1e047f8aa50263b37625f94004b580293bd04c8404049097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399709, "uuid": "6260bbce-4ef9-4000-b9c3-abb5bf09cbda", "value": "T165936D41B74C0A87E1935EF07E3F13E1D3AFEA9013E4B644290EDE4942729325697EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399709, "uuid": "6a8243d2-a443-49c9-9283-d2f6c15962d0", "value": "1536:JAsHIG2/Up91Pe96Y5R20y7aBsfgICmUL2xqgfISQP1wi3P4Aq:KsHtPYvr1mUixUScpgAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399709, "uuid": "0279962e-4e7a-4a85-96cd-e8bac21483b9", "value": 91792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399709, "uuid": "40d4c6a6-f7cc-4ff8-a397-f0996b5d4297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399709, "uuid": "209bd47f-aa7b-4ea7-a214-141c2a1afdb9", "value": "0cd3cfee55a682e04a78a7a1b1837cbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b63518-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Tofsee)", "timestamp": 1652340603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340603, "uuid": "2d0454dd-61db-43c5-9c35-b0aeb8022b8d", "comment": "Malware payload (Tofsee)", "value": "c334c4a18ad3d9dea36f07b5b04696db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340603, "uuid": "e0694ca1-36bf-4283-b3c6-30b0556235ec", "comment": "Malware payload (Tofsee)", "value": "3ce8363d05d1015ebd88250aad7c26b2ec0383b3e8a1634aec0cd86900f29324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340603, "uuid": "d9f92325-48c3-4cdb-81d4-4fb4908d084a", "comment": "Malware payload (Tofsee)", "value": "1dd0dbeaf19a6dfbd4f1e9294a3f9ed94e47d438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340603, "uuid": "f9094409-4098-47f6-87f0-9cab8aa13f34", "comment": "Malware payload (Tofsee)", "value": "d8522be2fe53f9e16e1287b2c49aefc2cac6aaef726a5853830b47e6195e9101159aa94420c0bbab337226af59327638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340603, "uuid": "5110dac4-1ee8-424c-84c0-0ff426580730", "value": "T11A449E10BBA0D035F1B712F4497A83B9B52EBEE25B2440CB62D52BEE56356D4EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340603, "uuid": "9d86f777-96ef-4ec4-8a21-8d453c32b74f", "value": "18b697a0f0624fef499c9d8294973dde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340603, "uuid": "4581b3cb-ad47-419b-95ca-8524586eec6b", "value": "6144:XtSMLmd2opjSXH9wRFXlW0VQRBjJz62Td4/o:dDpQjSXdws0VejJ2Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340603, "uuid": "7666b16a-fb84-44ef-bb48-6597166664ba", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340603, "uuid": "cd193cf6-0b39-485f-8bde-6820d301b465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340603, "uuid": "f115f330-4e7b-4547-99bb-2566fd9c92c8", "value": "c334c4a18ad3d9dea36f07b5b04696db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c096e86-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330224, "uuid": "bad11151-2c2c-429f-90d1-da0ac952b108", "comment": "Malware payload (Mirai)", "value": "4427918fc0d6fbdc65c0c4e120d74d9c", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330224, "uuid": "3a992a8c-519e-437c-b3d9-2aa843da196d", "comment": "Malware payload (Mirai)", "value": "3d16ef9262005ad57df6fcf5ae69b88bc4899ad56d26f652a4eec28af94538e3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330224, "uuid": "af91f333-7c30-483a-8f9d-f3d84386e9a7", "comment": "Malware payload (Mirai)", "value": "4b3c6e067c1bda640ea0a36b2745f6673e219f02", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330224, "uuid": "e08e244c-c8da-4f6d-ab4b-baff869fdf31", "comment": "Malware payload (Mirai)", "value": "c78596ffec99e8e044d28c1ff3272f84bfd82d580468dfca3e7b94021844246f8e9edddfdb363b4630c6cbdc4137f2ca", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330224, "uuid": "bd63b49c-f95c-46f5-a066-e461ec336224", "value": "T109C3396AB9819B12C5D216BAFE0E928E73130778E3CE7217DD185F21378B95E0E3B115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330224, "uuid": "467a7e5c-ee71-48a3-bcd8-5f826b382e82", "value": "1536:3ebn0kssm8YxT7dDR5V+Mfy25U8aenAz4IY+dXn5vlBaSVDPeeUBidQV6hm2IltT:2s+YxTP5V+85UcAPVnxlBaSVQVv2Ikl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330224, "uuid": "8fa437d8-c81f-4b8a-849e-26de260cf2c4", "value": 118980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330224, "uuid": "7fd56cd9-db8f-47ee-8d76-b6282139a652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330224, "uuid": "2b82b840-9b29-4ee8-af18-d86ba00220bb", "value": "enemybotarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e316ece-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652344347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344347, "uuid": "1a97ee25-05e9-421d-918c-16025622a8f1", "comment": "Malware payload (Formbook)", "value": "c35add08ac04eb7f5f3366373fc7e519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344347, "uuid": "e39d53c6-9fd1-456c-9159-26afaa3995ec", "comment": "Malware payload (Formbook)", "value": "3da251655b6e6d182b10a9eb0e3b3b4048a1f0a7cf9236dfc4452d6f6e2c80c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344347, "uuid": "e9f6c8ad-cc4b-45b0-9a9c-84c6dcd8a375", "comment": "Malware payload (Formbook)", "value": "916ad8d336b5bf9c5697dc8a8ff94f09831eb93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344347, "uuid": "159fb9e3-fb38-44f3-988a-aed535cf91ff", "comment": "Malware payload (Formbook)", "value": "a3d4ddef33f7bd20d90f4ebb666634c01f28808abe01559b815f3da1517c171274be7b18282202dd5560eeaf147238f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344347, "uuid": "4b158a50-9c51-4bd6-aa84-db7413e88f0f", "value": "T1A9A4E082D68086B2ED694B34A9335C360A57BFBDFCF4E94E968E71706B731D30027916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344347, "uuid": "0646279a-a16a-47ca-9b5a-a17b71a235cc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344347, "uuid": "3fd8985e-5192-4029-9ae9-c70771534d13", "value": "6144:WOtIFp3cmSsIB1sXekOqA/zZ1v+oB9doV7cSiTjFRhRyuNIHGgzunJGqTEbMVXrN:WO03PSsYsXe2aZp+GT6GbwqlBYSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344347, "uuid": "564be0bd-2404-4380-b0cd-fff6d9337468", "value": 482311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344347, "uuid": "e948c621-4ce3-44de-ba83-9b74d50c9a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344347, "uuid": "408ca9ef-122b-442e-b4d8-028600d3032c", "value": "Scan_PMT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0b8b3f-d1e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652353849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353849, "uuid": "70b086e0-8356-4ab6-906c-8134a93cbb48", "comment": "Malware payload (SilentBuilder)", "value": "bb485614285976cde3de873cd40a620c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353849, "uuid": "4acfdfc5-6cb6-44e9-a923-494c5b8c380c", "comment": "Malware payload (SilentBuilder)", "value": "3da8ff9d1bc9591945976effc2479f549ca090bce71284140dd0c991998e0dcf", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353849, "uuid": "341b7ac5-7941-4a14-a401-c2a503f37730", "comment": "Malware payload (SilentBuilder)", "value": "ba17475ac86256b7d0f2a2e11d05ddd38f2bee37", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353849, "uuid": "29d85b4d-7bde-4957-b75d-48b4203cd800", "comment": "Malware payload (SilentBuilder)", "value": "ed40cbe55494cba33fcb9b0ba0c256f08ec29c5dc226b1eb1450b7cdeb33c598c68819d4907b5af9ba8cf60d5c599bf8", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353849, "uuid": "d3549549-e8c8-48e6-ba9a-291678f1b9f7", "value": "T1A403834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353849, "uuid": "4802a4d2-88b2-4697-a21d-68803b311db7", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353849, "uuid": "dcee40a1-cd2f-4712-968c-5023b66c767c", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353849, "uuid": "5d347070-ac59-4f15-bbc1-120ccfdd14b8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353849, "uuid": "ed69d724-a05d-48ad-bbb9-9bda79f499fc", "value": "IhreRechnung 2022.12.05_1222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19677c9a-d1eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356821, "uuid": "6a17c64c-3d6d-4d9a-b0fe-e1e9f2769100", "comment": "Malware payload (Mirai)", "value": "ab2283253823cf285f91acd038fbd1e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356821, "uuid": "14cb347d-6ef1-4cfb-9ae4-a991693dbd3a", "comment": "Malware payload (Mirai)", "value": "3e07e1f82497656e7e658b97a757759fe2030d1e629b40d7957c2cd011fc76bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356821, "uuid": "c8e0111e-38d2-412f-82fd-c812860b25cd", "comment": "Malware payload (Mirai)", "value": "d2760310a4dacf6a11d7c508bd6b8aedeb372759", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356821, "uuid": "50ac91c5-8785-419b-b3f1-a72e47d8aab6", "comment": "Malware payload (Mirai)", "value": "a58f398270c70f2676db849ca9faedb0c4431a945ec12f56a61c1df32d243526e10c62074e790ac38707172a75754489", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356821, "uuid": "bc9b8ece-33d4-4782-9eca-e9722680e864", "value": "T1F623F1F510043887CE97FCBE62E553A61A3D29B3AB67DD497846EF86DC050A53B82CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356821, "uuid": "3b566612-3e8f-44db-8250-c0d5538189bc", "value": "768:fQI83S0syxxgtCD66K6qOOONkpm1xRrwC8JgGlzDpbuR1JruR+bDGnLFTLBx:fD8v9wtsK6qOOONkpm1xGrVJuEAnQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356821, "uuid": "eca8b5e0-9ef6-4936-af23-3e922bc8b212", "value": 49692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356821, "uuid": "aa90751f-c94f-45fb-9a00-88cb9fc51652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356821, "uuid": "1f92ecee-3029-41c6-8493-42a2a09ebad0", "value": "ab2283253823cf285f91acd038fbd1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f65354-d214-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652374643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374643, "uuid": "374e15fa-1347-42a6-b61d-50dd8591a284", "comment": "Malware payload (Mirai)", "value": "b9cd9fda4cb82e8a37df5a2d383acedd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374643, "uuid": "6e4075b2-c076-4f78-bf7a-90c6e69626ff", "comment": "Malware payload (Mirai)", "value": "3e27065797a426fd55baa9bbe604faba0d6dd1266748e64b169dcdba184cf30c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374643, "uuid": "6b2757fa-191b-42d2-8ab2-345602d19a31", "comment": "Malware payload (Mirai)", "value": "6921bf07f57d1e771f183e3ff43957fa428e0f1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374643, "uuid": "d6817bf3-91b4-4ff3-bc8b-78c718ec7ccb", "comment": "Malware payload (Mirai)", "value": "c95cd7df3793242c30d89c93b2c4c59895afbed8ab2c7f2d7b63f810e5da57d73b6f5347e3eef259118ad249fe28cce4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374643, "uuid": "c7f90718-be98-46ed-8abf-79f103f0d3cd", "value": "T12AC2D0659E098C86C9584A7987EC2F702E230E40F613F7A62D8BE7D6CC4B4E56543DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374643, "uuid": "c34decc5-b924-49d9-bb97-e7bdad7385ec", "value": "768:d/4SpciEK+MKCSyqbFJuZuhRkEJgGlzDpbuR1Jj+:tl9+MKCnaOH8VJud+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374643, "uuid": "85c26958-d731-4338-b5ba-01d433595e28", "value": 26440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374643, "uuid": "314e6702-828a-4c6a-88b2-66eeb3b60f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374643, "uuid": "ec447f58-9b1f-451b-981e-d667339d2099", "value": "b9cd9fda4cb82e8a37df5a2d383acedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b5dc2f-d192-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652318939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318939, "uuid": "6adca544-725a-49d3-b598-b956b667a06c", "comment": "Malware payload", "value": "98b29ef89ec7d588b6531d00b8674969", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318939, "uuid": "6cf07d5f-cf21-4577-a202-28174903234c", "comment": "Malware payload", "value": "3e7cb1950fd2fe170ef0cb38963cae833247d73e1bc3245b3f9751b6fbaefd67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318939, "uuid": "0b255299-370a-4c33-9e1a-d5e36c9f3496", "comment": "Malware payload", "value": "ff86f7d72f17bc2b4bc33e840fb5506883e15726", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318939, "uuid": "c4fb217e-459d-414c-89a8-9f2fbd78c3f4", "comment": "Malware payload", "value": "295b5bc6521f15d6db1969fd67cd8f90cc9371347a04d38bb45ecbfc70fc5e0bfbd6610c98d10bb368abd29b14337dfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318939, "uuid": "7af9a398-c745-4ad6-b8e0-d159748352e3", "value": "T176228442B74D0817C0363FB0393B6A90A75AAF6522D9E2C4726F598ED175D305281D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318939, "uuid": "74ac0738-9dba-4ef5-8b09-65347f205b18", "value": "192:5MrDqiFZJXN3N91ylBccKlo4n0eHFqYczKxFcTMWA3V3twp:5KDtRrylucKll0sqYczKTg9C8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652318939, "uuid": "07e6cfa9-67c7-48a0-8995-2832228446fe", "value": 10868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652318939, "uuid": "8d9e7eed-c068-4548-b1bb-9c8aa87916d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318939, "uuid": "e6406101-4fa7-4b25-a0d2-4ebaf81e33ea", "value": "98b29ef89ec7d588b6531d00b8674969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7b549e-d1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652350060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350060, "uuid": "9d960bce-a9cd-451e-8d07-dec90f435ccb", "comment": "Malware payload (AgentTesla)", "value": "1f11f9f84626ab088720deaac41989dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350060, "uuid": "4c5a6494-f3eb-47ba-aa38-c656c42358d9", "comment": "Malware payload (AgentTesla)", "value": "3e91f26895102514ae54919301b8e606adbc9bef3e7141263a527f29d150675a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350060, "uuid": "3a62395c-29cd-4725-8166-e7883feb207b", "comment": "Malware payload (AgentTesla)", "value": "fd81c4f69a4c9573def80a75c4b99f63617415e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350060, "uuid": "2db721a5-9518-424d-878f-cb540b308c20", "comment": "Malware payload (AgentTesla)", "value": "a494f0e3a5f2e32260f1d5f909071cce52c83a11213c8dd9336b9b759024e420b92c173a96d316402ea48fc0a69c6dd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350060, "uuid": "37ebf9f1-98dd-4f9e-aaa6-8210a3c8c290", "value": "T1E105A59C722831DEC85BD276DAA85C68EA90757F931F4103A02715AD9A1CAC7EF14CF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350060, "uuid": "3ed778d4-82bd-4ae7-ace3-8cbfc1e18037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350060, "uuid": "bbbd1887-cc66-4ce6-8a66-5f8b2881d15b", "value": "12288:BCsVE43JXSu02xNnd/XH6JPvkhg7Vp1GRNYmQL6xJD3fOrGmPtptm+9aShKiglBY:csBJC8PdvH6JPMG6P+mJDvghd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350060, "uuid": "39a54eed-8b41-4fd1-8f7d-ec4a74447abb", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350060, "uuid": "19680f1e-ec59-410c-8728-d81130caa34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350060, "uuid": "e7e469d2-0b68-4d94-98ac-314a9fc22c20", "value": "Outstanding Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1788397a-d1b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652333625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333625, "uuid": "89dc85de-8449-44a9-a0b9-bf8479922215", "comment": "Malware payload (Vjw0rm)", "value": "c50d948da162b104b550b18830c36eda", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333625, "uuid": "63ce6763-8e4b-455e-9e45-2c868cfe850a", "comment": "Malware payload (Vjw0rm)", "value": "3eb89e9ced8ab3d8730690a0d6dd87792189332e4eb122199d56e64dd748f857", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333625, "uuid": "2685a6db-2a90-4dfb-a9a0-ddecfb85eb0f", "comment": "Malware payload (Vjw0rm)", "value": "02c934a2330a1f33f80257224f63e7cc43133065", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333625, "uuid": "8c7898fe-517a-4157-a73f-c1971dc69cd1", "comment": "Malware payload (Vjw0rm)", "value": "fbbce8ab0f8eb3f26338e6a1c1e9df1779bd0782f61ba8b71defb92858d0a2ba4871ed75d50144b034535e75d81a5f79", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333625, "uuid": "c2305a4f-8625-4cae-9424-4c0205950521", "value": "T1A1B3F7CC7D61A0AECA9895767C3E2CC547F6624BA072938E350F32041BAB349DB9D75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333625, "uuid": "7d88e16c-499f-4b0f-b455-5ee965f7815c", "value": "768:TE0CdxROcFKJ5tFqL5rukQqxU1UtRv3wsahd6Rdf9XgdHZq+Ir:A0kxRoFq1DdO1UtB3w7dudf9XgJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652333625, "uuid": "f857e16c-26e2-4298-b3e8-aa8d88dfce94", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652333625, "uuid": "9c25f210-3362-4fd3-b554-9a938a2be72d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333625, "uuid": "a452b245-e53c-4c5d-a80c-1e20bd1e0b62", "value": "Voicemail_message102210.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6a70c1-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337068, "uuid": "3e855945-5f38-4030-a348-5d936bcc212d", "comment": "Malware payload (Gafgyt)", "value": "e19bca3997c5097329011c9dcf147e8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337068, "uuid": "2c643058-797d-4c2e-bf51-185676e4094e", "comment": "Malware payload (Gafgyt)", "value": "3ee274d11773e4c289ee04f128522c42c8e009769afce25ac291514d41695988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337068, "uuid": "314b23c1-51dd-43d4-8945-5467328c7548", "comment": "Malware payload (Gafgyt)", "value": "38d587c2707ea0a5e93bf8882c1fe16f191950b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337068, "uuid": "4f247097-6f65-486a-883e-cd8030c9b949", "comment": "Malware payload (Gafgyt)", "value": "369aef49bca43db1f3b08a2c9addf9b069ac1d82a4ba51c811e06c894638986e4b1a8517fc5779840ffe13885e30e35b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337068, "uuid": "5362e9ea-3836-42f9-945e-1d9579fd8ad0", "value": "T157734947A9659FB3C146AAB525E759300B13F8215F0F2B89713DAAF8430F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337068, "uuid": "70c3e8b2-227b-4101-a9d8-183d20cbcf71", "value": "1536:8wyVzh0fcKepZ4tyG1NaEVx7Cy3yzvVrmj9VqYLe8f26e:PIzSfDeYyGl7p3MVmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337068, "uuid": "219bcefa-1c28-4090-9b3f-892213065436", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337068, "uuid": "a91dfb30-538a-44dc-a749-84e684933408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337068, "uuid": "c4ae921c-7754-4d22-908e-6584894b36d4", "value": "e19bca3997c5097329011c9dcf147e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c627253a-d226-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652382451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382451, "uuid": "eff1a2ae-b075-487b-8e65-26bf331c8d59", "comment": "Malware payload (Mirai)", "value": "b0a796f5c0011c0a8aeb3ca93fb59a38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382451, "uuid": "2936d60d-86bc-4c19-a065-dd9128559bf5", "comment": "Malware payload (Mirai)", "value": "3f72f667c28ab65d63ec45c9de579975212f508f86dde84d71c86093bb0e6426", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382451, "uuid": "8f9bf637-58fa-4458-a35b-da2ceafff32e", "comment": "Malware payload (Mirai)", "value": "eae60160f3e171a5da5df6ce99e58e5d93a92c93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382451, "uuid": "4265d11e-2b51-48d2-a9cd-d894e28d954c", "comment": "Malware payload (Mirai)", "value": "f7d8c8cd178b72f38d8cf17bf70531d66edd8be06e5105bb06b8f7a2da5c8963eddcb05e2161b140d5f35dfd4f104a84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382451, "uuid": "1d707a0c-3dd4-48bb-9912-0636875ea886", "value": "T1D6932986BC419A11C6C21677FE1F108E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382451, "uuid": "d50b8c14-d21a-4b50-8837-8043422b76df", "value": "1536:XhnRcUWoXufJ4Au8YKzvo8J5zVMcOfaUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuG9hMRC0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382451, "uuid": "81869c09-43d1-4fec-aae9-5d3173fbaa31", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382451, "uuid": "36811a5a-7037-4a1d-a165-4bfcae1c3e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382451, "uuid": "bc272387-72ea-4272-bedc-52357936c37d", "value": "b0a796f5c0011c0a8aeb3ca93fb59a38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b87c63-d1a7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652327773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652327773, "uuid": "00f102a5-521d-4497-a34e-f646f2ce59dd", "comment": "Malware payload", "value": "07d922080d63cbbaaf52df06c56dcb47", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652327773, "uuid": "8e512cd0-7bed-4cd3-ba3f-09cd0e9af2cb", "comment": "Malware payload", "value": "3fc4903599e15a35f5c98ebde7e1f857503e204e5ff7fb9c0eb7b77faecd2b72", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652327773, "uuid": "bf37938b-2377-45bc-9843-40ee395c00bc", "comment": "Malware payload", "value": "750b798a4e3c4e48cd4cb67ee2ed9fcf4d467afb", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652327773, "uuid": "e67c238d-8413-4fcc-af0e-148b8b5ff441", "comment": "Malware payload", "value": "a7e8424cec170412be342abf93383d559c459e7532706ef29734a82fdb5c9b8dcc03585bb90e4acf6005b12a064059f7", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652327773, "uuid": "0f7c5d62-5bec-4cb9-be3c-5fd8f7c8641a", "value": "T14CD56CF89F99244CD437D83995A7BD7A9B8831135B4EAFD0331BE9125276308A82D1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652327773, "uuid": "cc37c2fb-751a-4653-9d39-863e4f69af73", "value": "24576:TeUSkpY/QiQtGqK+Rc6fOdmJTTZe51eYLx1VeIFpX7SvaT+XPpy3z1:CC0mter", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652327773, "uuid": "9d38b6b0-3ea5-4ec2-8a9a-0f5c951a1e58", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652327773, "uuid": "f3c7abfd-3582-4d4b-b281-ec76533fe094", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652327773, "uuid": "d41c78d6-f513-4144-8306-dcfc6eaa8a5e", "value": "invoice_pdf_1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17727bef-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652344362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344362, "uuid": "65022b5e-cbf0-4d31-96a3-c65abc20f18c", "comment": "Malware payload", "value": "5fca3bb39e715f8c92a8b5a8bb0d3430", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "JXWSSKY", "colour": "#DF8862", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344362, "uuid": "3f69155c-c97f-457e-a14a-3e26c111d9c1", "comment": "Malware payload", "value": "411faaeeb25e267d770efa4cefc5bd154a2c9a4dc64c91a4a68cfd3e722ec554", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "JXWSSKY", "colour": "#DF8862", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344362, "uuid": "22d9969c-94fb-4618-b320-dad156034111", "comment": "Malware payload", "value": "933b7caf3c5f51acb4b0f8bb50a3644b1869b250", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "JXWSSKY", "colour": "#DF8862", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344362, "uuid": "383ef1e4-e32f-4f07-a463-b911a29d5689", "comment": "Malware payload", "value": "62cbb6401d95646cb6d545208fccf1a85a607fa386dc4f8db352674632e184ac4192bfd48935e0bb65873a94cd40cf4f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "JXWSSKY", "colour": "#DF8862", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344362, "uuid": "495c7762-b26a-483e-8974-db693c874ba9", "value": "T1A9311B0F9F5F26D8CF54543F7458F5015A492F210FBC5A902D28FD7B68324CBD446588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344362, "uuid": "ba7c4406-c9e8-4e1a-a98a-9338b74259c3", "value": "24:Fl/8GdcgSlcumOxMAZSCNtW3JV8qtDmsQxBiK8R8SV/wVjby1F3phqaAwZC4LEiY:38GdcDmtodNtw8xsQxYK8RVVoJbyXjhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344362, "uuid": "8e5ae1ef-5abe-4d94-83f2-d28f4ce02dfc", "value": 1501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344362, "uuid": "a55b0700-39cd-4f7f-afb5-64dcc0be64b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344362, "uuid": "122dc81c-3596-4e52-b1f1-fd3d841a46a5", "value": "6059168111078193811982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc4edcc-d1b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652334949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334949, "uuid": "4237642d-443a-4ef9-b050-ac9a9c6b143c", "comment": "Malware payload (Formbook)", "value": "c01cd826477e6f9a8a9e97b3d9833ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334949, "uuid": "1c336d07-6c1b-4937-a003-c3c462ed9d2a", "comment": "Malware payload (Formbook)", "value": "41334a91329bbeb6ffdb8d4d4377629f71cc9b2b2fd47ffff3c26f2117b5010d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334949, "uuid": "044eb4e1-d2ec-42b6-b7c1-26257b50e875", "comment": "Malware payload (Formbook)", "value": "c935bc1a4faa6e6743ae13ab94b04d291b8aa888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334949, "uuid": "c51b5617-5c00-4529-bb80-bb6dde4d4fda", "comment": "Malware payload (Formbook)", "value": "5b5cb780c44019eb426cf5d1b865da51873f1d2964454966a1c63dc5aaacec0600ae779f535b09392bf5c97dc43683b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334949, "uuid": "ad4ed4de-ae5f-4ae8-8980-19e225e9b24f", "value": "T1CF85121623C4FD18C17D3334AD38A5C053F2B28A2A7AC34E66CB8279BF56B4E7B81555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334949, "uuid": "6358956e-e98e-4d18-af97-54f47736ac9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334949, "uuid": "5075e787-c1a7-4955-8d41-d3d3711440bb", "value": "49152:mKkq94Cgiry1f3XH/2aoaGwl/k36nwnOj+:mK/4Cgl1fRX/k3oUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334949, "uuid": "c1451226-e513-46f6-a98b-7ee911f11850", "value": 1770496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334949, "uuid": "7007b268-f043-4422-8e90-7959384d4cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334949, "uuid": "1c066c45-6af8-430f-980a-db3dbc1d3b5d", "value": "Photo_40389589jpg Photo_40389589jpg Photo_40389589jpg Photo_40389589jpg Photo_40389589jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3597d9-d1aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (QuasarRAT)", "timestamp": 1652328991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328991, "uuid": "be211fb2-f741-42f5-b2fe-79800098adb5", "comment": "Malware payload (QuasarRAT)", "value": "a7b132d27949ec0aaca7e31cd2fb0b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328991, "uuid": "7d160fc1-dd09-48f1-9aa8-9bfe4a85d00b", "comment": "Malware payload (QuasarRAT)", "value": "419a43cd026621eb0fb785f00fc7b502bd865e0cae5a65b540b03a12673f38d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328991, "uuid": "33da6eba-5e81-4f60-82dd-f586499db6ef", "comment": "Malware payload (QuasarRAT)", "value": "4d3345178b21924fb8bec7f07c2ac4bb4cd872a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328991, "uuid": "17142e6c-a94c-4594-9751-c8bcf35ef5fb", "comment": "Malware payload (QuasarRAT)", "value": "b97f8bb7f5301fc3aeb7d2341b7e3f2aeb43ad3202555a41db19d8affde9e21c0539be80bcbbb134e58ecd7bbd98769a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328991, "uuid": "a56706c9-5ffb-41ab-822a-01b22c57f07a", "value": "T157B46C4023F8862BE57E5779E87105206BF9F407B26BFB5F4541B0E92CA67069E40BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328991, "uuid": "d05d9eba-462b-4940-be45-1c796d87abea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328991, "uuid": "928dd0b2-6020-448e-9d3a-aaca51a9abed", "value": "6144:RTEgdc0YWX7IxUpGREWncoKKf7Z6HFTcEkPb8F9FY+pDliIcTR3e:RTEgdfY3xUaxiTUMvY+pDliIcde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652328991, "uuid": "fbcccdde-68e7-42c3-b1b5-3d76c0d50973", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652328991, "uuid": "6b6b91ac-6f00-4f04-9c66-89b76e8368ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328991, "uuid": "7d1cb166-79ab-4a2a-ad7d-a36fd8135850", "value": "419A43CD026621EB0FB785F00FC7B502BD865E0CAE5A6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19844a7f-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1652379585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379585, "uuid": "8dc4e3c2-6f4a-43c9-b3e9-9ab38a1a44d1", "comment": "Malware payload (STRRAT)", "value": "b40a090ec06b743317f29eb5dbaaeb6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379585, "uuid": "2feaad65-3e04-46b6-99f2-a2cea3c022c3", "comment": "Malware payload (STRRAT)", "value": "425eabe8caedbdc72ec556f9b04845a3a4e474d8f4cd68b7098a6103c4d438d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379585, "uuid": "818c1351-2b1d-4a2a-9530-845a6f7e4073", "comment": "Malware payload (STRRAT)", "value": "6ca471737ebb2c7ae0df946330f70688bc4fed46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379585, "uuid": "dc34a321-89f3-4cec-a6de-ac61358eec85", "comment": "Malware payload (STRRAT)", "value": "7db6d1d1ae37dbd2d3268ac8e6dbf45d9c0d742b66ec71ad04eaf2d58add795937ea14ab89e0f9703d43194877c125a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379585, "uuid": "550b4034-0d41-4239-9355-0e217e4352a8", "value": "T18024E549DF84076DC9F7C00AD0DE22CFBF98660D9F21B4E5BD616B5FAA63158138822D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379585, "uuid": "3ca4260e-89c2-4390-9ffe-d3bf3361a07e", "value": "3072:dg471j2VLfLtcYx5G6nWGUBKxor9Pho+t58tMENAM0BIWuIOJDgi36F2wydb:dgOIxDG6YBKcPxtpI9Db/wA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379585, "uuid": "c00d7eb1-098d-4d45-9c1d-31891bb4e27c", "value": 218592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379585, "uuid": "22d1dd34-4f7d-42f3-b041-fb0d00e0d5cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379585, "uuid": "3aa9f812-5c98-4aad-8f67-6a09f8bcba9c", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fed438-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340733, "uuid": "dc2e785e-679d-4026-99e0-8e019709a0b6", "comment": "Malware payload (Formbook)", "value": "6cc7f4dc6d60f6b01b7164532f4d4fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340733, "uuid": "0323705f-b842-4b10-8452-7521f7d0ea17", "comment": "Malware payload (Formbook)", "value": "42d8b7f214ab4c51c337d3abfaa9107f0e8fd78801311e205cd484e4b65fb440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340733, "uuid": "fe5ca222-34f2-41f8-8cc4-aa9c651512fb", "comment": "Malware payload (Formbook)", "value": "1dbf0fe6eb6c43494507f2cb286eac424ef87e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340733, "uuid": "553d4b20-9f06-459d-b2be-66ca494e2dc1", "comment": "Malware payload (Formbook)", "value": "7fb0e3e80d5d536e31911e2410b8bb51bb90d499ee1742fae0c52e8cc782f813e096b250f01590ded03a304cd8324e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340733, "uuid": "93bac7a5-f4b2-4271-b20d-fbaf927eb82b", "value": "T15B5413539DE0C197DB722A310B722A5A8DEB0D1528B4724F07D1BAB97F33591AC0E789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340733, "uuid": "eb3e4d44-5b70-4485-aa8c-3c05925480ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340733, "uuid": "a4f16e80-7ddd-4b78-b201-cd5b801032dd", "value": "6144:LOtIO0wanUvZCAb2uN1i8IO1COKrL7hWOHWHvXqFFt5IgkyKqRgyJTg4pIyaN:LOLAUmM1iW1CRr8OFN5IWRBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340733, "uuid": "57fdacf7-441d-4ef4-bf39-1d5d1a0ec0f1", "value": 305725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340733, "uuid": "ed4049c6-33e5-4716-afdc-1b05d4ac97b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340733, "uuid": "2627582a-8c64-4480-9696-ede93a222dd5", "value": "6cc7f4dc6d60f6b01b7164532f4d4fe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c625427-d19f-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652324184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324184, "uuid": "0e97b99f-0ea5-4d45-b73f-c5af84040efc", "comment": "Malware payload (njrat)", "value": "ab8a4c7bb3e24152d3f33deb5dbd0009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324184, "uuid": "38ca424d-0cc9-4b3c-8d05-8cba9936a4a6", "comment": "Malware payload (njrat)", "value": "431cdc21ffcd2785f9f3c1fde2cb6f003b3bfe5fef4ca8de7480a430c99a8905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324184, "uuid": "7c698c54-cd05-4df5-87ea-b5b21b792c75", "comment": "Malware payload (njrat)", "value": "b7b892ee236753217952d8c58e2573483db293d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324184, "uuid": "9d9f5b9b-44eb-48d9-9c26-a061e9911f89", "comment": "Malware payload (njrat)", "value": "cc06ccddc558b6413984d8784bcb9d90371a206ef1decb1fadc1f3068ba2cf8a8cced38fc7020306931840586325b57b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324184, "uuid": "d3cfacf7-b6d5-4226-917c-e97f98ceabe5", "value": "T17894E150B146859BF85657F0CD9EC4D403B6AD1FACB1D22F69867A2D5AF330200E3E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324184, "uuid": "f1c7027c-53de-48ff-934d-96da78bf10ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324184, "uuid": "3705c4f0-be45-4628-b002-13921106c934", "value": "6144:mCdPT2lEkrmQY0/ehoRfEf3q+2dfT/P5zAA+7tBiDZbjgWFExQe+:ra1YGfG38fT/P1D9HuxQe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652324184, "uuid": "222349b2-14e1-436b-8a12-c2fa9222a7ae", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652324184, "uuid": "f6246df4-68f3-458c-8001-d1677dc57229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324184, "uuid": "84c89e74-9c45-40bb-a05a-57c33b118b78", "value": "Furnicture Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21424ca-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652376861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376861, "uuid": "623742d2-fd60-428f-993e-3490d52621bf", "comment": "Malware payload (Loki)", "value": "e647eb555d9cabaf7997da05d2195ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376861, "uuid": "677b384c-c819-43fa-a4c4-2d87570a8c34", "comment": "Malware payload (Loki)", "value": "434e76f577ffcd5513d95da9adce03abd7eacd4dfe4ff8c320d9a8fe18b0c380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376861, "uuid": "9cd8cf52-4477-4d76-87dc-dba8505e2c55", "comment": "Malware payload (Loki)", "value": "ee2add1f7c0bacf5b539f57ace0e66e3213954a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376861, "uuid": "5d274ee2-ee6b-4fd6-a394-ed1081b023af", "comment": "Malware payload (Loki)", "value": "a7862b4261e646155d5f9de0ec5abef5b28d24b944b4d8b0b3109191ed5674b7b3d1703192e5de1919db8036cf7448ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376861, "uuid": "54ec4742-ab3b-4b3e-91e5-b1651ff818dc", "value": "T1E724122053F5D153F8F34A325D37AB294AEB89122168E2674B44316F7DB2A42DD2F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376861, "uuid": "861dfee4-501e-425f-ac17-3a92d0e23591", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376861, "uuid": "a19a921e-749f-4e4c-a722-588877b6abf0", "value": "6144:LOtIOhKEKF6SBEnIJVwCoildpumF3s2pfgF:LOLh0FPinIJVw2DpumNTpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376861, "uuid": "6e115c01-d9f4-4e27-b26d-6b0c995a56e5", "value": 213067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376861, "uuid": "6e07dc3a-6011-44b3-9d5d-f102f9100c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376861, "uuid": "7c281299-5562-4f2b-8d9a-c2461b56c864", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0abef8-d218-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652376502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376502, "uuid": "3feaf2dc-37f8-4cc7-8287-ee0b7fd2a96f", "comment": "Malware payload (GuLoader)", "value": "c792c744dde586c896d6ca8cceb0e04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376502, "uuid": "6eb0985d-1eca-418f-a6b4-edc39f8344ec", "comment": "Malware payload (GuLoader)", "value": "4385dcd25c41dcc70603b48daa969cb455c6fd605f7b3a7e6088557b9ab4964a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376502, "uuid": "4ebc8f52-c416-462f-9dec-ba3d199561da", "comment": "Malware payload (GuLoader)", "value": "66273efb747ba478fc7c2122f647c0a01d16c4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376502, "uuid": "cdefb418-2f14-478e-a07a-84eba8ea26e0", "comment": "Malware payload (GuLoader)", "value": "492f47d5d04b82b40bcf92e41a6aa9eb3bc1c863b6600c7d2689f26e1ecec32385c54f549e7c7ab1881e3a5b62bb00c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376502, "uuid": "354cd3e4-d98a-4f93-a935-11c9599d0548", "value": "T16C04020827B0C453FA6707F24E78877A7FA5B91158E5924F13A01F85BD72B439A0E35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376502, "uuid": "30f2b765-8a55-4224-acd3-25493c28ac6e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376502, "uuid": "6eb60627-a00d-4497-aa9c-4477a42ffe49", "value": "3072:RfY/TU9fE9PEtu4bDDq6VG3dGmKdKFXKX+d2Q1Wi+hZUKqSccz5xqBES1CXF6DYT:9Ya6wC6cdOEcm2Q1ahZUKQcFxw/1CXFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376502, "uuid": "f8bc16a8-76c5-40f2-8dcb-a356bffc6093", "value": 184424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376502, "uuid": "a3f7dce7-65ec-4f79-b4b8-dce803c7734d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376502, "uuid": "69a62882-bfe8-4033-90b5-5ac2c61761f2", "value": "Bluepoint2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44293c47-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652374073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374073, "uuid": "01099d4c-52c6-44ed-a344-b5b39065970b", "comment": "Malware payload (Mirai)", "value": "e72cd0be135a6cffbe9dfffe4ac45aab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374073, "uuid": "2dedadce-d78e-49ad-8b16-7a25e16f7b04", "comment": "Malware payload (Mirai)", "value": "43e02759c2e2d4405e16d105776b1d94a93f910f9ae17a7a8cf0f0868b5d1e20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374073, "uuid": "90e51fcf-c6f5-4d94-bfd0-80a0e93b449e", "comment": "Malware payload (Mirai)", "value": "a7a65052efe667b5608e576674dd70413390ef00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374073, "uuid": "531d4b94-3889-4ad3-b8a6-e5acde61bea3", "comment": "Malware payload (Mirai)", "value": "4afb14058fcfba11aa702470a014be93c8d57cd0df4e4c35dd54704a8fefa64fe9b2730b98aebd1b18d7ee95d81cb243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374073, "uuid": "6afe8b64-fc60-4973-b9a5-78dc394687a0", "value": "T1ACB2D055E8604B46EFFFEC652E84DBD6AB214F8933C29F521480EF186D665B31346CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374073, "uuid": "32094b2e-77be-4863-8d7c-84a99e1f2db4", "value": "384:QVm2lsZxbHylj8mFFlP5tccmsIJsb2IedCymjSK/5Nw9HSAVM4uVcqgw05VxJ9:SmEcryLGclIJsqIlBD/5NwR+4uVcqgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374073, "uuid": "ee1f9029-d479-4939-b1d0-8eacba773487", "value": 24172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374073, "uuid": "6debc508-34cf-40c2-970c-e2cdeda6773a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374073, "uuid": "8426be69-5cd2-44c0-a016-f6db3155bce8", "value": "e72cd0be135a6cffbe9dfffe4ac45aab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93686cf2-d214-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652374635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374635, "uuid": "cf596584-090d-47db-8502-acde785fcf67", "comment": "Malware payload (Mirai)", "value": "6db58264d04ea385c11cf37f74daf2bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374635, "uuid": "471a8638-c2a6-4b2b-9915-7bd87e2c9ef2", "comment": "Malware payload (Mirai)", "value": "44488584239428bf00777ee1291b1d1c3dabdc6053b18f5720651c75b3f35668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374635, "uuid": "93512204-73ea-4fbb-8b81-4e50efc92ee1", "comment": "Malware payload (Mirai)", "value": "5553e78f9210e93eb5c60f0f219549b889c81837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374635, "uuid": "bb91f706-df7f-4600-8f0f-11d65886b918", "comment": "Malware payload (Mirai)", "value": "08c0e7a82e977e40ebcbcbdc3e98b3a07b78b772a9bef19380f4c129192802c8fbff1ff48d76d803959f1649fb41231d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374635, "uuid": "762ee88a-383d-434f-b90f-a2c072489feb", "value": "T1C1337C64D46A9DACD1064AB476288EB48B22E0C0D7477DF6A710C3A99053EDEF154FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374635, "uuid": "0deac70a-bbfa-4e9f-b29b-4fa0c212d3a6", "value": "1536:Ka88Lb7cEJFOfs3IbYtx/qv8zthypvNLOOll8INSNC0gGo:Kr8LfGf+IbayXl8IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374635, "uuid": "e090ef76-500f-443d-a3a2-7ff6ab5e20c4", "value": 51668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374635, "uuid": "c393ef13-9c3f-4cee-9aa7-aca286c858ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374635, "uuid": "48de5877-ffbc-4088-ba2f-b3496cb6dd37", "value": "6db58264d04ea385c11cf37f74daf2bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd93c5a-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652334740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334740, "uuid": "573b9ff7-95e5-4e5e-8d78-f95dc3022a67", "comment": "Malware payload (AgentTesla)", "value": "f92d277ff0a2da4153a0cb3c6a520403", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334740, "uuid": "eade6a2c-1d9d-473a-8850-d3e3bd27b0bd", "comment": "Malware payload (AgentTesla)", "value": "4450c535da1485c7f2014b60aced54a1716074b7ce4f2a75dfe1892813d0bec9", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334740, "uuid": "14a9a7be-a3b7-48b6-9adb-d930f1d43f52", "comment": "Malware payload (AgentTesla)", "value": "741182c5bc6cd77f28c4cb3279b01017d69b4bd3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334740, "uuid": "f6068d32-55ff-491d-bdf1-84f9d1888416", "comment": "Malware payload (AgentTesla)", "value": "4a83021f6ad01cb945c681d5cf40940a2ad8c246f0b2dee0689df0ea7eacd296ecf805b7276b1e24017ad1e50c4f251b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334740, "uuid": "d0d98f46-0b13-40af-8c9c-10afea7386f6", "value": "T1BEB423C0B1D546931E86B18061E0E7BD0C4BAABA9D6EBD9CCF4379F6540ADD8E41F603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334740, "uuid": "c1758e36-3bc8-4223-bf6d-f061adf6cda9", "value": "12288:WXHL9hYqH+PimTz0h1GMjkMgcJNcqEKZ3Gk/D7cWZ2f:WXL9SqH+L0LGMoMg3tKMk7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334740, "uuid": "d881e49f-7904-4b90-829c-e6c6edc4e37c", "value": 518828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334740, "uuid": "82b0be17-0e43-4d3c-b9bb-ab10f1ea315e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334740, "uuid": "ca2599df-545b-4297-805f-e62a2163089e", "value": "PO1050AD.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5a22cc-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652379401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379401, "uuid": "41f25e59-7837-4d3a-a884-695bd1242f18", "comment": "Malware payload (Formbook)", "value": "4361c2e9b32d339e6218660857236ecc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379401, "uuid": "4ee691cc-7c34-474f-bb9d-150599b3ed9d", "comment": "Malware payload (Formbook)", "value": "4496d53b263a648a327ef1236a83dfc9db9595f3562066bbbfa2862991d64319", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379401, "uuid": "7523b240-b07d-4e25-8e4c-38d73c36ee5e", "comment": "Malware payload (Formbook)", "value": "c85bfbbe020cf3597b3f1ba3ef76b58ef6ced975", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379401, "uuid": "740b28ac-8b23-4dfc-9c96-8704fc84bbfc", "comment": "Malware payload (Formbook)", "value": "b7a7967d50582a822cdd70d596d286d07d8b1d6e863ec1c23b7c5c2ca103bfdd136dd58adb8a2899c6c460a025f23362", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379401, "uuid": "3b7bce1a-00e6-4cea-9880-bfe3aae35401", "value": "T1DC0412383B6FD7D0C236EC7C968846366635EE787AADBC0241C6B1691D3274E417823B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379401, "uuid": "0526e8a4-0f1e-401e-bf60-6c8087238896", "value": "3072:feRzLpWiCoDyOB/8nu+yP++j0FUG8+str/CuwSY9BcgOoyl8pf3yo03jZZMyA:GkiCi3knujv5G8MBSY9B5OoK8AoaZZM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379401, "uuid": "a0cc38b9-25d1-4a1e-b11a-79e08d20c6f0", "value": 188104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379401, "uuid": "ff2a4c80-2283-4f61-a519-e7d49c5a206c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379401, "uuid": "f867bc95-ec78-446a-b468-9cc83e40cd38", "value": "ntrebare ES220062.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699f60a9-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652343641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343641, "uuid": "cdd04d1b-338d-4b2d-bd04-5d781c2675ac", "comment": "Malware payload (Formbook)", "value": "f096be8a5bfe60b7a4a20518b5f7b601", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343641, "uuid": "960432c0-8c26-4217-a6d1-cca1c15e0a38", "comment": "Malware payload (Formbook)", "value": "44c088af1487247b48ef427d49ce3be93642e593f3ba4d730ba41d56ce17b66b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343641, "uuid": "ca8caac0-9810-4f9d-9afa-ca23e601c7b0", "comment": "Malware payload (Formbook)", "value": "4e08b30841c1b6ab070dff1bb173de0c1de80d15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343641, "uuid": "db82bd14-4848-42b7-9b86-0e2415a4f523", "comment": "Malware payload (Formbook)", "value": "eb4633c66bdced17d05b776b58e110f14c1c05afa65c9d19257847f07908f2e34fa37a3e36c0201db2037b9364375d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343641, "uuid": "141a3e16-1e5c-427b-918f-df70bdd7da7e", "value": "T143E40218B7EADA22D1AE7F36D4F5101417B9BE4AA033D31E2DC8124D2E537D74A613A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343641, "uuid": "e2609d30-e38c-4b8f-a8df-ed7e7f414a53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343641, "uuid": "02870f29-51f6-41b7-a92b-57d2980b90b3", "value": "12288:FpzpmpfT89WJ2HGOlG3980jpQ+dJi6Ztv10m3wWaPaVp:F58S9T7l+98eQwJi6ZtvKWWaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343641, "uuid": "60fbcdef-c7f3-441f-9e54-215feb2bb436", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343641, "uuid": "e4028b1e-2629-4d75-b908-cb3876babb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343641, "uuid": "9701df65-0ab7-43bf-a381-3017b54fa485", "value": "f096be8a5bfe60b7a4a20518b5f7b601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321783ec-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338824, "uuid": "6452c897-41e1-4579-bb6b-fed1564db4e9", "comment": "Malware payload (Loki)", "value": "78380152054843ae60d20e613dd12426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338824, "uuid": "548716b0-5433-4861-b0a0-58b02ae6f72e", "comment": "Malware payload (Loki)", "value": "45396f2515913a19682e40490b5db745429ad2cd0dcb9068103d8fbac833287c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338824, "uuid": "8c70c747-15a3-4745-b46b-917861b63ed9", "comment": "Malware payload (Loki)", "value": "b060be3fc0726f2e2a4e1d714011c34196d25dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338824, "uuid": "1f57ff83-7175-4923-955d-93056c1839ec", "comment": "Malware payload (Loki)", "value": "64208ab24e4ff15c255e9b1222ce91aa841612eefb3a2a624ee148267d50a0ecb0ccfaea21ff7733c62360019f212281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338824, "uuid": "baa466c9-c95d-4e49-b619-90e3111b8d46", "value": "T187A412096AA41331E89E6FF4CE59A1CD13B0BD125D32E65B0CECF1EB16B274406A5F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338824, "uuid": "5128e3af-daab-45e3-85c5-22f1e66cf784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338824, "uuid": "e146277d-e917-4dcb-a1ba-88512796578c", "value": "12288:qSFMDHbk2v0vW8NEbQJagHnrZ1IYrTNQZ1JxgXne:qbIzVeWHHhTNQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338824, "uuid": "9995e99b-9d5d-484e-a236-7a3d2072da9e", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338824, "uuid": "0ef3a7b4-8777-4014-bc38-3826adb87114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338824, "uuid": "f413cae1-939d-4809-93af-58ffc426d9da", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86b63a5-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652363611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363611, "uuid": "92c08d7a-611a-4f91-8ba0-68b25697a909", "comment": "Malware payload (Growtopia)", "value": "44ab8ed350ba77eee3e095b79b5c2dd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363611, "uuid": "3091e022-b523-4587-ba93-1513a477fd4c", "comment": "Malware payload (Growtopia)", "value": "45fc53eefee0c75223d2c5f1c0a1398aab49614246830eada1b8c109584b73c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363611, "uuid": "6be61244-06a4-4efa-929d-4693e3cb5d15", "comment": "Malware payload (Growtopia)", "value": "85ec1afa953fe01d05b1d5890dce0f2df9ba4c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363611, "uuid": "e70fb6f6-25f0-4e0b-b645-293e84370070", "comment": "Malware payload (Growtopia)", "value": "fd9c0830f5acff12d1a1de31f508fd72a8cc362bfe456e6fd1518ec4aad4363080d519efddc4d1ce177a4d459749a3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363611, "uuid": "1fa54bed-fff3-412c-a87e-fe0cd66e355e", "value": "T152E3E60167E85A0AE0BE17B9A672001107B77A92A976E79D7ECC10CD1FF3B44443EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363611, "uuid": "5c3b8fd1-3429-49c8-be80-2dcfc61fcf96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363611, "uuid": "1dcdd534-5100-4c2b-8097-40f19338b2d9", "value": "3072:ZO7Cdcg/nYzvJINu8vlhrHDFw94XAraax35J/QFO3FNGFIOvVWN:ZO7CdXnYzvJINu8vlhrHDFw94XK7XFGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363611, "uuid": "1eb83480-f8e5-4311-bb06-29bdbf4d005c", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363611, "uuid": "c2f7dc62-adee-4fb6-9392-90d51370693c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363611, "uuid": "3dbdcef9-a48b-464b-9107-5439f462bf6b", "value": "45fc53eefee0c75223d2c5f1c0a1398aab49614246830eada1b8c109584b73c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d0c964-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652379424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379424, "uuid": "d403d70a-4d4e-494b-a441-087d1dddb2c4", "comment": "Malware payload (Formbook)", "value": "3ebcdb468abe171ac696c82ece518c1b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379424, "uuid": "a65fa1e3-7022-4317-8910-328321ed08a7", "comment": "Malware payload (Formbook)", "value": "46e25f241a3fe9bf7b85356c7ae6ed18230d59054f677f445545a9667a5e4709", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379424, "uuid": "be6acbc7-a5ee-411a-a6e6-58c510f422d1", "comment": "Malware payload (Formbook)", "value": "37fe82dd3d3a65e31965f9788f06af1a49a02192", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379424, "uuid": "dae135f9-069a-4bd8-880d-bc8306d364d5", "comment": "Malware payload (Formbook)", "value": "5bc772b64ba075423975c8e3887bb0216cf6bcb4168cb890166083bcd9cb37bb9eac08ea5128bb1e65290bd3a34ae38e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379424, "uuid": "8d86f330-5cd7-41a4-ac10-a9ba96c0e706", "value": "T12A04024A71F5A94BC29897BE5009B2D50F37BCE4BDE4ED96C1243B1E97B1183B6C031A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379424, "uuid": "9dab81f0-1694-4719-9f8e-6ccabcf0e061", "value": "3072:hYj2sAmtpn7Y6AMLyjo5BwNVzyN9mrrpNUD9p9dfUnZOawmHONDzc/jLM+:7s9NrHL550Vzu9mfzgOnZJw3c//r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379424, "uuid": "c50752d9-027a-4eab-acc5-f0451303f470", "value": 187976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379424, "uuid": "9c2cba78-91d4-4294-99bf-80fca40736dc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379424, "uuid": "a39552e0-5fed-4c7c-98b8-a08d0358732d", "value": "Quote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a395efea-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652366502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366502, "uuid": "36e85b10-bb36-42c6-8784-f63ef6f8d745", "comment": "Malware payload (Formbook)", "value": "a73474cc8a3a9d91f848377808558b73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366502, "uuid": "dbf7df18-4daf-44dc-b290-518f0ef9f048", "comment": "Malware payload (Formbook)", "value": "46fb325748ec66128dc2d5aeb0341e7afa31c1b74bdbe7d6145de2e865338e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366502, "uuid": "f79ac426-9d8f-4bb1-911b-d4b33896c5c6", "comment": "Malware payload (Formbook)", "value": "11ee617c8b7fd044fd43e71a3daf4b4c64bc5f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366502, "uuid": "8b5b22c5-52af-4fec-b46f-fe51469bbebc", "comment": "Malware payload (Formbook)", "value": "105f816da917b9fc282092822b0008192cec4729b9a334f6099c01dc8b7a6eafc65a76fbf6e0a06c561271279635bd47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366502, "uuid": "7554102b-716a-4725-894a-c6299be3ddea", "value": "T19D05AF22F1D0883BC173E9B95C5F92745835BE102978D88E3BE55DBC5F38AA23A35193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366502, "uuid": "397f2fa6-2b69-4a1c-b339-58c95a5e4536", "value": "018a80c00aff107bf9538dc2e44950b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366502, "uuid": "fa6a5280-ccfd-4497-bbf1-1a8c8db887d8", "value": "12288:PDVMCvQQIQzSswvpYTT4GhvcQLGSzX9GyT8ipYdaQHOJ0qKcFxilF0uFC1Vv8E:PZpnUpyT4G9cQxxgirOgFNY0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366502, "uuid": "297ffa51-82a9-4f32-9a2a-24046ecb0ffb", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366502, "uuid": "02e964ab-c8c7-401e-b15d-c9a9aa777341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366502, "uuid": "470e5916-af2d-45d3-a89c-7b4799881e8e", "value": "P.O New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65a7dbb-d203-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652367419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367419, "uuid": "161495a4-4928-41f8-8422-d65e01e01dc2", "comment": "Malware payload (GuLoader)", "value": "90e91d605fb261fa827093074c0d7178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367419, "uuid": "594a3345-d781-49da-b4c6-315f3062fef9", "comment": "Malware payload (GuLoader)", "value": "4700f996868b461bae3a5b57efcd8719169d0c9acb400fa77d6a36787b37b0e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367419, "uuid": "382c60c4-f0bb-4e36-b66f-f4bd50c03f9c", "comment": "Malware payload (GuLoader)", "value": "1737b52ca846659954692ac55235addf749e405b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367419, "uuid": "66ce7b44-414c-4c1e-bb78-927fc2d243ee", "comment": "Malware payload (GuLoader)", "value": "e4950a2393e782982c6d207b2020b473c1a67f106766b01a5524e416e81aab6ff7d278d6c99b90e7366691edf2fb0504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367419, "uuid": "7eac325a-5045-4764-b1d7-ec6a44220d91", "value": "T1C234D01E3661C0EAF88883751B3A9B0B2A9FBC07138219573771B7785B352D3D91E9D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367419, "uuid": "328bb8ea-87f7-4c92-87fa-864fcb53442a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367419, "uuid": "136155f8-29df-4221-9718-e4f0f25703e2", "value": "6144:qbE/HUKlmkDdr0OjjCmH7FOnQkvWqYlKPwjH25:qboFJHuc7FivWqNPwj25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652367419, "uuid": "4fac755b-7cb5-4ccc-aab6-dc5cace0cebf", "value": 253128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652367419, "uuid": "5eb4d34b-48c3-498c-818f-243c8be81d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367419, "uuid": "76275b3a-0997-44a9-b3c3-bbacb89cdfdf", "value": "SecuriteInfo.com.W32.AIDetect.malware2.8516.26511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316c43b4-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330233, "uuid": "64ce8c9f-f7f1-4b8d-a5e6-067c2bb7f208", "comment": "Malware payload (Mirai)", "value": "bc7b5860c0d8d05f7301951dc785aea3", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330233, "uuid": "7120e321-d236-4a25-8be7-03fdd0483b0a", "comment": "Malware payload (Mirai)", "value": "479e29641beded9463f9cb125fcc35fe6d572e4503937f061be95661bc6ea394", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330233, "uuid": "32d0dd4f-9412-4fb1-88a2-f5393963032f", "comment": "Malware payload (Mirai)", "value": "f287ec4497e42c4dfa102cb2507634b1ca6c552b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330233, "uuid": "8939973c-7a67-4adf-b9cf-bf0596d4773e", "comment": "Malware payload (Mirai)", "value": "25e48fb432c227220be70fa9772d826dd1ce6afcacf1ea25fdfb2ee97ee5f3e4db0187406b40e82f58c73cdc7ad52742", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330233, "uuid": "2908a408-8d1a-4adc-bc1a-bc25c6befcdf", "value": "T16CB34B99F982D653C6C216B7FB2E428D3B2743ACE3DA3207DE295F21328B54E0D27155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330233, "uuid": "537dc9b7-1b8b-40de-9e21-7329d2f81e7f", "value": "1536:2IwFSWbe4x6dB/z+7l7CPhIpFb48+2AgvfGDsymtpSUde/fJOV7dU/TZ1tE99p:Lw8Wbe4m64P+JNSs/7SUE/5La1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330233, "uuid": "0c5c1d71-6149-4b51-826e-2c7cb8c98c18", "value": 114036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330233, "uuid": "b9459b3a-00ad-4479-ad10-5603b748ce96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330233, "uuid": "150b33fc-0c2a-4cfe-91ce-8e57590bf856", "value": "enemybotarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcd1e45-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379592, "uuid": "778c8668-2ec2-49ca-8c37-f4db2f35e2f7", "comment": "Malware payload", "value": "751c525e474a15e6aafdfa98f4f45899", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379592, "uuid": "59d0c789-3941-444b-929a-1cae56e01c7f", "comment": "Malware payload", "value": "49bbf45707d65e888df05b3c4b36081228fb10c60f724ed720ff8cd163aad0ed", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379592, "uuid": "a2a1b6fb-ad8c-409d-82ce-4f7dee5cba2b", "comment": "Malware payload", "value": "6e11707fa8735bda301583e66887cc4a451db4a9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379592, "uuid": "dd5edb4c-99ae-4e25-8482-862f01a9e641", "comment": "Malware payload", "value": "48c8835e123d00a27488b4ad2e3d6ede43f63048508c35baf7c07f9c5943aa4ec01593d0a46abbb64f9439afd59e04a6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379592, "uuid": "e6672c03-fee9-4b85-9ecf-cde0bee3190b", "value": "T10B533BE61E0E79F4CF1C78EE27A4D6243C2BA47BA6410181D41C49826E367DF0736DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379592, "uuid": "00bed60c-5797-453d-bfc9-580a1d437290", "value": "384:VRsA16W3aWu8OToQNtoTNyoh+rMoNTgPj+rMoNTPAPtoSQqhJoeTPu8OToQNtoTz:Y06Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379592, "uuid": "a49d00e5-4e2f-4e4b-a1ff-4c0c46b5fb11", "value": 64066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379592, "uuid": "807dd303-8cf1-4d21-a11e-a0bd2779b49e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379592, "uuid": "ec694741-9c75-4d60-8a1d-802e48d48989", "value": "Info_Releve_ID00215002501.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c066f26-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337069, "uuid": "3a17f8ab-713d-4bd6-9766-7e30a553c75d", "comment": "Malware payload (SnakeKeylogger)", "value": "83f4b14a264fbfcfeda01c4373a67e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337069, "uuid": "df315270-2fdb-4d33-817d-42dc5dfd57b9", "comment": "Malware payload (SnakeKeylogger)", "value": "49bbfd6c4ac92fb284c2f81122d999bf77904a29fbf7d97c3356dfeed1ea7b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337069, "uuid": "dd2fef11-ea38-4125-9388-030da0a34341", "comment": "Malware payload (SnakeKeylogger)", "value": "5a6ba6c04ec31b129eb90c530234fcbc8267316a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337069, "uuid": "a1bc923e-4bb7-4e0c-99b0-3dc40616d6e4", "comment": "Malware payload (SnakeKeylogger)", "value": "7d87966657d7e8f4b38fc2d617d7b056d23e83dfc87dc072566de760a3c1ab71af5039577b74334e562716e515d8a426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337069, "uuid": "23745935-159f-4c4b-9ea5-26517f0174b3", "value": "T1EEA4D04A63ECED21D23F3771AB69656082F2E0C72A32935F5445C1EA37727846FC16B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337069, "uuid": "c9afab65-bf10-48e9-a820-bdfb7077fac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337069, "uuid": "164c1a42-d89f-4ace-aa32-80fe096ed272", "value": "6144:97ETMfpi+RMivwBCC6FlQtqTgTg9NGgV7/Br04Nh+YiH4XkrijY/BEZkXo:RKkRwmjQt+TPbV7BrPPiA4OZkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337069, "uuid": "4fb7be53-2a2e-4e15-aaf0-a8571a9c3649", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337069, "uuid": "90e7519c-e7a0-4258-8e4a-c869e9988213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337069, "uuid": "4ff18bbf-849e-47b5-ae72-29ccecf84cb2", "value": "aforementioned invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607ce871-d1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652364242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364242, "uuid": "0ecd52e2-d999-4982-bcab-0b2a0e471750", "comment": "Malware payload", "value": "3602e83132121245776d3e56866a85e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364242, "uuid": "ee6187f0-6324-4e61-b7a3-421663ccbebe", "comment": "Malware payload", "value": "4a22c754b7f9f3b1ff74acf24bdb84ff6c777298b7ac4957059f8fbba5ddffd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364242, "uuid": "e4945b3b-967b-4ac0-80ae-68f1bad47984", "comment": "Malware payload", "value": "f1af6642e323743ccd6566c2c46298108bd2688b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364242, "uuid": "784196e9-eced-4fad-b3da-39da5c3aef4d", "comment": "Malware payload", "value": "b4302e568e91b799f7ef5044a697a2556a563d7c3e35291123b4c42718ad244830c7d144af70899efa45d0fd952b81fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364242, "uuid": "dce1d575-26c9-4158-a91b-92b1ebe29149", "value": "T1CB44BE5213EAAE1FF9AB2F3CE9233519C5F26F342D25BD3DC99C31A614315C84A46362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364242, "uuid": "7caa08d4-7bea-47d2-a63c-b2bdd0c9f5d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364242, "uuid": "1c05df8d-ec12-4dbf-a01d-3db778888dc8", "value": "6144:8MZGK/cALHzDLqiRTON/vY47++t1MC4R/utYa99S2UH8:D/LH3LqiR+X7vdEW6a99E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652364242, "uuid": "40844f81-ebc3-463d-87c1-232d4b22bfc8", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652364242, "uuid": "1428dbcd-704f-4145-b02b-2f1bf956da2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364242, "uuid": "ec80b8bd-9825-4077-a5d4-b2cb0b29842e", "value": "4a22c754b7f9f3b1ff74acf24bdb84ff6c777298b7ac4957059f8fbba5ddffd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c625da-d1dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652350366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350366, "uuid": "0dffd99e-db48-468c-afae-599b4e5368b7", "comment": "Malware payload (ArkeiStealer)", "value": "3537f56d4971205e9987782b5d3b3504", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350366, "uuid": "dd352364-669c-4fc4-af9c-00b1c32ad708", "comment": "Malware payload (ArkeiStealer)", "value": "4acab2cb128ba9c8a9f91d1f677ec1b6770b265b9d04e9efe3bf979a2327ce1a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350366, "uuid": "c49511fd-f797-4f8f-a53b-c39a676f907c", "comment": "Malware payload (ArkeiStealer)", "value": "ea61b392af3f4699a1594dda403dbf675df8468e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350366, "uuid": "653467ef-0b6b-49ad-87cb-8f4061cd3c80", "comment": "Malware payload (ArkeiStealer)", "value": "91839a6e99c34252021a2a22fdc2376396c64a8961b740852fe77eeed5ec23111e8cc4b2ba7fb759ea344e64f94bdf8d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350366, "uuid": "dca0fdbf-4f7e-4c3a-a25e-154abf3e4289", "value": "T1A3652325ACC084A3D2756F7BA916C9211336BDF25CF84F470A49394B1E1F1A3885FAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350366, "uuid": "285a7178-46df-40c3-986c-e51e33f8d6de", "value": "e069db3169b10d2de1ab388f0782438a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350366, "uuid": "1b289f78-c05b-4056-8c82-1938fbefb1f0", "value": "24576:YqEI1nC67rQgzh0dmAn7na4G5ImVK2Nczo+Uh2IGXYX/npnlNj+LIvCn2ILla/bT:YgdhAgtwmAnU5jV7czoHEU/npnl0b2Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350366, "uuid": "e26f7202-20eb-4912-886f-3df48fdc612d", "value": 1537056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350366, "uuid": "7f097a89-1764-4691-b532-660f40d3bd9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350366, "uuid": "1ab9f1a9-9c29-4bd2-9938-dfd0b0c6d298", "value": "SecuriteInfo.com.Variant.Jaik.72893.16950.31145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7d2a80-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652355675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355675, "uuid": "7e7c63f2-4451-44cd-9a84-198fd5c6a66f", "comment": "Malware payload (Mirai)", "value": "44a8692a9135f71b9074a569ee1a1934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355675, "uuid": "9ee986d6-c4ab-4f93-b238-291c390fa818", "comment": "Malware payload (Mirai)", "value": "4b85520ac025803628e8b3eb64490a7917c780c772d881f289cce601de970921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355675, "uuid": "1d901764-35c5-40cd-88ee-fe96d7954130", "comment": "Malware payload (Mirai)", "value": "cc2196575d1a71eb982366a7bdfde15f5c80a3cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355675, "uuid": "ba8cbe95-7acf-45f1-bb17-d3dfa04b1ca6", "comment": "Malware payload (Mirai)", "value": "d7fa9e0b4f526329d9194013b11e846e88e141c4d4f3eec5a9587f6c94e1c5151357a6437f758cf284aae007f71050bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355675, "uuid": "06dd9f69-f4e3-494e-b13e-3f84e29eaa70", "value": "T133833997F800DCBDF809D73744634906B230A3A24E921A72B7277D2BFD721A55927EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355675, "uuid": "eef587e0-6223-4e9f-92a9-0b5c686f5a03", "value": "1536:BpPOJrybnlU72bP3EbHo8TCak8t/SOayBkW1guEdPXVJ9KlzJ3p3:BBOknm7APaTvPSOayBkWiu8QzJ3p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355675, "uuid": "dac5b833-1a65-4a88-9bae-cc42dd09f0ce", "value": 88360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355675, "uuid": "23bf3174-55df-4a5f-9e5f-b7a57c74546d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355675, "uuid": "f3f711d5-0162-4c31-b8c3-279f52d1892c", "value": "44a8692a9135f71b9074a569ee1a1934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b3d915-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379397, "uuid": "de504d22-2e2e-40b2-841c-fd569070c837", "comment": "Malware payload", "value": "61b289597cd0ad8aca18a9b08e208b65", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379397, "uuid": "28e5f1d7-a38e-4ff4-aad7-bf1eb01a61f5", "comment": "Malware payload", "value": "4be4e0353a70ce8f850447f623360eeac83fd62eacbc0bd31825db9405ea42a2", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379397, "uuid": "5f7472a6-813f-4ff9-b41d-b3119f2f434c", "comment": "Malware payload", "value": "8256b2c114b01b33a04c8c18c0cf7325e97d597d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379397, "uuid": "c3a34284-06df-4000-8ce9-3bd081a59933", "comment": "Malware payload", "value": "91d210961854be62b0c3f2751afc8a7b6387ae7e38ded16045b442df19805af1954e2172b93833385bfc4ade131f5a1b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379397, "uuid": "c2b23aa5-2c6b-404d-8cca-80f212c173b2", "value": "T12504013460DA8723F592C27477925BE3840BDCBB1B04D92F44DEBABE38706D3522746A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379397, "uuid": "95481987-a815-4755-a747-360af3aaf634", "value": "3072:fz+5FzUvh1zfXVz/AMCsQWTYXCXtB7gSc6QFAYtU3WuqSWh/lFkDv4ZIpSR+0dJL:iwPzNAMCZO7M6QWYtUUSS/lyDQnw0pOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379397, "uuid": "0a375a3a-4719-4569-aab5-45aa0d1b18c4", "value": 187944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379397, "uuid": "0f230ef9-6729-4651-9739-ba8b84ff3e0d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379397, "uuid": "d3e1acac-ca10-43d0-93b6-fe0d09505c7f", "value": "Product_List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c50571-d1f8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652362363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362363, "uuid": "922a2777-6c94-467b-a116-59d6ba1b6c70", "comment": "Malware payload (Mirai)", "value": "846562d524df52d9d58efdc3d511fd03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362363, "uuid": "be4bfe9a-1b69-44d4-85d9-19453731cbe4", "comment": "Malware payload (Mirai)", "value": "4d13f3bc4a92c48d001716c0784e83590b3635f2774c981c2f0f51680b15512c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362363, "uuid": "153b6aaa-2859-4439-8d33-cbc8463a3b69", "comment": "Malware payload (Mirai)", "value": "65e35c51eb319776c40275e8c8d990ff67d7ff1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362363, "uuid": "cdb65327-e3cd-4ebb-910d-18694c359b34", "comment": "Malware payload (Mirai)", "value": "8e53e834ffcf92c54ce9eb0c10d3af63945050fd92780a05988511d010ccfddec989327bf32298f00f3f1936c4f18040", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362363, "uuid": "df085134-8c8e-45c5-af76-433ffa9d75e5", "value": "T12CA3840E2E619F7DFFAC823887B79B219249339A36E1C585D15CEA011E7034E741FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362363, "uuid": "e769fe74-9d69-4f06-8b1d-6f6a408c3c4a", "value": "3072:XDIkiGgcsQoeJP0r01ed6WP0qNuCd4aqP9:iU2Rd6WP0qNuCuvP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362363, "uuid": "d60be7a5-58da-42df-98b3-02571171ebae", "value": 100332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362363, "uuid": "7f4b8d18-4068-48b6-a7e5-26a484e9871d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362363, "uuid": "a4ebe8b6-65ce-4499-94d9-55b5243edcf4", "value": "846562d524df52d9d58efdc3d511fd03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ba37b2-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652346561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346561, "uuid": "68ae498b-3d04-45a0-a772-64821f400a18", "comment": "Malware payload (Formbook)", "value": "73f4f5fe07b5958e1760dea625c35a35", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346561, "uuid": "8106d559-3010-4634-ae81-c5270250487b", "comment": "Malware payload (Formbook)", "value": "4dc726a87c498212bae7154e2971a835684e8bea13316cf72ec486a6c8803cc2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346561, "uuid": "5e6b9913-e2d2-4eec-a6a9-95e963da548f", "comment": "Malware payload (Formbook)", "value": "1de2d527643059b07a078a5ca66d6be7fd8ac7ce", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346561, "uuid": "e64a144f-c345-4d7c-a64b-b04519cc5e5c", "comment": "Malware payload (Formbook)", "value": "061595dcefb9992b6ef6c50e26514f477283a9434e15f71c9201a9291e29e96242bc3ec88c7b111713a43c6748049732", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346561, "uuid": "6c7f2528-944e-4782-8f3a-078a1b700822", "value": "T1E404122E25C84980DDEB7971174B8D067168FCB9C7E5029E817DBE0831B7DB943265EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346561, "uuid": "0c390845-c6f1-4048-b85b-e4ded993d246", "value": "3072:VCiDTjoMjaNMfnQEnDD2XDmjTGVTyKACRyUrhBl8PV/oDENeOh:v1jaEQK34mHCRdTl8b7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346561, "uuid": "134d8dc7-1a5d-4930-b9bd-243d18322366", "value": 188216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346561, "uuid": "5971b566-4c21-468d-89de-3d0f64f90ab2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346561, "uuid": "308da836-d211-434a-8a96-355975584574", "value": "Energe 1,010.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3a3aae-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338141, "uuid": "8d87116a-e073-4f2a-a9c0-40ec574580ca", "comment": "Malware payload", "value": "efd7a9b258d880d92afa3304b507ad11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338141, "uuid": "d9895a4b-ebb7-44eb-a722-92f6d7893db4", "comment": "Malware payload", "value": "4e63cc7d70a145455ba4e476df13d940932fadcdec3d704bc4f6d44d18b976a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338141, "uuid": "6fb05c83-7c4d-47fd-a3df-7ffe8bcaad4c", "comment": "Malware payload", "value": "7681f6877e4dc96d011a41a4c61dc28882a6898a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338141, "uuid": "89ec6646-b315-4aed-b818-ab1d209b0fdd", "comment": "Malware payload", "value": "5e5657ec99cba44b2bbcdaf02c1bae2484ec92741da1d110beac21a9d894a45c2afeac402120c878e0858147325d212c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338141, "uuid": "56666dfd-7ce1-4ff1-873e-1d5c27b2e59f", "value": "T1C40602AD2268735CC01EC0389037FD44B2B5661E0AE8D979B1DBFEC0377A855DA82B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338141, "uuid": "85a43263-6d27-4bdc-b64b-c303e2d15b1f", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338141, "uuid": "935a116c-4b29-4c9f-af9b-ec79bc4299bc", "value": "98304:PDUuQv4Vl6JIx0GluYktyz3pjGjMcZ1TCVBn:PIgV4K+2uHMGdCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338141, "uuid": "63e13466-24e3-4c98-821d-22acb6de6024", "value": 3682304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338141, "uuid": "00801937-9c7f-4cf2-a4ba-5675af8036b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338141, "uuid": "00a3ea54-e17d-4650-8bbd-8d5451465115", "value": "efd7a9b258d880d92afa3304b507ad11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ade72a-d1ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652342611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342611, "uuid": "a73d3068-854b-4c2e-ae4a-64f1555ac248", "comment": "Malware payload (Mirai)", "value": "187c21c9a823d9fb1d2db01e44f38fe4", "object_relation": "md5", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342611, "uuid": "f62989fe-33a0-4eb2-9299-1056db572d1d", "comment": "Malware payload (Mirai)", "value": "4e7e1ad3d23f02d6b6376c9465d2c79bf47958df7416759fca13fd71c667dfec", "object_relation": "sha256", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342611, "uuid": "a8535a37-6f82-47d0-9064-06ecaf3f2006", "comment": "Malware payload (Mirai)", "value": "c372d32f44a4b77fa1b8f11650e8d38e09b3cb0e", "object_relation": "sha1", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342611, "uuid": "653b7703-0706-494d-a3ca-9fc2597b0f73", "comment": "Malware payload (Mirai)", "value": "95e26575b80d37d531c06942783063c9380657e8ea9a7cd22d7e6908bcda911381c4c495941dd621430d026c668b899f", "object_relation": "sha3-384", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342611, "uuid": "1d8b90ca-74b0-40e0-ac6f-69a9caacd7fc", "value": "T12F23F896B9C29F15C5D0127FFE0E118D331367ACE3DF72129E256A2037CA56B0A7B846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342611, "uuid": "9c633784-34ca-41c3-bdaf-6da2b1986e8e", "value": "768:86EnvWy4zica5RbswGbXrQzmVm5JQZYxUUdfumpuSSIgLZiY9uxSzU+JgV4Jt:8hnedir/wnXUzmolxU8POIMiY9WSzUGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342611, "uuid": "ca8174be-9a2b-4171-b5c9-300658126af6", "value": 47268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342611, "uuid": "3957cf36-6cc4-4a17-a13e-59f78386479e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342611, "uuid": "5a2df68a-bae1-4be1-9980-0ac671888497", "value": "4e7e1ad3d23f02d6b6376c9465d2c79bf47958df7416759fca13fd71c667dfec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fab923-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330244, "uuid": "58e14b8b-8383-4aed-a17f-655c18fe6c57", "comment": "Malware payload (Mirai)", "value": "c66bf1471472e2be693cd2ecbe7a7a21", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330244, "uuid": "bb6bc1f4-d0e0-4783-b931-f645235f48eb", "comment": "Malware payload (Mirai)", "value": "4f18e25803b72fac2a58f621d5d8024b9a717b728432d9f4edccd43c78d0d27d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330244, "uuid": "9a1452b6-008e-415a-b7a2-fcd3acb3d55d", "comment": "Malware payload (Mirai)", "value": "28ecc9b0cdc5321bb8c9945227ad170229956cfa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330244, "uuid": "d141b0e9-82b2-4d87-ad3f-ca658fd8587a", "comment": "Malware payload (Mirai)", "value": "4f2e2c1da96d4bfc3ef43565ac92a233a44f2352419db27961f27746bc6f78b268d9579a0d88a98f7e5a8aaec24a2cbd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330244, "uuid": "5656c660-9c04-44da-96d6-f8ed10cad52a", "value": "T1A3B33BD2F500DDBEFC1AE73B84474A097131E2A51F821E36A21B3467AD761D86927FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330244, "uuid": "834a94ca-38e2-4b58-8320-5b1c86b46126", "value": "1536:Wlzd2ZcQ2Gh8W0mtKqWYrYDR3xrsrAel8lQ5yE0ClkGrxicUg+fNj7IFROkUEpU0:WX2oCZvtKCYD99srAe9yE0CEc3+F/n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330244, "uuid": "cb6f7446-e82c-44ab-bcff-9a49b5883e04", "value": 115840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330244, "uuid": "3a4d20e3-22e5-4be5-a3ad-a966f1aab025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330244, "uuid": "24318f8e-9c69-4d90-88ec-8418fc162335", "value": "enemybotm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a21ca1-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652345750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345750, "uuid": "11092c60-4c4a-4459-8348-290432934b1c", "comment": "Malware payload (Heodo)", "value": "22fda7945296c831ac5646666f6f31fc", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345750, "uuid": "1b201709-7a2d-4e05-b86b-e8ee02f1f040", "comment": "Malware payload (Heodo)", "value": "504805eda73424bafe0f54dc1e415f122eca0507c2a47406dcae5ce206c2b026", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345750, "uuid": "73b6664f-5990-4d1b-9c83-915661a10554", "comment": "Malware payload (Heodo)", "value": "0256433c9bf936382d3624178849d0ed99aa6831", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345750, "uuid": "d7c27264-d3ac-4105-a6ec-9833f29d999e", "comment": "Malware payload (Heodo)", "value": "07d3b26823f923a4ae14df881d0adc3ea7c2b03f14c17843f4f630e1cb297ca357f52a2f11886261d34e0c153b543577", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345750, "uuid": "8758385e-3bbf-4910-b9ec-0529f1cf893b", "value": "T11A518D2C2DEE2115E5F3DF717DE87AD5DEAABA777811494E00C1030A4912A40FD91D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345750, "uuid": "88a4c3bc-5f4e-411a-af3d-e440ef6c72e1", "value": "48:8mrHVGzXjeUuISQDl/KNVh5kWAljH2X9eL5MM4ab:8mTGa6Sqwh5SH2X9yMM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345750, "uuid": "b652d405-cf8c-492a-bb69-333f3badccc4", "value": 2714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345750, "uuid": "a45a3884-06af-4fde-9e32-0d15e3f3155e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345750, "uuid": "e345ec17-ad03-4f29-b717-dd1e2da3cc3c", "value": "2022IS00008768 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecbbf26-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652366252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366252, "uuid": "04b49cb7-aff2-4838-9a4d-fff152c51b4e", "comment": "Malware payload (Mirai)", "value": "f72152c6291ec917c3a0c4f4262df10f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366252, "uuid": "2df95fba-a189-4940-a6f7-02b5fd36111a", "comment": "Malware payload (Mirai)", "value": "507b7e737808910a81ed3e3a43b2802696728ec6a18749ebefdfd350a3200f99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366252, "uuid": "0f592e19-9eae-4662-a834-2ab843ccc8b6", "comment": "Malware payload (Mirai)", "value": "12a586c22f99edeefb22350e76478b12d7554c8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366252, "uuid": "3d417ef7-9238-4481-87e2-124554bb837b", "comment": "Malware payload (Mirai)", "value": "490c898ddbaf3ebd0a02db7df276720a09fb6b2c89cde191cf3e4d494c35fa0190df532309c8ae9e083a88e76353b587", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366252, "uuid": "5336adc5-15a6-483c-bb26-59ad638a1272", "value": "T194835C34A97D2F26C1C4B13E22FB8351B2E1260E26B4965D7DB60F4FFF2464068476B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366252, "uuid": "bd9a7385-97c2-4c63-a840-c02c532bd6dd", "value": "1536:jA0CGS0VIpYhFQPFKIFRcuBfefcwSZwKAmy6vnxXchmPBgk+uF85:MvXW+jWfcNA+vnJchmS5L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366252, "uuid": "000963dc-d186-4a70-ad4e-43149fc31a81", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366252, "uuid": "df7eef5b-c2a5-4e3c-adf0-97fb79f92635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366252, "uuid": "999ab9fd-f9dd-4d01-989a-05d9a99c51ef", "value": "f72152c6291ec917c3a0c4f4262df10f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b7aa11-d1ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652342796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342796, "uuid": "980bef1d-b457-45b5-9b79-8f78b82eb339", "comment": "Malware payload (Formbook)", "value": "47811f527386f1024081701f3812deb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342796, "uuid": "0e7805d5-d211-4956-8fa0-579b0ecca0f4", "comment": "Malware payload (Formbook)", "value": "508cb22224be3ffe5f189767b150490b717fdfbbdea4ea41c3a1add4ecfe7730", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342796, "uuid": "c041d8df-8618-4d2c-b8d8-2a61faad4198", "comment": "Malware payload (Formbook)", "value": "16934d7dbc4ad5f583f3721e180c0669a57c5c84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342796, "uuid": "e6361747-be20-4c82-908e-6f6690227384", "comment": "Malware payload (Formbook)", "value": "c1a384bbb630c9ed621bd3f0c364467d1d02962f60da20fcfbfa0f26d03af4de7428143d4a879f5316ad6c5e936f16fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342796, "uuid": "7fafeb13-df78-4633-a68b-3c63bf392450", "value": "T14CB422141255536BD9BD4BB4ED2285CC7BB5AF2A8D32DF2F5CE530ED08B4B88025236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342796, "uuid": "a214a191-0ab3-41f1-aa85-d13c773967f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342796, "uuid": "107d0734-b015-41da-8ffd-7e68fe460821", "value": "12288:iJmoQFYZ5LDGxEPLLQlLgAMcke6IfePu70se:igoiYfaILQMAMPeffePuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342796, "uuid": "df9d7dab-89d5-4f9f-91b4-a368adfd991e", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342796, "uuid": "0175ed1c-52bf-4aad-958a-b9b04a995d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342796, "uuid": "4c06ff92-9d38-4323-86a2-49853eaa3677", "value": "47811f527386f1024081701f3812deb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab71559a-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652379400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379400, "uuid": "104aef89-3d0e-4374-8a7f-a17943110c1a", "comment": "Malware payload (AgentTesla)", "value": "2ad7af031dd56d2169938951e6c4f897", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379400, "uuid": "af46ad1e-deb1-4256-bde7-cf39d43bc602", "comment": "Malware payload (AgentTesla)", "value": "50dadc60ec3c71fe9a5ee5b5868418924b91fa1f38dc3d51ef58cddb28bed43b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379400, "uuid": "2333e88c-77dd-40b2-8b3c-1e0383c03fe4", "comment": "Malware payload (AgentTesla)", "value": "5788e86b1fc0ac284f8081729cc2d24456dfa31c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379400, "uuid": "58262bd2-9d71-4535-8a50-e44a86aff1d6", "comment": "Malware payload (AgentTesla)", "value": "3732489886aff74a3bb6a73afa046cfec20c823c1e3a85d6ec0aa14e63899890a5cb6db0465fe08b4514f469dadbc9ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379400, "uuid": "721c936f-917f-4cfc-8138-3e2da4525f8f", "value": "T1AD0412A73A439A44D2C23DFCDD155B4F7849FCAC80056A113DCE70A909B435FBA9994B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379400, "uuid": "a3f3bce1-de2f-49a3-ab3c-4a24e2445607", "value": "3072:VLjtAwPTHZDZWJSVI+yZXNGdt5OqRfHbGaLJR/CDCRaxcxH9R8T7fKWX:1jtAwPFYn+yudt5OyfHbPmDC4s9STzK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379400, "uuid": "8faebbcf-5b66-4dd6-af8e-8d536fca8b14", "value": 188184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379400, "uuid": "082b0b1f-6031-4c54-835e-457e8a20f9be", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379400, "uuid": "a9a9efc2-d1ef-41a5-9bf1-bec58a13607e", "value": "Bank Slip.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23da3d9a-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337082, "uuid": "99d741cf-e0db-4313-8636-0bf9f590ba09", "comment": "Malware payload (SnakeKeylogger)", "value": "079b048f1c07ee45d0f17cae972b6caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337082, "uuid": "697d7a0c-20bf-4654-af0c-fd5183d6201e", "comment": "Malware payload (SnakeKeylogger)", "value": "5101d5b57c9d963bea6076e50811b465f96cbe2daaad0d2e38d92ba3946c8245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337082, "uuid": "a22f2803-7828-4616-8f7c-73673f36aa3d", "comment": "Malware payload (SnakeKeylogger)", "value": "df1e098105efff057ee2795e740e6bdb0a3a22c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337082, "uuid": "522e517d-8cf0-4107-b8d5-df54d75fa126", "comment": "Malware payload (SnakeKeylogger)", "value": "beeca99a994f7750179aac2afc30fac5bbd0feb88eaa70ef85c2f0f58aabaa2cc80e900b6fe48d07b8967193f3fa9078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337082, "uuid": "5540e21b-ec1e-4d20-b8b2-beee8b104744", "value": "T112652A4C7B09C686EC40C772EDB62B6223A3CBBD9C424707A7953639F47B7AE15502C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337082, "uuid": "5a069dc7-15eb-4fb7-87a5-fa2158125158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337082, "uuid": "8b55bd98-c86a-4b07-91fb-a25cf1d6fdc4", "value": "24576:xj5J5ILsGZWQT9ZySW47lnAYbp4fJSpy:55DQV2Sbp4fJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337082, "uuid": "06db47a2-4cdf-40ef-887f-1fc285b1dee4", "value": 1442304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337082, "uuid": "c6ca6ddd-eecf-4ec9-a260-180af36af98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337082, "uuid": "489a6787-d2ba-4a6e-8607-8263738e6dd0", "value": "swiftt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033a9957-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338745, "uuid": "dc82bd8f-1beb-4d8f-9df2-a21beccf0278", "comment": "Malware payload", "value": "1c412deeeea71fcca48a22cbe110b611", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338745, "uuid": "942af0ec-9e32-4b2c-8f47-1d00096f0e8d", "comment": "Malware payload", "value": "51091d0bd503f9f0bae0979de7bd8d7aad4c9b46671b035c7ef3b1b74917af34", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338745, "uuid": "98c5abc4-5075-4a66-aa3c-a11803f4b676", "comment": "Malware payload", "value": "fd7c36d2845ba830b67741a98a5a66d81d8aed6a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338745, "uuid": "a0f2fc54-4419-4a82-96a7-02c99df36da4", "comment": "Malware payload", "value": "9d8ea392dc07b0f6f10e74359ff71e820b4a56895d3efa1d821eae5a679330b07d60f921ed6f77f1ca227303e009009e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338745, "uuid": "503905c3-4da4-4a55-aaa0-899b84249edf", "value": "T11E04121BBA5150E3E9CB0BF31FCB4B6819EACF08CA158C25C5DFB39A0678945D362514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338745, "uuid": "1e810b44-8d75-47e7-9615-9675777bbf41", "value": "3072:favsfYjYdIozZ1Hevd/6GvVBp50UIDFstApuLiMptrMV8YXdGJn/l0YDb2mcv:KNd2Z1ed/6GvVBwDFBp0iMpZ48mol0yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338745, "uuid": "c0079dec-4f1a-465f-b420-fe03c5645cef", "value": 188072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338745, "uuid": "00d8d68d-daed-47fc-80b4-482d69398721", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338745, "uuid": "05e1045e-7d35-4f40-9508-64f71a0f9928", "value": "7643242-20221105.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb9f384-d23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652392475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652392475, "uuid": "cb418fb0-7b79-4f07-ac36-7819398c908c", "comment": "Malware payload (Heodo)", "value": "748a599bb4f7a3450c4afd0dbe5c2731", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652392475, "uuid": "7470c3d8-6fbc-477c-b975-ca0a54ef47a1", "comment": "Malware payload (Heodo)", "value": "513b91cf7a67cef4262f782d0a8687d4dc2de517fe9b987ab4c9034fa7075c6e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652392475, "uuid": "6f17d4b3-07b1-421b-9aa0-e6d40be8565f", "comment": "Malware payload (Heodo)", "value": "9cde331583031c8ceca71416de146d1961d2d476", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652392475, "uuid": "ec31829f-6fe4-4bd5-8cf3-d43f37fc372a", "comment": "Malware payload (Heodo)", "value": "3a82070fa29634167b8c3ad42824a782c0eee6d947d398ac71313823f9989b34002bc93673a1465f9abdf932b3336714", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652392475, "uuid": "ea2de53c-d8fd-491a-8e05-4964b9669bce", "value": "T17BE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652392475, "uuid": "c6b5f5d2-8afd-4553-9d6e-df3e1651e626", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652392475, "uuid": "fca3db9b-de99-483a-8ba7-c5f52d355fbb", "value": "6144:mkajLyaPIvW1TFpvzYNB1M3B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8s6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652392475, "uuid": "02d15ef2-5d24-4728-9d03-df473403fbf6", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652392475, "uuid": "766157d4-e675-40d1-8fa9-d982d5f98eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652392475, "uuid": "cbf43508-237c-4dc9-88e4-1df55611bf6f", "value": "748a599bb4f7a3450c4afd0dbe5c2731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25187b30-d18c-11ec-8e58-42010a9c0032", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1652316038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316038, "uuid": "46e6830f-572f-4e58-957e-775907316473", "comment": "Malware payload (ParallaxRAT)", "value": "3fd3937bfe06d1fe40144907d8fe1463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRASS RAIN s.r.o.", "colour": "#E07EB8", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316038, "uuid": "7462769e-ae1e-4c0d-9443-fc6389dcec14", "comment": "Malware payload (ParallaxRAT)", "value": "517af63bf54611b1ae3707b905aa9263c3e139dc576acc53ee1cf34e75c3ac7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRASS RAIN s.r.o.", "colour": "#E07EB8", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316038, "uuid": "ea75f663-4277-4b5e-bc2e-10827f4b930a", "comment": "Malware payload (ParallaxRAT)", "value": "1d6617ffc465f67674bcdab3bce4440abce5d7f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRASS RAIN s.r.o.", "colour": "#E07EB8", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316038, "uuid": "601a65f3-dbd6-4113-87c0-0017c924bf10", "comment": "Malware payload (ParallaxRAT)", "value": "2109d2eb083622e53b1d96702eebf3e733f7ecef34f68788d82450253305880f69904c91a4122132d9fe03c0536a2853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRASS RAIN s.r.o.", "colour": "#E07EB8", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316038, "uuid": "4752bd73-c0cd-42b6-b701-95908d248755", "value": "T17046AF2373F58060F5F32B306E366674997BBE71A934C6BE4790190E2A71E50E935B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316038, "uuid": "5ff77607-e6aa-4cda-b681-8350ffd3a73c", "value": "64e6a9ff9e7228c21348997eb96a2b62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316038, "uuid": "8b0d11e3-339f-4a82-8bfa-ec47726764e0", "value": "49152:sIjzyjnpUhMhukQNosSICGr8CLBb4D5k425Fr5SclXzbX:sIjzyjnpUMONosSxGrhN894OwjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316038, "uuid": "4807f1d1-eedf-402b-a2da-68f5e063c8a2", "value": 5728648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316038, "uuid": "435d5933-6f02-42a5-a2cf-f886a1da4b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316038, "uuid": "84ad2988-15be-4064-a177-5f16dd11b0ce", "value": "pulsed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442f6dc6-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652334559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334559, "uuid": "a4e1de10-0dfc-4b73-bb50-6c07a2e8c60d", "comment": "Malware payload (Loki)", "value": "4787954bd0dd2654134b04309a0503fc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334559, "uuid": "31183ebb-0630-4d3d-9ed7-a9838d81eb3c", "comment": "Malware payload (Loki)", "value": "518936b9c2caa9bdf35829903c0dcb7e033c9b82c2a772b096908674f4e9c7b7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334559, "uuid": "c8d8c5ea-9a35-4c2e-b41f-d987f6eebd23", "comment": "Malware payload (Loki)", "value": "837ea70b966dad08ff1634c1ea90cce2bb2087b8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334559, "uuid": "5024b175-4964-424d-b51c-55e841e4d4c8", "comment": "Malware payload (Loki)", "value": "3edcd30869e3542597f594370a455a9a8c35cc92f04f49bb896202c76bdd01af7a7691d0f34f22946ce9115db87be7fa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334559, "uuid": "3f329d03-6ceb-4556-b134-761c49af5392", "value": "T15EF433CB69B3086EABA2AB71D4075DB1D1FE705D91C58E8F5120FA38542B89DFF84903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334559, "uuid": "36763cff-e2c0-4ee9-b0d3-602b748107d9", "value": "12288:jVhm21lTkUkTWkr0BoGvfRt1HKQ3t74dmdxHXYSHHHDtJ6k2/mPtN80s6xaWB9:jjX1llw5Gxlt7JrYEJt2ePtps+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334559, "uuid": "f01ae7fd-293f-4554-a550-918d331947e3", "value": 766341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334559, "uuid": "4f3afc17-9610-4909-a186-a922c667620c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334559, "uuid": "9196ba55-641a-49b5-b595-98befbc05be1", "value": "quotations 37891984.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4acbd2d-d205-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652368302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368302, "uuid": "80a5cc97-9594-4792-b89d-6b95ae988011", "comment": "Malware payload (Formbook)", "value": "1e9fe4285b42d387c2125fdc8346edb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368302, "uuid": "ba4e228c-16c9-4df2-a3b6-59c9eea6a533", "comment": "Malware payload (Formbook)", "value": "52366658a3a7471aa7d7622b690c208c19e1e05af19a914977dc8e6294bfe19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368302, "uuid": "e9e349db-0a3c-4159-948b-a055b156df11", "comment": "Malware payload (Formbook)", "value": "75b18913fa096559bc8bdbcb0c4ebc58ac61b470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368302, "uuid": "23efd504-849e-4fef-9979-3a89952acfac", "comment": "Malware payload (Formbook)", "value": "1aa0954bea0a7c60bb4ff52b4cdfb7d21d7636bc82b5a7e7bd9f0ec4b31166a70e849c77cbd69d0eac766be326128efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368302, "uuid": "b05cb7a5-cac6-4978-8e80-e5a46411e8a0", "value": "T18E54124173A3D097FFF012729D3B2719ACBEA97210100A1603A4B9BB7F7B181DA9F555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368302, "uuid": "cd18ad5c-d5f9-44d6-8acf-3b6022041c7c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368302, "uuid": "e2dff60a-da55-4d69-a09d-036bc9831490", "value": "6144:LOtIOrQ/X513JBkVYOHs0k8os02zDhp7zwpE/Whui4l1R:LOLkbJBkPeSv/0CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652368302, "uuid": "ac68698c-b5cf-499a-98bb-b9eccbec43db", "value": 305390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652368302, "uuid": "9342985e-ca66-4114-bc3a-369614e7de80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368302, "uuid": "662454df-f280-4ea0-b4e9-6630637d76e2", "value": "tooo890765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b877b972-d1e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652354940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354940, "uuid": "3712f948-fd4f-4fec-b286-1e3a30042fc0", "comment": "Malware payload (Heodo)", "value": "cdde7d576c0298cbc2c16ca24ea31aa8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354940, "uuid": "5de006d9-d22a-4a21-bcd2-a6189ef225b8", "comment": "Malware payload (Heodo)", "value": "52c6b237ebea20dd8639bd75f57e1518f33c4d31245c91aac4ad0d0a41456d13", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354940, "uuid": "98e4e725-76c9-4249-a5e4-cf974a5a3eba", "comment": "Malware payload (Heodo)", "value": "b47a4f61b0c056228a9959c39fe644d636e59646", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354940, "uuid": "40f8f9a1-8efc-40b1-9551-fafe6fa3c348", "comment": "Malware payload (Heodo)", "value": "49f4a22564b9c747ae0518caf400f92aa48991785ae26b0cc6c204273ad2a2618b56f90bba136e23932308ab27a5ff3a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354940, "uuid": "9c031f59-c105-4ca3-891c-fba4a889f00a", "value": "T1E1F47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354940, "uuid": "c2bbda9c-456d-44f9-bb3f-b8501f0b2d4c", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354940, "uuid": "15e2ca39-280a-4180-b3b1-6b8ccea5a20e", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSpjNwgraKRT61cKGNx:S4DzZKnH4gRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652354940, "uuid": "9adbca86-3959-43d9-95fe-0b1d4d554bb6", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652354940, "uuid": "403dc78f-2c9e-4e1b-a331-d00efe00d62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354940, "uuid": "b12ec832-0325-4ccf-92d0-ff21a19afb3f", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c03790-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652334610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334610, "uuid": "be0cedee-83a7-4929-b540-5dbfca9f15fc", "comment": "Malware payload (AgentTesla)", "value": "23d67523a2ff6805d1c27dfebfa37139", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334610, "uuid": "f7631959-781c-4005-8972-0d88c8fe3b0b", "comment": "Malware payload (AgentTesla)", "value": "52eb035aa258d9f70a7c6ee1a0b9f2924813641eaa9082c7ce4b842f7a79186b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334610, "uuid": "0bed2219-2778-4d10-a0fb-a4ce35ea60f2", "comment": "Malware payload (AgentTesla)", "value": "2124a75ef3428f0b822d0b24ed5954ecc18c9947", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334610, "uuid": "5fde20d7-6872-432b-87f0-040d7f9b0e78", "comment": "Malware payload (AgentTesla)", "value": "5920b8b0cf47ebeeceeb57674835986c34ae52af2a9104105669e3fd71d82a635338456f466302f219aa23248076279e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334610, "uuid": "55d026b3-d787-491a-b284-45654682f81b", "value": "T1A2C412152299B372D0E98BF0CEA184DDA3F4BE5AAC22D3278C9570DE55B3B68845350F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334610, "uuid": "a4af01e9-00d9-44e3-8cce-9062ea1c1999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334610, "uuid": "0b3e9a1b-529a-4a26-bf1a-c11f5514a698", "value": "12288:mffx/vBdTP68l7gNce4Dbxjv6NGs3ao5oip/OByozcj2cAMZMWe:mB/J165NcesVbxsK/i1OeacA2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334610, "uuid": "3ea1c498-09a9-46ee-8aa8-23e2a613f55c", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334610, "uuid": "19c4cfb1-9323-456e-9016-5f5896a9c2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334610, "uuid": "ac8deb69-451b-4107-ba21-12c7879ca0d0", "value": "DHL-AWB 6878628680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a669ad-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652338486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338486, "uuid": "0f222de4-4c5d-4468-bb06-804c01f4f1b7", "comment": "Malware payload (RemcosRAT)", "value": "f1035d3fc2edee1b068a0f95193b1dee", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338486, "uuid": "0762919b-89ff-42cb-a03b-ca1ba9671588", "comment": "Malware payload (RemcosRAT)", "value": "52ec06afb5c0aa5e28828f49ad02748990513b8370c33685a1de2a03ec840207", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338486, "uuid": "41315f8b-cdb6-4533-877e-f6a9a8b7081e", "comment": "Malware payload (RemcosRAT)", "value": "50e45c6aadc6add4ab3e15b802ca6ebe5a0d6784", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338486, "uuid": "46f4cb2c-6943-4d02-a1bb-8acee307fced", "comment": "Malware payload (RemcosRAT)", "value": "b8d04b4b1bc7e775ba54e81081c2ea7e2ae6346e06dd00ffd45699d49319e2d6d8efcff5244183e8a505374a21b0f8c3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338486, "uuid": "a95297f9-c3ad-4509-982c-829d48f25402", "value": "T1201362A2B396D80AD99507364CE7C7E63726FC516F53C34B3289F71E1F72AC08A02656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338486, "uuid": "d5878c4b-7bf4-490b-8aef-bcbdfc32993f", "value": "768:Kmk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJPqqs+SUhNwE0imMCpFZXNi:fk3hOdsylKlgxopeiBNhZFGzE+cL2kdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338486, "uuid": "9e866288-2f22-4ff1-8886-a6cfd100c537", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338486, "uuid": "d39d3aac-d878-4017-ac40-59f539a08120", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338486, "uuid": "466fbfc8-ab30-4956-9f27-eb0bf8d10ad2", "value": "ACH Payment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ef3a0e-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338352, "uuid": "3952391a-4a58-4c4b-ae66-e714bd1555f9", "comment": "Malware payload (Formbook)", "value": "42cd03b537635eabf21afc11f0db1de1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338352, "uuid": "fb9d35d7-c0f9-4c71-a302-3e94f5bf105c", "comment": "Malware payload (Formbook)", "value": "53cfccbb5e14c9aec53709e87948d6bb0adae3f989d5eb446147989cc4b0327f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338352, "uuid": "1d6f4dcd-4fed-4b77-8903-6b71255c1426", "comment": "Malware payload (Formbook)", "value": "8a70e38cacb8438f547b10e7e650e0ee5d97677a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338352, "uuid": "63678d73-7190-4329-8ace-28ff615e2858", "comment": "Malware payload (Formbook)", "value": "7c44a2ae1e51d3a3af2dbbdf40a2cd9fa5bc7287693adaf30c30f9cc789f5e57b4819ea3a58924738bb9a8db26a2d24f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338352, "uuid": "9890185c-6f30-48e4-ad3c-b33f896c2159", "value": "T14875EC31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFBF82CE6CA69342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338352, "uuid": "1dcf14db-ab81-40e4-b3a3-7f49bc9ca9fb", "value": "1536:ech6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bZ:uf0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338352, "uuid": "eaf7575e-d266-46cd-996b-123b8ad2ae17", "value": 1676681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338352, "uuid": "ff37ea06-251b-4035-9a24-9f2bb786d8a2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338352, "uuid": "e783a8bd-7a83-4d33-8389-bd807676ee8e", "value": "PO. 4500129645 -- Jyoti CNC Automation Ltd..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6889a524-d1b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652335479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335479, "uuid": "50e7bf27-97e7-4791-9acc-0045235a761b", "comment": "Malware payload", "value": "bd52ef8641f84cb1a418f192f86b4554", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335479, "uuid": "2c24da5f-736a-4661-903b-03e7419224cb", "comment": "Malware payload", "value": "5426fab46234b122102d347c2d21f74fe47ce5fabc906d6b353e8c5c93fa430c", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335479, "uuid": "a59a0183-b7d1-4b21-8bcb-d8bad662e502", "comment": "Malware payload", "value": "6d44fbbb453b948c1708b1abc56a519454b04a97", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335479, "uuid": "3375a89a-9104-4a6c-b941-3b6d75b204db", "comment": "Malware payload", "value": "1187f4b09bfc8f27a2e391161e94f8e577a2e9d978509a59fa49fde12cc163694f21d0e4935ab349a3c17d8b2f69d861", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335479, "uuid": "ed8f0fc8-f65b-466f-bf7a-9eda4dd91c12", "value": "T11EA35F7D7620ADE8C1BA633757EC9DB299316C6D0A919D0B2001734C397CC7B1B6CAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335479, "uuid": "3080f7bb-9f8a-44ad-8563-6d4bbd97128a", "value": "1536:rvce+gM9yCmiQO/JcL7PZZ73jHDhZ9BD7f7N77j/35NlDRPBLhHddHjzjF5DtDrY:rvcyMDBBLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652335479, "uuid": "654b9415-0bb5-48c7-85a3-79d250f44f3e", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652335479, "uuid": "2c2012f6-08ef-41ae-ab4e-6ed590e317a0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335479, "uuid": "96ed5f72-36b8-4fba-883a-318c11ed0376", "value": "Win10-11_System_Upgrade_Software.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecbe627-d1b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652333691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333691, "uuid": "a63491f7-c292-44fe-8212-cf80fc4c03e7", "comment": "Malware payload (GuLoader)", "value": "434578c759bef1db26fa7b3165ac84ad", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333691, "uuid": "d64d3dcf-692a-46c4-aa80-7ba72f21d549", "comment": "Malware payload (GuLoader)", "value": "5439ae4fe11fe9f6f264fc0d4617eefa997719d9b65be8745d3632b2203e3557", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333691, "uuid": "4fa6f180-882a-49e5-b6a6-04f64b745550", "comment": "Malware payload (GuLoader)", "value": "df84b67b8df35a4ab8770b9f3c3f370e26b7763a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333691, "uuid": "d2dd20db-9f2c-45cf-977d-aad4428d32c0", "comment": "Malware payload (GuLoader)", "value": "d23daae6c8f6f076b9d26cc3e6b59328d86fbf4ff139d2ca5d3682f7c52ea311e12555da05b170fed6234f7c5e1f8185", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333691, "uuid": "9ed4406e-6a33-4ba8-b8f8-26fd15346a4e", "value": "T15C348B0995D6C1A065DFD50DE4113988F79CF8AEFFB32DAD768309C6D0F8051AE8BA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333691, "uuid": "050d13a2-534a-4aaa-baf2-ca22f9f4c1a9", "value": "3072:GXDrUO7/A9bLSzUFA7UqMAZ5uNIIhOD2Xq6s2mFg1:4Ho9i434Z5uCIhLXC2p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652333691, "uuid": "ec0131ef-032c-42f6-aeef-c6bb1c62bfab", "value": 236357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652333691, "uuid": "6bf96959-26a6-43aa-bebf-00ba2436520c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333691, "uuid": "c40497da-c4b1-4e16-ba4c-4be43e723919", "value": "Sursdep.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d356cbfd-d1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356274, "uuid": "58094cb2-4873-46c1-b2eb-f7df713ca46f", "comment": "Malware payload (Mirai)", "value": "ff3b1d0bc9356c300c63461ee5bc8a3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356274, "uuid": "4929343e-db19-4c04-b5fd-8505b6cf7abd", "comment": "Malware payload (Mirai)", "value": "543febb992984a47eb6565ada1eae4b339c8d319ecb93e366b965541d713a32d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356274, "uuid": "8ba4b744-63e9-4358-862f-92fade104d3f", "comment": "Malware payload (Mirai)", "value": "70869b7a088449d5d1979ce86587eceeb3aedd3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356274, "uuid": "2f383271-c264-4c39-a9fe-20c0aef45a82", "comment": "Malware payload (Mirai)", "value": "5d33e845ea3b414d4cc44eabbf06ab83842b58c32496d72d5fe0c187c5c936fc38ba8ccd2db5116d688b10876f4ad5f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356274, "uuid": "35d2d15a-0628-488f-8294-d5368860083b", "value": "T167D33B4755D5AFB6C183A97A696A25200705EC175B3F1A8B34387BB443BF4CDB00FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356274, "uuid": "48160ed2-0774-4d3d-af70-8b8c00a4a2b9", "value": "3072:rJAlJ0Sz41ByX97xA7XHnHx7Nn8amYstuUgwGTkNg:rJA7z6B099EHHn8amYstuUgwGTkNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356274, "uuid": "ca336c02-ae0b-4ed5-92c3-c512d6d6ea61", "value": 137759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356274, "uuid": "40df0d72-488e-46ec-bafc-b867c8f47a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356274, "uuid": "d182dd2e-15e3-4eff-944e-92357906ca7e", "value": "ff3b1d0bc9356c300c63461ee5bc8a3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563961ce-d224-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652381404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381404, "uuid": "fc8bc7ca-36fa-4721-a508-fa0a2b3635b2", "comment": "Malware payload (Mirai)", "value": "1e0ca8a10a05b92691c7d8af67a18d14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381404, "uuid": "69f5c49b-e6d3-404f-b8f0-fbae59121db4", "comment": "Malware payload (Mirai)", "value": "54b71b4ed153dde3760fc3de8fa2f5dfa82eb35a2a1dec9969a7fd379cf64024", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381404, "uuid": "6d174496-2e60-4aa9-9f07-12c403d42f2f", "comment": "Malware payload (Mirai)", "value": "5b28942f6a242b55f8daa6f967b0902b7883221c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381404, "uuid": "4d838443-b6ad-45be-9075-fdac6d507b75", "comment": "Malware payload (Mirai)", "value": "1ee2462dbded79d29b9e4375f1e93fe4ffd9ab409e031fada29a315141351122542ee2676ce1db71402d86e251e3b959", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381404, "uuid": "3198b6a6-647f-4f64-93b3-4e1d78224254", "value": "T131735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381404, "uuid": "39b14148-b1a8-4818-a8ec-dfa27aecc4cb", "value": "1536:b/DYQYs1ZokODichQR15UzOHIt09nfsH18ruUGDKVQSi:zDhzUkODichQdUzk40V0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652381404, "uuid": "da8c7573-43eb-45be-93c7-351923bcf37c", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652381404, "uuid": "49bd4f14-86e1-4922-8933-436b1575fba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381404, "uuid": "f445bcbf-e011-45d3-9d5b-16e5135e4ef5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4a1be8-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338732, "uuid": "394ab1a3-c165-44c7-9f61-7be8eea92ba5", "comment": "Malware payload (Formbook)", "value": "4a6cc2760946bdfa44e89ea1f65d433e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338732, "uuid": "e4a95839-5503-4378-8ef7-0940b7a28c5e", "comment": "Malware payload (Formbook)", "value": "553ced635355236920c7cc47a0038b815a295bc701f42b18e6b16c1bdbd772ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338732, "uuid": "f8491c46-6767-4b49-91a9-a6973a1b09ff", "comment": "Malware payload (Formbook)", "value": "9b9091e27286698ae35d2a0ca432c6d97a4164c7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338732, "uuid": "3f3741d3-4733-4a24-8de4-03e2370c3617", "comment": "Malware payload (Formbook)", "value": "0d7b1d6e88e61eb18889628ed660bb7dc09b49cafa22ce6ce215a17f922ae1bcdfbe055ecb361845eaf73f26503884bf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338732, "uuid": "7e3520ac-f649-4388-8a82-da887ac9c602", "value": "T1480412B83D208318F8DE13BB2C97C21F802BEFC567555A6EB19A3B581734652C721676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338732, "uuid": "4204003f-29c8-43ec-a782-42598cf50bf0", "value": "3072:0d4rvm2MNTlYlKHTtbTOkaVcqDjYmb5SUvd5qwzmKeLB0qv4L8TlwSPHt6o3GPLD:7D5dGbi2qIVqPaxv4L8Tloo2DoDBN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338732, "uuid": "d67f9550-96c5-437f-84ef-abb415b3566f", "value": 188152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338732, "uuid": "582229ad-575c-4756-a597-87433f85bb81", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338732, "uuid": "72c22b1a-8627-4b46-9303-ef7188ce297c", "value": "OTP and FICA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f732e9b-d1e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652354737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354737, "uuid": "33a4c1ad-78a2-4c48-ba50-4a0b6984ebd6", "comment": "Malware payload (AgentTesla)", "value": "0e85ef099628a2e45d0c209ea24f4114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354737, "uuid": "1b7f355e-f499-4bdb-bd4e-eb7374d0d5c7", "comment": "Malware payload (AgentTesla)", "value": "5550c9c521d10c49e857c2ba2d0d873089056944f44ac92e42429220becba234", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354737, "uuid": "b25fd4e8-08f3-4cba-8102-2584c1005b80", "comment": "Malware payload (AgentTesla)", "value": "a50ef23244275d06c6f53fd18a97881ecdeab45d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354737, "uuid": "e34e7231-cab1-455d-845c-f991f2118387", "comment": "Malware payload (AgentTesla)", "value": "5fe88fe8fb1a184577bcf55a6e2be15139ccd48f69053e783f09645b9b2e0501c8b0cb6290be76d733f81a8ca310a941", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354737, "uuid": "adf2589a-0c14-4b91-ad1d-997b7d04bdc2", "value": "T1ABC412153217A322E8694BB6DDC650DC27B1AF1AAC23C74B0CC5316BAB37BD31A90757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354737, "uuid": "ffbce911-0417-4591-9b96-bf47e3ff1c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354737, "uuid": "9b42f691-bca4-49f6-9ced-9b039855e2d6", "value": "12288:kl2ebJGEOTDbFDnXfl+K8TV9TPTjSyojg+t6mL3dkRC1b5h0:klfVhmfFDnvE1x0gmL3dkRCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652354737, "uuid": "f9e285bf-ec9e-4808-9b72-730eafda0ea5", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652354737, "uuid": "96973109-49b9-44c4-b99a-b85f4f04db00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354737, "uuid": "780e2db5-d5ea-45a7-a79b-477a315f5692", "value": "EXP 22-12-05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4e6746-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (MassLogger)", "timestamp": 1652337074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337074, "uuid": "466af1bf-8bac-4a06-b68f-15b00c51ebda", "comment": "Malware payload (MassLogger)", "value": "cc92ae8e32081a13928b298af4d3ae68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337074, "uuid": "95093414-dfd0-4dc7-b747-7e5729a88122", "comment": "Malware payload (MassLogger)", "value": "55a6538b91bcfc7f276bdc96e863fefd2f6bed25bdac956b67b8606bcfa843bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337074, "uuid": "e4051b04-fdf0-41af-bead-2f0bf3c874b0", "comment": "Malware payload (MassLogger)", "value": "59ec8506d6c05cc849cd012fc38b2a3da8badb26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337074, "uuid": "38cf0d3e-b719-41ae-87d2-87130b0350dd", "comment": "Malware payload (MassLogger)", "value": "0684dab64a6247cdc583192532803292b9ac7bb4349658a24b6c09cfce117d49d79ca0d7cffc458619710bab9451e3ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337074, "uuid": "c13b8060-3be0-4ca4-bc75-dc9f98f93b3f", "value": "T133D42394FE54D4EBEDF227B00E0A3B535EFF933499B4581A430137557CB6AA5800F28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337074, "uuid": "8a855c1b-4b8d-411a-a3c0-f5c1f8b523e4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337074, "uuid": "12196c37-35c2-443a-8038-dbbec575105f", "value": "12288:pOEUWP/ApQU+9ZBrqaXnR6ppa9aDaiNbwUsRQw+DU0F+r2CJmlWIkNJB2sR:pOpEAMwa8MQ72+DU0Ar2HT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337074, "uuid": "0c307f8a-e19e-4687-a5a4-a7959fe2a062", "value": 641498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337074, "uuid": "a77dee30-f7a1-4001-8153-1ea9b54b6c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337074, "uuid": "1b98979c-47e4-45f0-9f5a-740d7979d6be", "value": "S0000987654345678900098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc5ccc9-d1d6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652348156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348156, "uuid": "bc18ffa4-1d15-4760-b8c5-43856252bb40", "comment": "Malware payload", "value": "d226ff0a8b21cf5189f9aac8d54f207d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purelogger", "colour": "#439B9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348156, "uuid": "d0a6cdb8-4edf-4357-bb6e-6fadf03da516", "comment": "Malware payload", "value": "55b9b380e7b5173e1481af8f2379a2490f54dfef43324ed9dc71e21a48207a9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purelogger", "colour": "#439B9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348156, "uuid": "e927a331-ae16-41d4-9e89-ffbaa4320d5b", "comment": "Malware payload", "value": "e162e6a9d32f91379a1b490896e9d77322342a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purelogger", "colour": "#439B9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348156, "uuid": "a01fb9ac-c4f8-4c1c-b3f9-08c2348f6168", "comment": "Malware payload", "value": "3db2ecf7594798408029898bdb3d190fdc1f754a15ade1cfbd90f96ab739a1844c0bf2dd04a33404d9c8907a0bbe54a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purelogger", "colour": "#439B9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348156, "uuid": "154f7a86-53b9-483d-ad19-5bb0c9e40933", "value": "T105846D063384CF25C51F15B6C8A3C2F81327BE00DD459BDB76C9FF2A79B22AA6951583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348156, "uuid": "4b81934f-32dd-4d4c-9d2c-dbe508e8fc5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348156, "uuid": "2b64d4d8-a51c-4f7b-b265-9bfb846ac301", "value": "384:wWulqRQN3bf04J/e+EMn06CjFN8P3YsU6fCWYA8S/hs/E8sofOh/Q0RbnqyGt/QZ:wWHR23b7dM8sScz9Apqn+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348156, "uuid": "ab9a411b-e492-4ee2-8420-c6f157882e68", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348156, "uuid": "02d3d765-8da0-4328-abd6-95cd27b0f8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348156, "uuid": "2f110a32-a1b4-467c-8101-7c074edb950d", "value": "VbmzgOe1Fz4Uga_PI3miSQ9U3_9DMk7Z3HHiGkggepo.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52745ebd-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652366366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366366, "uuid": "422f4d86-60f6-46e8-85eb-b03b0976b1ba", "comment": "Malware payload (Formbook)", "value": "9df53fc0307485ce3a1c231756c942d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366366, "uuid": "62cca65b-6e92-4f4e-9aa1-38bfb8605675", "comment": "Malware payload (Formbook)", "value": "55c7aaf9afbc99e9e74450f9fca82d2edfcd8df88f9d2d507bec7bbab69f95fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366366, "uuid": "e60d0ef8-ce89-4c76-b5bb-b5c4b915cd9a", "comment": "Malware payload (Formbook)", "value": "cba6a61752ed44fdc896fd7aa7057e59dfc9725f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366366, "uuid": "3dd07160-0897-4a3c-a8ff-5b4228b90919", "comment": "Malware payload (Formbook)", "value": "1c514fde8f1aea5f2c45bf265bbded86f4475ee6bfb9c6f0880e86960aa01d190608587493fd2c6899007b41441d2d57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366366, "uuid": "1c72ae21-f43d-4115-96ba-5a7ae4c16429", "value": "T1B52402C163D85907D94C5A71A162408527F8D217B77BFB8FF9B4821D8E933E22FA05B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366366, "uuid": "adbafa63-d0c8-4ac5-b3e5-f88b06cc72aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366366, "uuid": "38e9d09d-496b-48e1-bd22-dc591ab9c6fe", "value": "6144:kYDYeCT6nYIbEEItJknFi32UgwQEzZJyG:DDGTJIHcJaFi1gF0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366366, "uuid": "289acc82-bbd7-44db-b125-302459716de2", "value": 227376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366366, "uuid": "4249ddd5-4399-4627-8a35-e0948eaffc2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366366, "uuid": "f2c96a1d-1e0a-490d-9ec2-fe78537aaaa4", "value": "Proforma Invoice & Parking List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8220b5e1-d1e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652352272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352272, "uuid": "0c245dca-29a4-44fe-a929-4b9eba290487", "comment": "Malware payload (YellowCockatoo)", "value": "a65b0b749d43e3e062db4d662bbe7485", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352272, "uuid": "44d78ef5-6ce5-42f1-bf2b-b48c2bc3f065", "comment": "Malware payload (YellowCockatoo)", "value": "55faf10e612aeaec2e2a563cab2c00bfc2a7d2054d8e83c04789105a5fa99602", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352272, "uuid": "29adc1e7-db57-4961-8900-9b2907ab1a14", "comment": "Malware payload (YellowCockatoo)", "value": "5eaf09ac556d19d6f3d53d2270c1ceb5a1dc1767", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352272, "uuid": "cf385e65-571b-4710-8671-93d22239d105", "comment": "Malware payload (YellowCockatoo)", "value": "0d4119844ea5cfa011886b373860c7b23b98763bbf68b20dfabc9373470cdf08d17ec66e3d04d1a8c1293194c63df152", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352272, "uuid": "f543ff10-6182-418b-81f8-23d3eb5cf538", "value": "T16636339FBC0737418225E4EB4DCDC5342CAB62BE9E96EF03F156D4835E888C6F86445A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352272, "uuid": "885fec34-b1cc-4460-bbe1-6fd4956b7f55", "value": "98304:WtcTY0V0TFTHAdl/P8mXspMpoOKaHbPsp+P8DGgIqrxKeN7K2sx8Q37h:WmEFTH+V9tbPO+P8DG8xKeRrIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652352272, "uuid": "4966c554-b34c-4437-aa1a-6e1752bcca3a", "value": 5248485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652352272, "uuid": "4208333e-9109-4ab0-a261-909d69ec34b7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352272, "uuid": "cb03fe4f-de3f-4489-99e2-a45758002b4d", "value": "0404db80657a603605b3c0128269a1d7eea2b4e0a17b7a3f48ddc0640248f2c0.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49016a6b-d1b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652335426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335426, "uuid": "9357ebbd-357e-4a09-b8d2-e27b06dc196b", "comment": "Malware payload", "value": "47b0c297be39cd01c5a5bed5b5bd5cec", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335426, "uuid": "18224586-5bc5-4332-9de1-741741327312", "comment": "Malware payload", "value": "560feb69ec5771380c0440f52c60d9a229a56eda4d616d10b47e3ebaabb25f82", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335426, "uuid": "f2569ab4-216e-4f69-bd10-f23221c37a6a", "comment": "Malware payload", "value": "764082d7e0de80b28d6d78274747e06253b9ad74", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335426, "uuid": "806416d6-d013-493f-86ff-696a033bc1be", "comment": "Malware payload", "value": "6a64e003da16494858ca074a4ebc2bd266c15dd238ad7b4b1404183dd0ee6ef1758e44f8287c9b5bbfd516452e5f6f8c", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335426, "uuid": "100806ab-56d4-432f-bc84-af62c598b323", "value": "T1E7A3B9B7260025E1E146C271003DBB7A5726BDE9859F043493B7F2AD3E73D628ED6782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335426, "uuid": "aa74b92c-e882-4631-aa70-0866a970be0b", "value": "1536:/Yw99ypVbgyLoY/YD6Zetif4lcxmj0D80Df7fxI:Anpp8pOZetiAk7LxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652335426, "uuid": "5034efba-60da-47d8-a65a-211aa903b918", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652335426, "uuid": "7203790f-5804-4a03-bf34-8fb207a80f54", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335426, "uuid": "3340dff6-c8ed-4e90-b80c-8a9ebd4755a3", "value": "Win10-11_System_Upgrade_Software (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78596fa5-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652316608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "eb17a0b2-b663-464d-914e-66759bdce6ed", "comment": "Malware payload", "value": "f7d03c56bd101e0b69bab46d8c43427a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "88c7252c-b2ec-40c0-bb4e-e5295380a339", "comment": "Malware payload", "value": "5614ad6672aef0dd8a408b456eca84cf3122729fa4bc71279237d6e14208e44d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "41b0bddb-30a1-4df5-8a50-ace853b3937e", "comment": "Malware payload", "value": "3cefff8cf925dbd8002a3304b94545b49f522fe3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "7de14241-5bfe-4dab-aaa9-82f6b6485f33", "comment": "Malware payload", "value": "057fadda901d127cf72041d1e2a274e65cc0136878be9f007ec5981cfac28f63fb6e1115ecd5b64d3cd0dd559ed6ae3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316608, "uuid": "be5d777d-e94e-4675-90fc-257d0cd4c50e", "value": "T1E12294C6B906AA07CAC48136B70E839DBF225709F2EF330767177F9165479370A67449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316608, "uuid": "adfc80b7-122d-4d2b-b710-7137f976cb62", "value": "192:8+CCeR9Ag1ya8hWOKSPT+rwtsgwaS6LYTm/C4gGA+1v3kEZx4e:8/Ca9AgsdMO7PT+4o6LYTFkvFx4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316608, "uuid": "277af743-1de6-4cd5-a617-a7bbf4323d7a", "value": 10388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316608, "uuid": "f8413d89-c36b-4ff8-aa7d-4ed8875885fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316608, "uuid": "230a38d3-8752-41e3-959e-47838220a8be", "value": "Ugliest.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4424d046-d196-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gootkit)", "timestamp": 1652320386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320386, "uuid": "8a7a0ad8-0d31-4f35-ad5a-9cda6bf9e33c", "comment": "Malware payload (Gootkit)", "value": "c17e19cbc2eed9a30f3554574c3d38ef", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320386, "uuid": "007bf024-96e0-4a8f-866a-3a9ee76dae2d", "comment": "Malware payload (Gootkit)", "value": "566d48c7acb52cbe910bccc646d70a026ee25924cdb5751d3526864df49c69bb", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320386, "uuid": "72c4dbe9-014f-42e0-992a-f8c1714791dc", "comment": "Malware payload (Gootkit)", "value": "3779d8475b7abeaeaa0c8117d2be982bffe29d26", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320386, "uuid": "6aed2e91-7e3e-47d1-943d-00afca9039a5", "comment": "Malware payload (Gootkit)", "value": "9970c953566356b25ba31f3eb31db6d4fd971efb123811fdd2ff139802807d5903ca3781c15088e4c9e603fb996ac4fe", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320386, "uuid": "53e98856-4bf5-4e3d-8438-26192ee678f2", "value": "T1F38313035CE39152CF84A6C77970A19FE72175BA98CE2239907E2056D85BDD00F5EDD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320386, "uuid": "39f03a70-4aeb-434d-8c5c-c25670391874", "value": "1536:/ZtQ0gIYPoCuMplWGyg/w8N+/BWmY58vXn29ao6VFQ4MkmSg:/mCvglkB8NmBI5w32YvDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652320386, "uuid": "0fbeec10-d381-448a-a344-65d359ee40a5", "value": 87818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652320386, "uuid": "f5d1a3fe-3c31-4e28-a4e0-4dbef61f74c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320386, "uuid": "a3bd5b43-6730-43ac-b51a-4f9afe06c153", "value": "hipaa business associate agreement template word(59723).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e46ab3-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340686, "uuid": "3f5d91cd-8829-441e-b051-ac563a8c163d", "comment": "Malware payload (Loki)", "value": "5aced01eb87f9b45da181121f2c5f510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340686, "uuid": "1eb236ec-588e-407f-82b8-69ebc007105f", "comment": "Malware payload (Loki)", "value": "567bf09698cfcb493c909227b6f3d53db7e693cc0dbfc6d9c1ca060f3ed13f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340686, "uuid": "fb06ad1e-de2e-4c79-9fcf-a9117e6fb44e", "comment": "Malware payload (Loki)", "value": "a57a4c0b27bd776bc086dc35ddad1d3506ee556b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340686, "uuid": "66c139d5-aa79-4ebc-9096-d90b56221646", "comment": "Malware payload (Loki)", "value": "bc79282007e536b4efbe3804e66402f5f3933a1df5cb0bc65c0573f58604fbc58a282b78d4207289ad897881ea070f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340686, "uuid": "ca50a380-a666-4509-92ff-0ab3a02586d9", "value": "T101040271BA71E1A3D9C287316A77DB17DA6BE0233062A14B0754764ABE31351A32FB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340686, "uuid": "a543999c-aab7-444e-80e0-4517d881d6ff", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340686, "uuid": "6b9f37bb-ba5e-4a56-9865-adfeebad35a2", "value": "3072:LODZGPEounb3MZmAsln4rZCWHjcY880kV1uLWcCcnkYSvyy16OW7uL8JxK:LOtIO3gVW49N2LGKkQxqL8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340686, "uuid": "6a5f7158-307c-4d4c-b36d-50208c713cd7", "value": 183131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340686, "uuid": "0dc0edc5-6a0b-4027-8ca1-a69e8c020c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340686, "uuid": "8f717e70-8159-455f-9402-4670565935f1", "value": "5aced01eb87f9b45da181121f2c5f510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce74ac0-d195-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gootkit)", "timestamp": 1652320024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320024, "uuid": "5dd9bd32-416e-4eb8-912e-ac692a7cc609", "comment": "Malware payload (Gootkit)", "value": "4d8181ec1b1e1e1bc392419defeb463c", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320024, "uuid": "17190f63-31ac-4e4b-ad24-729b352a930b", "comment": "Malware payload (Gootkit)", "value": "568eeaab68afe15f420fcdc4ac5174dfae9cb1b56b365ddf0951dee35f916dff", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320024, "uuid": "9520ac44-8ead-4bb9-8e8d-1417147491e4", "comment": "Malware payload (Gootkit)", "value": "a5092c21ee1740edcfcd8b0ee698b8357444c448", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652320024, "uuid": "67db71b0-4565-4e4d-a715-8b503ae075d7", "comment": "Malware payload (Gootkit)", "value": "c5510325f0767ce702c11d0d93a3a407a979b13caf1f6e5ad5285df7b1e2637ee5f90fcab74a6f801561c427dcf290ab", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320024, "uuid": "77073e3a-d637-4594-b195-bac8c0b821cb", "value": "T16C8312FE473A1BDF0B94539CBBDB227A7DB6543CB7D55D2008478624183387635BA284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320024, "uuid": "96ea85a0-e02a-4bad-929d-89b8fbb31c22", "value": "1536:m2vik028j9taT58rfMatbYc8y3dgtMqVJNqSVVnUtHpoTEloA801CYG:m2vCZbfBDzS9VUtKq/Cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652320024, "uuid": "314d1aba-f05b-43fb-87a3-9fb246145e05", "value": 87874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652320024, "uuid": "c7f86d3a-4312-4a1b-a785-3a97d62f8c4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652320024, "uuid": "b943593d-997b-4cf4-86eb-279216b8fbdc", "value": "what is an open book agreement(56225).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6eebef-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330226, "uuid": "55f351ba-a485-4d58-a7a5-81935b745bc6", "comment": "Malware payload (Mirai)", "value": "1fac1ff9dcf110718f0acc94e64c2872", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330226, "uuid": "e745afb1-6660-40cd-af09-5697f09ae3ac", "comment": "Malware payload (Mirai)", "value": "56abfe3f69a30a0a3bb55213f6cc074704bd9de47ce5afeb5e5d1dc0900346ae", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330226, "uuid": "2e083367-e2b2-455a-ba97-9e9ffa9aa2da", "comment": "Malware payload (Mirai)", "value": "f22bfdcd12e553896c63f9cc86a9589f5490dab4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330226, "uuid": "1defbfe5-d377-4025-af3f-23d353d485ff", "comment": "Malware payload (Mirai)", "value": "a602814c341ba2e61d0f87937fdd172bd7baa02dc31f1894c6fa289978e06333b0b97748be3091da2721ffea777163dc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330226, "uuid": "33d78fbc-e402-4977-9fd9-a397da8516c0", "value": "T190F3A51E2E31DF7EF768833487B78A70A29832D526E1C549F17CDA090E7024E655F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330226, "uuid": "18c0bf6b-8153-440f-98dc-170a1ab171b1", "value": "3072:jAs8KXl8vhArbI2B9y56bbhmqy8xR0tEy2VXz3:k9KXl8vhArD9y56bba0RXBz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330226, "uuid": "9710421b-7446-4a19-a07d-1b7b324bd2a0", "value": 157708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330226, "uuid": "4f5a2252-5228-4da0-a44a-f05b61953f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330226, "uuid": "890d2f23-7d36-468c-86eb-f19845f49d98", "value": "enemybotmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f80109-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340702, "uuid": "079fba63-61af-4d9d-bf51-1481a9535ca0", "comment": "Malware payload (Formbook)", "value": "f35d4b7708578a4ad7f16a1c51d41eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340702, "uuid": "eda5cece-2cb5-465d-a8b0-ce1336cd8efb", "comment": "Malware payload (Formbook)", "value": "56f0926377455c42b13e8235983ec0c4a2a1bdefc68a712d7e9374ab67af108d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340702, "uuid": "4e8a684f-b170-4f4e-bb71-970723b0e51c", "comment": "Malware payload (Formbook)", "value": "bf61328a1e6ed8d9cc7dd48e96bfeb5de74e9c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340702, "uuid": "78af3a7e-21a7-47e3-a16a-de8a41815658", "comment": "Malware payload (Formbook)", "value": "56a947daa8f7aa3e4703303c6aa8eadea14add4aaacfbdaed771fb69c0c69c5f96f2ba6654d0a8a27aed3f62743532f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340702, "uuid": "6d873d96-6824-4e00-8245-9b5f1d5b117f", "value": "T19944139183E2C5E3EED39B329D7B532B5A6A68005D6442270B4027FE7CB6DC2EE17315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340702, "uuid": "b301d214-8157-4356-9e98-a279596f3085", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340702, "uuid": "70765f50-4599-4c65-941c-2fcce592b470", "value": "6144:LOtIOD1J/AW9Erz0FYvLNkAlmVPy+Wyvoc05wdZt1/V2qZ:LOLJhAWa/VvLNkAQgO3j1/VfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340702, "uuid": "5353766d-43d7-416a-83f4-14cb347d041d", "value": 273857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340702, "uuid": "bca2b71f-8a0a-4b36-9e8b-9d0cb15ef330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340702, "uuid": "75b5f4c4-69e8-49a5-9d9a-8b5e749ad20a", "value": "f35d4b7708578a4ad7f16a1c51d41eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2011a0-d1ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652342788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342788, "uuid": "5fdb919d-9da4-4732-b8ec-5d01d250f343", "comment": "Malware payload (AgentTesla)", "value": "bca756ff46476a13b456d1309fdad174", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342788, "uuid": "f91e5050-c38e-4163-bb67-6a7af2817466", "comment": "Malware payload (AgentTesla)", "value": "58662a541e967957fb29666739766952c7379969a44bd73dfb5ec22e8fc2993b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342788, "uuid": "31af761b-c034-42fc-b140-e7d8b1747ea5", "comment": "Malware payload (AgentTesla)", "value": "d7244cb49f8f98a501d4fb1e0784a12c5af4cdc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342788, "uuid": "4c5a4b3b-bbe0-406c-adc8-ca6618d5f254", "comment": "Malware payload (AgentTesla)", "value": "1b773d94b94e6bbbfb1f3f74e5a7374a8f7216e722def8a3eee2f0efddcc7a05998972fc365cb3732c08fd971ecf16a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342788, "uuid": "e54b5a5d-47b1-4e5c-9b81-f4dbde6f9bc1", "value": "T120C4120621646333C8AE5FF8DD6294CC43B1ED1BAC31C76F0DA9B29D1AF47584262B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342788, "uuid": "cf74f33e-eae6-4205-baf4-f4383a13504e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342788, "uuid": "6cfa5cbb-4d36-464b-8a29-dff24f161d2b", "value": "12288:CrvKs/528MvpZdcjIlQYCggpd6EButA/6g18+OSj4e:CLLBNMvpZuUeBHWECE1go4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342788, "uuid": "244d257f-2898-46de-8758-dcd207a66cfc", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342788, "uuid": "9332aaa1-dd30-48d8-96ff-a2e89b769805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342788, "uuid": "6f129cec-57a4-489f-b6c5-eaa16e29cab5", "value": "bca756ff46476a13b456d1309fdad174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513675c0-d1d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652348754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348754, "uuid": "3b9274ee-c131-4137-9da1-fb82de7849eb", "comment": "Malware payload (Heodo)", "value": "c86d2ddf581991566a3a4d0e9e1be304", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348754, "uuid": "8db2f8a0-71f2-49de-993c-1622eb9d7874", "comment": "Malware payload (Heodo)", "value": "5876e15d5de17d85942d2cb949aea3cf0de2b67bb28bee64790c247bc84c342c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348754, "uuid": "376fb6fa-fe27-4807-a993-09f1e10e35ad", "comment": "Malware payload (Heodo)", "value": "be64fde57b1dd1ca78aa56ae286270bcbc97be59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348754, "uuid": "a3cd9dd7-e667-4f1d-b7eb-82b5aff32024", "comment": "Malware payload (Heodo)", "value": "86b81da59183f969bdf56762f21f7b1bd3a818a27aeed0e8a080b277af3784cb2e03a5f725a5939781f1e48965016db5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348754, "uuid": "7599fcc7-28bd-4312-9df5-d427ccea100a", "value": "T15DF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348754, "uuid": "af65184f-3171-4534-9098-7ed25164dd63", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348754, "uuid": "0110a6b9-7aad-49ae-a221-bad283f3ea21", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSZjNwgraKRT61cKGNx:S4DzZKnH4ARGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348754, "uuid": "732780d4-2307-42d1-9a57-8e093934a02a", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348754, "uuid": "6a298024-fa67-46c4-9c08-439c2bea7d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348754, "uuid": "89f04737-aeae-480c-9243-bcca2bd34c9f", "value": "c86d2ddf581991566a3a4d0e9e1be304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c3ba0f-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652346344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346344, "uuid": "299b0e9c-c696-477b-b270-1521da7ecb02", "comment": "Malware payload", "value": "8e9565d68ae038e62fb2e01a734f08fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346344, "uuid": "b8e557dc-71c1-4a86-8ad7-0c06b2233801", "comment": "Malware payload", "value": "588c9c589c341d01997e40c295dc709f9259c42cf162879e3699a4bc231154f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346344, "uuid": "4dfbaa6c-59cf-4dc8-a69b-f59b03844bae", "comment": "Malware payload", "value": "db51cf6059d34ec7b4caa5c0478387698e196b9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346344, "uuid": "9cf2b526-1eb0-417b-831c-ffe2f621104f", "comment": "Malware payload", "value": "b2f726d88ef2ae753f278041cb0edacc7cff2a6a0d89165a0de1b85b0c778db702529caf0927af81cfd7d5fddc645a0a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346344, "uuid": "a3cf9a64-4562-4138-8d0a-55bc7c2d4576", "value": "T1EF73F74177E21721C48855B8C1EB492503F3EB872337D7953F8842EA0E523E98ECEB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346344, "uuid": "057d8a72-db9d-465b-9f6f-9f13ebcb343d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346344, "uuid": "a368230f-deaa-4481-84bd-bc5caea583be", "value": "1536:bVUMg1C2AEi8dYKnX7rWx4CEVeQDVBwvWdavxY:iI2gOnX7rTeQDLwOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346344, "uuid": "14f38e2a-b8a0-4dd5-9c6a-e0a4f6d7bb86", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346344, "uuid": "38d5d5c2-4572-4179-952a-747a99f1b34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346344, "uuid": "03b9ed9c-06b8-404a-8589-34ff1b1d844c", "value": "H1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6898810c-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652341063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341063, "uuid": "af13df77-9883-4780-b8fd-b1cdb9616541", "comment": "Malware payload (SnakeKeylogger)", "value": "562f93b4629b66823059d460e38a834d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341063, "uuid": "5b63c42c-34e1-4cbc-9c4b-6e980b8aaf89", "comment": "Malware payload (SnakeKeylogger)", "value": "5906d988451cd22271d32dc03d438b62196fd47544dd507c70a41e521328bc78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341063, "uuid": "e58bb328-86c0-472c-b229-70fbdeae16b3", "comment": "Malware payload (SnakeKeylogger)", "value": "1160234f473532f9a254f061d1446038bc261e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341063, "uuid": "5a273ccf-b5ac-47cd-bd33-3c72f41479ea", "comment": "Malware payload (SnakeKeylogger)", "value": "ade7ec10d7f930d023083ca41b55adf437bb252932dfc4e3eb910c4f8abeb2d95c8a3831a99b0488715da6cfe4734974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341063, "uuid": "6a819e4c-8c6f-4951-b07f-2e9fb2d605ac", "value": "T160641245D290D053F9B32AB26F7F46D286BACC2160E6A40F53807E2D7832657CE6F166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341063, "uuid": "f65fd829-fffe-40b8-8f43-72267a1b15da", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341063, "uuid": "92d2417d-15cf-4ee2-8e2c-28dd2b91fdd0", "value": "6144:sOtIIVBfrXIvBX56mw7PrehIB94qq2orpH+GtNWsNe3ooc/aLb:sOVB7IvBX5dgoi4qXoVHdtNWge4/av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341063, "uuid": "49243a2c-7fb1-493f-92fb-9a5023272ae0", "value": 336139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341063, "uuid": "2b1d197d-d8b3-425e-93a1-cacee453dbaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341063, "uuid": "62f3eda9-bd45-4e26-bdd1-ced562bac559", "value": "45678909876543234678909876513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38816258-d1ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652335828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335828, "uuid": "a635838d-8e4f-4b8e-b7bf-efd8bab099a4", "comment": "Malware payload (AgentTesla)", "value": "a212761666e596995d242cebf5df8592", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335828, "uuid": "05631014-3187-46b1-8f73-11207f0c497c", "comment": "Malware payload (AgentTesla)", "value": "59143ce3ce84a082ead015d3cca2fbf9bc7f15aaeb9785ca04dffe15227d716e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335828, "uuid": "95f8df47-3292-4e86-9a26-7fce04517a9a", "comment": "Malware payload (AgentTesla)", "value": "1a89d483c3a0836446d7bcedfe72d09606b49a08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335828, "uuid": "264861ce-b6c0-46a8-8c8c-97a60c22d615", "comment": "Malware payload (AgentTesla)", "value": "68e374246e7b551a966f8aadeb9fd40934b2673867cbf521123e950323d95c650b6fd5a8b4d16e62d697f9d0c8eece4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335828, "uuid": "32beb1ef-65c0-43c0-a519-2d89da6cbb93", "value": "T1EFA1FA359F8C4843CA12C5F7E6097F27017AFAB7CACB5A81732DF5900F5B5066962846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335828, "uuid": "d32aca91-bbde-4ceb-9cb6-24dfe7ee856d", "value": "96:neKhIB0b3rulYkcqeCXq7xStXrEny/priVFjfXfgMjTT2uckD/bZer:neKhIB0bbYYkcsXq7Qt79Bra4MjsYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652335828, "uuid": "985df2cd-b6d1-4410-8b4e-2d1ede7d8aaa", "value": 4859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652335828, "uuid": "73e775df-12f4-45eb-90cc-70501887add5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335828, "uuid": "2cba468c-3637-460e-9c30-b0aa5f81c65f", "value": "PURCHASE ORDER .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de745cb8-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338683, "uuid": "cbd103af-8975-4da2-9254-1bd155a86dd6", "comment": "Malware payload (Formbook)", "value": "dbd740ba079564aea301ae18d5004c0b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338683, "uuid": "5629ed0b-a337-4534-9ea6-c9e7899a1013", "comment": "Malware payload (Formbook)", "value": "59636f53a8b4d26ab73011214063264545ba501042027f2346135931c831cbf8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338683, "uuid": "31728c8e-0397-4246-82b3-4a2a252289e9", "comment": "Malware payload (Formbook)", "value": "e31e4a4a6058eef52808a3cba7ebe813a0f19dce", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338683, "uuid": "3ac230db-6c9d-47d1-ac8d-407bde605fab", "comment": "Malware payload (Formbook)", "value": "5b2c3f2f0a243ced8251f983a93556fa56a64ae1c03a742c7434471333fd3b31dc9f83d356e1d6410885888515828a9a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338683, "uuid": "931cf7fb-2a15-4405-af45-e031d85ae16b", "value": "T1A40412E03F21A65EE0A71D7E9B2A2EC14514DFD1D572DAD7ACA0380F4CBDCC464D462A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338683, "uuid": "8f5cf3c7-a206-42af-8aa1-5471beaaf621", "value": "3072:fxCwUywxO11m+tlVZ5R1HQE0So89q4TMJJ1NF+YXACb0J/y/h+dsX6J6S8MtqWoq:tAsDLH7nVDm/RX6PUVitgUNizAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338683, "uuid": "8bec3b38-76dd-4ad8-82b4-b6e6fac64a47", "value": 188264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338683, "uuid": "75ffe5a9-776e-46a6-9d83-47b618a72b18", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338683, "uuid": "48389209-3c01-461d-805a-f53464d8df04", "value": "Order Package.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7481410c-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652355685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355685, "uuid": "834c951e-3c3b-4f22-8d84-9c3fd1a7f03c", "comment": "Malware payload", "value": "0cad40db4bd8ffd537468f32f433ea24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355685, "uuid": "4eeec01f-e354-43d3-9a51-7dcebfdf4a75", "comment": "Malware payload", "value": "5992339b03e53e91432f777e55b78aaaccfd9f1007747bf2276a2dd0b5949c63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355685, "uuid": "738ce06d-b465-4820-bd75-6986895dbca5", "comment": "Malware payload", "value": "9e05650b7fcb3d14134df8f525638765549b120c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355685, "uuid": "e9e4d5ce-2e61-4f41-9d48-6df42bc1eb1b", "comment": "Malware payload", "value": "910fbe06b7979e9f282201e0b0f13a8e5fd3f705a866301828278d272b81ad640e25bce42bc2afe671cc88c0e7e8449a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355685, "uuid": "30b3090b-1f8e-4362-84d8-662a8cc4efbd", "value": "T11F03F135F050FE46FAEF09BA1D7AA2C1AF911BC430C9C4D4964D0FA139A1726630EDD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355685, "uuid": "b8810bb0-409f-49f3-8690-b424add6c1dd", "value": "768:Qz2/TlowhSpI9tuBcqAcL0BRo3V3OUmLJVAZOdL2T4uVcqgw02NWXb:T5ouSpI9tuBczcIPUmLYZG2T4u+qgw0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355685, "uuid": "7f393bcf-d71f-4053-9237-9a51029d8aed", "value": 37732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355685, "uuid": "9f5fd463-7c19-408c-8d0b-8919c7f7590a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355685, "uuid": "a4fa929f-78e6-4bd7-bd0f-c74a10883c42", "value": "0cad40db4bd8ffd537468f32f433ea24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ecdbc8-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652377485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377485, "uuid": "c9f10799-d5c7-4db6-999a-e789547ccfc0", "comment": "Malware payload (Gafgyt)", "value": "7b363fe271e984c95e667400ba624b7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377485, "uuid": "8dfe4628-f5c9-492a-b768-d95177d15b28", "comment": "Malware payload (Gafgyt)", "value": "59ab9c409f0d20a30d817f382c35d58b559d5a668e568695e8205775800504fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377485, "uuid": "b60672fa-3922-413b-abc4-8b348e8c369b", "comment": "Malware payload (Gafgyt)", "value": "55ed9d21c7ec7f6bbcec120daf5711e029522cf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377485, "uuid": "f6d91688-1bd2-4926-a2be-54ca8e676f22", "comment": "Malware payload (Gafgyt)", "value": "d8b49ea0679aa1fc34e217e7c2cfe68ae20e7702b39ad13c5241f01f6a9e56dab09338fec384fb206c0c147e1f103a3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377485, "uuid": "defa40f2-746f-4402-89ed-34466a5db638", "value": "T14FA31892F800EFA7F40A977208D34B25B670BBE50E53562273177AA6AE761D43C23F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377485, "uuid": "f4c12411-b758-4ef9-bd23-1e74014b382e", "value": "3072:sM8YtyyqH5oAyIOp+bmSQR+duvmmVVqDrI8fz1e:sM8YtyyEyI5j3duvmmVVqDrI8fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377485, "uuid": "4a9ea1b9-bcc3-434e-82ee-b5821fc7ba18", "value": 104274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377485, "uuid": "1cbc2005-0dc3-4c3d-912b-c6417d728062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377485, "uuid": "007a165c-2d9d-493d-bb8f-fcbed396ff05", "value": "7b363fe271e984c95e667400ba624b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe25b7d-d248-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652396856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396856, "uuid": "08e6a55f-04b1-4fc7-85dd-4d008f5f412f", "comment": "Malware payload", "value": "caede0591a51fe4803d25285f1762e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396856, "uuid": "6e7840d9-71c5-4e36-9435-c2dddca3e1f0", "comment": "Malware payload", "value": "59fda32a10199c04798ab66ca2a75ba73cf1309858e34429bb281548d89b7a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396856, "uuid": "847eb97e-53a1-4c2a-8b25-628bba74ff58", "comment": "Malware payload", "value": "fc40c3f4277bec27d845028bf206bc7e57fa3dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396856, "uuid": "cfd12357-1a4a-417f-a203-a9a314951cc1", "comment": "Malware payload", "value": "5fdabc64051e81c50469e09340950c75ababc1d1033118060c4845e44c027b203a50473b471d06adf7c17efaefced1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396856, "uuid": "200243d2-fd13-4fbf-a419-1fc05e8d2171", "value": "T19CE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396856, "uuid": "1daf52eb-5543-43cb-99e6-95a3aa06c4af", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396856, "uuid": "418ea0a7-f20b-49bd-834d-58034eba05e5", "value": "6144:mkajLyaPIvW1TFpvzYNB1MHB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN886nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652396856, "uuid": "6a9ef11e-417c-4904-b924-a5661c08cc91", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652396856, "uuid": "27db0d62-1104-4669-b3e5-049ba672b3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396856, "uuid": "2c6c1ee6-466d-4d2f-be9b-710a6a82fec9", "value": "caede0591a51fe4803d25285f1762e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb5feef-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363596, "uuid": "801ee15a-d43e-4fa9-86ec-bc4797bd51b3", "comment": "Malware payload", "value": "8e918fbadf1615beca76c1fa11449c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363596, "uuid": "ba75c58d-5578-467b-9f82-f082134c14a8", "comment": "Malware payload", "value": "5b2ead800dd3b04273765dbc68ce21a21bba84f1f91f2ca3ed48a93a1288ee9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363596, "uuid": "594142d1-e5d4-4838-9815-21bb018966cb", "comment": "Malware payload", "value": "cac988d540ce79ec9ca08c93f6bc8c1163675eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363596, "uuid": "1633aa9c-b150-4a75-a65b-2b83c673607c", "comment": "Malware payload", "value": "dd1c85d3c7ce024b406ccd6ba68ab29ebed41523e9082f49cb100edc6a662e0118976320e398fe53727095419999789d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363596, "uuid": "f955956d-7d4f-46a4-8636-7115558284fe", "value": "T184934CAE9DC55CE0D39E83F1AFF2443FD627D6218EC60A1611AC47248F55F2CCA0AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363596, "uuid": "c613a534-5fe2-4a40-8738-447bb825ae75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363596, "uuid": "a3301352-dc29-4093-b48e-b3c439ae5ac8", "value": "1536:v6oDMmNLAd5iqiemuXC8BZtlBTSCVpc/dFPg+7Y:v6oPL8cRuXCGZtlhQhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363596, "uuid": "1a45e4ac-6349-4a35-bcc7-33a33a74c17c", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363596, "uuid": "e0c642db-c2d0-42f2-9038-4c136ef6e7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363596, "uuid": "54567197-be16-421c-aad0-f8997982ba52", "value": "5b2ead800dd3b04273765dbc68ce21a21bba84f1f91f2ca3ed48a93a1288ee9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35366809-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330239, "uuid": "3325614e-4ea8-43cb-9bcf-04b6beff0df8", "comment": "Malware payload (Mirai)", "value": "a83871211e33b4f7da937a00005f1070", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330239, "uuid": "8c80f9fb-778a-4843-a6fe-dc5114924496", "comment": "Malware payload (Mirai)", "value": "5b5621240c4f541be1ef37e5c7d69f737e0ca98fbbb74900e1418be4dd6ba33d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330239, "uuid": "b1b85eae-fd00-4813-9d3d-0f0ce7834f8f", "comment": "Malware payload (Mirai)", "value": "221de7d881ee057774904fe01361c6d56a346492", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330239, "uuid": "c0e66229-5a62-49aa-a63a-8af0663f8212", "comment": "Malware payload (Mirai)", "value": "61d2e3766e61272c879f2e49f3acd991c513ce565bfbd6e6102e6440b59f90cb9c17f2ace55783784458eba69b45d770", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330239, "uuid": "2b2a389c-36c9-4f9a-bb96-8b5802a44217", "value": "T13AB36C52B70D0747D2232EF03E3757E293AB5DC132E8E2897A0DEE0592B5931954AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330239, "uuid": "be6fa5c7-f071-4c91-9d3f-a5a5d0e22726", "value": "1536:2feaRYh+dvIGWqAbx3KbEaJPDT3ryBPOo9qO7ivpjWmvuQv8Era9tE99GV3:gY1C236DT7yB7cvp4ErNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330239, "uuid": "9ab6cfdc-a0aa-40d3-b3fe-257de498b2e3", "value": 111472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330239, "uuid": "ba9b1f1d-aac1-4ba1-9671-f93af682af55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330239, "uuid": "b896c671-6f8e-4290-952c-63a8384de59c", "value": "enemybotppc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1b86da-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (FFDroider)", "timestamp": 1652337928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337928, "uuid": "472fdd12-03bf-4e62-b120-701c1cf5d8ec", "comment": "Malware payload (FFDroider)", "value": "5c21cca8d79a5c46f7f1bd78b222c47a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337928, "uuid": "6477c02e-5b22-4915-acae-70e918a59aa2", "comment": "Malware payload (FFDroider)", "value": "5b60d2cb0b63bcd9c7df5873496d119de3f5364ba6eeea8548f20b2940a73ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337928, "uuid": "13c15083-9866-4ac8-a20f-9f3eebbefc7f", "comment": "Malware payload (FFDroider)", "value": "bd249dea8ceb0a4bde6ee336ed2063696b821767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337928, "uuid": "4e33cf16-c32d-411c-804e-af60a27b7e45", "comment": "Malware payload (FFDroider)", "value": "afd828279077c11c17b54298eb568d9cd47810deac4d77d4cd58a13c2f0f5c415e5d290a61c2fca0647d4272de95e385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337928, "uuid": "480236a9-bedd-48da-b0e8-cba91273676d", "value": "T1691602B07B85D861F17306334D92D2D8956DFC747E62C2AF76D9234E1DB22A0AE36132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337928, "uuid": "e070bef3-5e86-497e-a5d1-08bd1ac2a942", "value": "0fe7c747747cdd5cce39f3b09e435ca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337928, "uuid": "df9b1447-3eb0-4f99-8b20-2c315d86424f", "value": "98304:o6u5/mdsfAg6zsMn+NPOU3tLkBQ7iIxA7LXOJxiZhvINou0d+2:oJndtLkhZhKou0s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337928, "uuid": "01c8807b-2764-434c-8f97-45b1a11b8a8c", "value": 4068352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337928, "uuid": "08751c27-a19b-4f53-9e28-059c5ba78272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337928, "uuid": "7810099e-15aa-4b5f-b562-ea3a15282ed9", "value": "5c21cca8d79a5c46f7f1bd78b222c47a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3d3b01-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652363402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363402, "uuid": "c410ce57-f73b-469a-8d77-1586deb3dcfb", "comment": "Malware payload (Mirai)", "value": "ea288b9d9d662636ec8e78e252d75616", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363402, "uuid": "d963f84f-28e9-4047-b787-9ed71056b0be", "comment": "Malware payload (Mirai)", "value": "5c1570aab64467551f0a155f1d80c766499b70b5a4414054eb96de0eed0105ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363402, "uuid": "7bf1dbf5-935d-4470-b54d-51a62dd292af", "comment": "Malware payload (Mirai)", "value": "bb3d72e325d2f9509069d069c3ac8d32e7285c02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363402, "uuid": "a2608d36-4746-4527-9f54-4877b26c294b", "comment": "Malware payload (Mirai)", "value": "3d741538522d48c8b3554a14bbe65e844daccf5cc98d8bb9ca1ab15d2b52686b83f314088e043fff4300e736738e9885", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363402, "uuid": "45dfb992-0d71-4fae-8d87-f13d4cb32432", "value": "T1CAD2D1F3C0ED9626D0BE52749EAE7F2D5098920D24642DF6964AB019199BFFB1F143C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363402, "uuid": "3aa75a2f-bbf0-494a-a006-5d5ccdb5f271", "value": "768:TQENQRQHq2ObpDiu481X2Wd0+7HULconbcuyD7UGQRj9z:TQ0iQH981mWy+7Kconouy8GyRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363402, "uuid": "e6aa8227-a19f-4d9b-a10d-a32252a96ffd", "value": 30748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363402, "uuid": "5c4e040d-0781-47f1-8a4f-99e363ed26aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363402, "uuid": "25fd4f88-f4fd-4750-b936-4416e41431c1", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcd027e-d1fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365073, "uuid": "fd6d27ad-455d-4408-98bb-d1d3e4bf6d8c", "comment": "Malware payload (Mirai)", "value": "6031d83549fcc427122d146b89fe67e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365073, "uuid": "f4d7b2c9-5326-44f1-8ed8-93646abca354", "comment": "Malware payload (Mirai)", "value": "5cbb9eec6b9f5b97a021a5855d71ff807a3079c9ef475ee8fd129ee07f80d46e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365073, "uuid": "bb32f512-fac9-4499-a75f-77d39030917e", "comment": "Malware payload (Mirai)", "value": "e0eeae8fa78a0ef2638086bc361efecea71530f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365073, "uuid": "1cbb3162-43ba-4c67-8a36-12e94b9d963a", "comment": "Malware payload (Mirai)", "value": "a02096248c2ae40a98de2f232e0dc992732424d44799284308c5749725bc3ea58456590cefd3aa9abf29d751910f5d3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365073, "uuid": "cdc78477-fa39-4cd6-a15d-451b7138919b", "value": "T163D2E1603EFA6574D52006BC75B4F84963160B38D1CEA37641AC0ED886DF05A9AFA39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365073, "uuid": "82988475-a571-4491-9250-db80ff045ca0", "value": "384:vsF83qquAYIr6TPJC42LVkr6NfTmKfsO/M4UANrDDii5TcoGrRXVI5saobRhymdB:vdaqu5wBrE4UA9DTZmRosaobRs3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365073, "uuid": "3fd12f32-bc3f-420f-b5e8-6d0139994093", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365073, "uuid": "9f89132a-0445-4520-9757-8fd907da774c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365073, "uuid": "480fcf5a-3b99-4215-b994-e50ff9824bae", "value": "6031d83549fcc427122d146b89fe67e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcce450b-d242-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652394461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394461, "uuid": "87e90ab6-dce0-430a-87de-3bfdbb265873", "comment": "Malware payload (Heodo)", "value": "61a0b499a5faac9bb3bf4dcde857c0cc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394461, "uuid": "1707802f-b83b-43bb-bdd0-3d4740a61674", "comment": "Malware payload (Heodo)", "value": "5d5f9fed30c457828d51f4a2fe528773c6cbd4ed15fc7500429a659c29be4b5c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394461, "uuid": "ea09a10b-5e8a-4214-94d0-6a4676afa45a", "comment": "Malware payload (Heodo)", "value": "85d3fae509e54402f22fe788292a817b7dcf714d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652394461, "uuid": "3c9a18dc-edce-4c7c-a7fd-758ef1132f67", "comment": "Malware payload (Heodo)", "value": "df40a92cc75aa253983bf9f8c3e1436f0748ddd24048ac7705bb01ea0c20e7adddc897cd69bea3e7338009cc8f428859", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394461, "uuid": "78400d2d-7bc2-4914-aa68-e6aeed7471d8", "value": "T1F1E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394461, "uuid": "c701a561-362e-4f48-aeeb-31fbb393e613", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394461, "uuid": "826b23d0-fae2-49ea-863f-2aaa03bb334e", "value": "6144:mkajLyaPIvW1TFpvzYNB1MHB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8w6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652394461, "uuid": "0d7956e0-7ffb-4caf-afd3-59b9235b2fc5", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652394461, "uuid": "afbcaf89-8eb9-4a33-9042-ee4d3bc73f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652394461, "uuid": "0fcf13ed-c671-4663-938b-1e54f1502b25", "value": "61a0b499a5faac9bb3bf4dcde857c0cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c720b6-d1e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652354015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354015, "uuid": "484fcddb-881d-4817-a890-6857acb6b02c", "comment": "Malware payload (Heodo)", "value": "c55b1faf9b3f66cbcffffa576a086010", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354015, "uuid": "74625333-120a-4451-b187-b5539a4eaeb1", "comment": "Malware payload (Heodo)", "value": "5ddeef575950ddc6f148e0763177908edbbfc6a5e196571bc599c0e2f1e4fa14", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354015, "uuid": "17134152-7170-4612-aa9f-760436f9a942", "comment": "Malware payload (Heodo)", "value": "6e9c1927b1e0e673429cdd0ccb5f74bd9a8476cb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354015, "uuid": "71bef758-548b-4a7e-8c6e-31dcb81b956f", "comment": "Malware payload (Heodo)", "value": "6ab13b33873bef87755a4c4e163d962c592a0f1d4bf87cec017abb218a6ebe88cc37dadbc1ddfe4cce79514e19a1d57f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354015, "uuid": "789b6400-4cc9-42dd-8e8d-6daa25968271", "value": "T148F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354015, "uuid": "44cc664a-f721-4011-9f76-2bd1a17aeab8", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354015, "uuid": "098940ee-99fc-4e88-aad5-6c7cdf1542e7", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSOjNwgraKRT61cKGNx:S4DzZKnH4bRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652354015, "uuid": "6211001b-2b25-443c-81d4-c106a1f49297", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652354015, "uuid": "19bb7474-6ef1-42f2-9fb1-63ab0b60e18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354015, "uuid": "3dd27a83-a37b-49d4-b983-cf798ec8e311", "value": "YvRbA7BbgyK3mbUdnVZbsGyWeOIKF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1319048e-d228-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652383010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383010, "uuid": "9bbf6977-a05a-42fc-af1b-0567c8455753", "comment": "Malware payload", "value": "9b2841db46d32072eae9ee990cc634c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383010, "uuid": "fc7221a4-3784-41d7-be70-635efce6d61e", "comment": "Malware payload", "value": "5de69b3fbb5fae5d1c1e0f6bf66eec6bb0f88eb69a91871d3d0b26d6185db6f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383010, "uuid": "3fc411d9-3a73-4aae-b649-7dab0479ced7", "comment": "Malware payload", "value": "26a95011183c5ed4848d1973a052e192fe35f614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383010, "uuid": "6a714e2b-0990-45c0-bde6-12875a354d12", "comment": "Malware payload", "value": "ff1cd7d2b46fe65c0cf3cdd70c13064315e764fb448d25a59f67e462caafa86a686867d61d34b1ddd56895735c908f88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383010, "uuid": "1f7a2a70-cf28-4621-b905-fa93f1dd15ad", "value": "T102F4739C726871DFC85BC276DAA81C68EA90757F931F4103A02715AD9A1CAC7EF148F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383010, "uuid": "a92e1950-55e2-4d23-a67d-eafef64e43af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383010, "uuid": "a173149f-b58b-47ce-a382-22ace1e4befb", "value": "12288:JHEzHlsOkKc2VeEDZOFd7otMih7iZkHt522agGYpYllRX+zRpZ33qUzvFP5N7STz:QsKcieE434u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383010, "uuid": "f4ec2a67-7e46-4e35-a2a1-bae7bd29a496", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383010, "uuid": "9d22b81e-8897-4d08-ba2b-3bab94a2c5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383010, "uuid": "0a98f6f4-f011-4497-8398-85d8f0c97848", "value": "9b2841db46d32072eae9ee990cc634c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c4c441-d241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652393973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393973, "uuid": "84963076-8871-4e4d-b5f0-847d9b532393", "comment": "Malware payload (Heodo)", "value": "311e5e0017ac91bd23c3064f410641b6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393973, "uuid": "313673d8-4387-4376-b1a5-b627845fc784", "comment": "Malware payload (Heodo)", "value": "5def02735f8fee891efa973f32bb345b148f8725346abbf34d2ee240fb71c56d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393973, "uuid": "2b66a03e-12c8-402f-934c-704f01ec9366", "comment": "Malware payload (Heodo)", "value": "41f2c924d00e878ab958bfb7d52770ace30caa5a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393973, "uuid": "c2165560-dc6a-4f2f-b8e2-479ac49be681", "comment": "Malware payload (Heodo)", "value": "95a19b051f8080aa451ff675e5948299bae1c9bdddea48d4c0d422c16a45bcf8e323b2c2a0c72c6e1f4a81008d6d5f0a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393973, "uuid": "3cc585da-1a2b-4fe7-acb7-3bf206ce1821", "value": "T13BE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393973, "uuid": "577e18eb-3767-4750-8f20-fcad3d6df27d", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393973, "uuid": "bac19da3-4f81-42d8-9e3f-26428186d9d0", "value": "6144:mkajLyaPIvW1TFpvzYNB1MxB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8S6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393973, "uuid": "361ad41e-291a-483a-b87c-ae26e448dbfc", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393973, "uuid": "448c8dbe-4c66-49bd-965f-bcd131d7f484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393973, "uuid": "30c13079-36af-45f5-bc4e-83fd6dcb372e", "value": "311e5e0017ac91bd23c3064f410641b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301d0817-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330230, "uuid": "1f40602a-8a71-4d0a-8450-ac72ae75ea2b", "comment": "Malware payload (Mirai)", "value": "58b1f25c7e239a810efa3e47e23eb7fd", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330230, "uuid": "05e6fd42-758c-4ee5-892f-e2df938b71db", "comment": "Malware payload (Mirai)", "value": "5e466a9ae582b87991946217cb566ce87f4b81215f78f07880ec37f1da83ac95", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330230, "uuid": "3289fb6a-f6d2-4dd3-aae0-0fc5f5b30238", "comment": "Malware payload (Mirai)", "value": "7aae823b8088100fa97b8d7dd24172948006f033", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330230, "uuid": "f4301f73-9874-45fe-93b1-e2934808f4cf", "comment": "Malware payload (Mirai)", "value": "d3913ca723a8b59557ffb60f0678fbf8233f0c9451390b9dd85a6bf3aaa56d186cc9869a17faa73b7d77cb643ab99ae1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330230, "uuid": "c50a4be9-f640-49a9-a34c-b938227c0efe", "value": "T1A9B33B9AFD81DA13C6C216BBFB1E428D372643A8E3DE7103ED291F21368B55E0E27151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330230, "uuid": "c09b8086-8ae5-4caa-ba11-ed21a6056a14", "value": "1536:qauGU/0cFLV2bSa8uBrrW6vGoqEs+EbpUAkWbSyCJwe5BgiffO3KXCWME4tE99T8:puCcFLVcrSoqHq+SLye5eiv5MQfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330230, "uuid": "2eeb81b4-3f16-4bb2-ac4b-29617139e191", "value": 109940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330230, "uuid": "25089cfa-ccf8-4278-94c6-1b7c7368630b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330230, "uuid": "e8e2a425-00dc-4240-bdaa-0dd24ad20555", "value": "enemybotarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16f56ff-d1e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hive)", "timestamp": 1652354096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354096, "uuid": "962ad5e9-60cc-485a-b9ec-d2b5b487c435", "comment": "Malware payload (Hive)", "value": "0ad93a96179c6fbcec12a5849ffbc5bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354096, "uuid": "f28128b5-9ffe-4020-8fc1-a68dd48c9389", "comment": "Malware payload (Hive)", "value": "5e6c5a9fda2d20125f6f24e37e8a217a39ff0a5cfddc07ddfdb18049d9ea4597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354096, "uuid": "6caf734b-c24b-4771-8bdc-e6db52a0be0e", "comment": "Malware payload (Hive)", "value": "c479683fde7a6737a6f7d72a043167f3a42296e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354096, "uuid": "02c81bc7-eb96-415e-9973-2d5bb2af383b", "comment": "Malware payload (Hive)", "value": "c16025a16710faad739ef9eb888fda30f91c1e8554ea91d5b6e84e04f357a63063252bcb893b7f0cb0879fe3f38f483c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "NerbianRAT", "colour": "#03A6BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354096, "uuid": "28111778-d893-4c15-95aa-451e091131d0", "value": "T15FA6BE47F85150E9F0AED230CA669262BA317894473023D32F50EBB62F76BC46F79356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354096, "uuid": "c92c02e4-b47b-4ffc-a9c3-a3a87439a728", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354096, "uuid": "0033fb3b-ab77-495e-90f1-282bf32610f9", "value": "98304:fk8ic3+bMyjx+MEDSpEbfPS8tIOIc6K9JtjCvf0hK6NHCGyex:fuFbEX16AI3KNcex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652354096, "uuid": "f0fd4d2c-c938-4be7-b20d-819a81b5a539", "value": 9607168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652354096, "uuid": "70a2a1df-384f-4d46-939f-5a72f5738c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354096, "uuid": "f3f8ab19-3b5a-43a8-b9de-202eafd0436c", "value": "5e6c5a9fda2d20125f6f24e37e8a217a39ff0a5cfddc07ddfdb18049d9ea4597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955b626c-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340708, "uuid": "244a5489-2759-46ff-92c9-7e5ab6ffc4ae", "comment": "Malware payload (Formbook)", "value": "a6481e8a071be497473fd37fdabe8d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340708, "uuid": "ed1ce3c3-7da5-4f9d-b39c-32ba770d3f84", "comment": "Malware payload (Formbook)", "value": "5e9aba7aa4cb5b012889435a0bdaf3ac311ff6c7545b5c156f7c3cd3e3510f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340708, "uuid": "58ced362-7cad-4847-8b52-3848fbe51567", "comment": "Malware payload (Formbook)", "value": "64ca16d365f80e529446583a8900b7b28d356487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340708, "uuid": "dd55638a-9868-49b2-895a-602a3a65495e", "comment": "Malware payload (Formbook)", "value": "00846ff30feb78afee40b5f1bbf76036da5c027a20a6abc94080c91a89e37c7fb45bac37ff1b6eee09b3edd302ff7acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340708, "uuid": "1b70ee9b-ff5f-4b33-8d99-f08d774e0271", "value": "T1A64412016390E8E3F42216329D32AB129FF98926A8F1874747107A59FD346D31BDFA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340708, "uuid": "e8399691-d9a4-4431-932c-8001d888ea33", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340708, "uuid": "7b954dcc-2246-4baf-976d-2b124773ff8a", "value": "6144:LOtIOaQ4mqaLdIyVopyt9MgHKWZQ9kNXBUpjHnSGLL/H4JYUxDHBk:LOLah7aGyVopFgqWZQ6NXmRnSGXvyx9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340708, "uuid": "4ef95d14-eee5-4811-9192-667a30731450", "value": 259569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340708, "uuid": "43d13d3f-6dab-40e5-940f-27c1c18d0514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340708, "uuid": "e4e06eaa-9ee0-4f21-8b6a-43ae9968b1d7", "value": "a6481e8a071be497473fd37fdabe8d83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e9585d-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652363602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363602, "uuid": "43f5debf-2f24-4b8c-be51-d27b2d530d96", "comment": "Malware payload (Growtopia)", "value": "57580017d8fb4885a3cadfda9a868762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363602, "uuid": "01641498-a478-430d-b5ef-87ded4f85064", "comment": "Malware payload (Growtopia)", "value": "5eb236c9789e71cd140f93022f488535a71bddf56e48cf94849d16e22b1df6f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363602, "uuid": "e5dd76ff-d45b-436c-84e1-f63c3f93fe56", "comment": "Malware payload (Growtopia)", "value": "d10d0ecd8361a3c73cd5a8fb802207e820102e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363602, "uuid": "da6d1167-9d2a-4fd3-aa9d-caa81f3c3a87", "comment": "Malware payload (Growtopia)", "value": "3c185df2fef6d99a98a59682f0a2195d1f68ce79b3c049c5f8904ef2961318642fdf063c9c6e18dcaba006120b2f93b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363602, "uuid": "e6997336-fefc-4f54-92ed-92c2932e214f", "value": "T116520815B7E44236DABE87BA0CB28B248335E5C26526DF5F2CC8119D1C367534DA2FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363602, "uuid": "839656f5-2cf5-4421-ab62-3b1fda454bad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363602, "uuid": "57906f01-064f-479d-b8a9-07bbbbc0d151", "value": "192:9HVc6DceNF5YzRD09mwhasD9gKYHrIcQK3/xK36WO:91cAcmYzlA1hac91YLIcTPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363602, "uuid": "0285698b-17af-49b6-9666-3a941a670623", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363602, "uuid": "446a7312-106f-4682-8b22-7d5a3ec6bec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363602, "uuid": "54e70c18-2757-4c52-ba39-6d1352962830", "value": "5eb236c9789e71cd140f93022f488535a71bddf56e48cf94849d16e22b1df6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414b3c17-d21d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652378363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378363, "uuid": "66f1c87b-6dad-4950-a8b9-d567e213a24c", "comment": "Malware payload (Heodo)", "value": "c6ab481ed8ab39753b588c7d250b4d78", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378363, "uuid": "7a0fb8ad-9992-49a6-b458-81882827c097", "comment": "Malware payload (Heodo)", "value": "5ee3994fd10eb6f4563d60bdf56b686bbf2628052c1d603d76913e7de18a4761", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378363, "uuid": "8416b21d-66aa-499e-9b72-1d05fb839a8a", "comment": "Malware payload (Heodo)", "value": "2cab0e23f1c1913eaa5e287a253016e7fb65c3ef", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378363, "uuid": "7a903ecc-f735-4fe0-bc01-39423d657e71", "comment": "Malware payload (Heodo)", "value": "a2590f2d7de6eaeaf35694eb4fec7648ca8ca2d70b17be3371b4bec941f20af79a0b0ebe412977490fc114ff676092a9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378363, "uuid": "a8da06ac-85e9-44da-8946-44c3478452c5", "value": "T13C51AF383DEA5229E5B3DFB169E87696DD9FB6737802499F0082070B4811600EED1D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378363, "uuid": "1f9f0619-57e6-4967-9618-48df3da32432", "value": "48:8mvAPCVWbXjN07z1xEPYF0utpUP0mJMzqX8dlzA2X9stWHM4ab:8mvX0bRIBKYFlaPvMzKS02X9vHM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652378363, "uuid": "f2c534bf-0a1e-4b3f-a531-2c250b1e84ae", "value": 2602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652378363, "uuid": "e1e33db9-6567-48f2-8220-225b41c1e231", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378363, "uuid": "2180697d-ee8c-45bd-8497-cdc98336ab7f", "value": "EPI.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d5d96c-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379396, "uuid": "6af228c2-f576-4955-946a-7fe2c0dd8c42", "comment": "Malware payload", "value": "e3b3c1da4b16ced1cc2e9516a814fb44", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379396, "uuid": "b61554d8-51d0-477f-a81f-a0aa120f1ac7", "comment": "Malware payload", "value": "5f394a72079c59fcaf4d91d755b81c1e4b166d75e6f8c619f9a7ac22dd647199", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379396, "uuid": "20205cb6-d566-4f89-8ac4-1dfc769b0176", "comment": "Malware payload", "value": "256ff34b01fe50392b1aea34774703e8c70ffff3", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379396, "uuid": "272ffff2-ef78-4964-9305-c8d27bf08562", "comment": "Malware payload", "value": "6810156c680d5701afcdc17e4755b44d734af0d87caf427a27e5af8e9328c391c024e83bf740d15d47c473b970e146ef", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379396, "uuid": "b9af9cec-b9fc-4800-b6ed-3c00e18c72ef", "value": "T18692F5DB26E96DC5EC163A35397E86043A24EC8849355D02628872DF8FF75D13B203FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379396, "uuid": "243abaa0-ab64-4469-a236-a403d34607b9", "value": "384:MLM555555555555555555555555555ZTwm555555555555555555555555557pF5:Mw555555555555555555555555555amh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379396, "uuid": "9406ec2a-3317-4228-8620-9331da58228c", "value": 20840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379396, "uuid": "ae338355-0a9d-4fc1-aaa0-e21cab8f84cf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379396, "uuid": "9484a560-f4b9-4087-bfce-bc8a08e6e0e0", "value": "Invoice-Transfer Details 12052022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5795d1e-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652379390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379390, "uuid": "5a44b768-19bd-4d6f-b09f-edc3dcc794c9", "comment": "Malware payload (AgentTesla)", "value": "0af51765c84420ae1728d399dfc5a5e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379390, "uuid": "b9a00c9f-6957-416a-bb10-56506556f3b0", "comment": "Malware payload (AgentTesla)", "value": "5fe1fadcb6c40bb99ad77045fef68d3f0d040395958d9759378d0befde91f5d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379390, "uuid": "7403d808-fa05-44c2-bd03-cd4cedbd5d7f", "comment": "Malware payload (AgentTesla)", "value": "f65052fb8c0a27e31d415d0f21504462b51a01f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379390, "uuid": "c641a373-36f8-412d-83be-8be0392526a4", "comment": "Malware payload (AgentTesla)", "value": "8f9731a06ebc020b2cef2b8c7bab678c99f35aa65cccb7252db8e395d4c2479f98677566de633fc8b02265cafd13625a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379390, "uuid": "96e21c29-242f-4494-840b-7a0d0c5c00fc", "value": "T16104123AFBD5415ACA613372461FDC646A3DEC9EC9E706D0A680B5B817B38E054363E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379390, "uuid": "f6281549-0e83-4a6a-9127-18895d0a87b2", "value": "3072:rl0mqX33fjM77umfDgqWpSK4T51OmNt8BzBuEkVEkVoiji3:p0mqXaumfDx2b4T5LteuFER3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379390, "uuid": "ad5a4c72-ab52-4f55-b6a4-99a5122bae7b", "value": 188248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379390, "uuid": "8067dee2-c4c9-4720-9feb-1157e765856e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379390, "uuid": "657979b0-e27e-44cb-ba9f-98d90915e14b", "value": "Order_List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33abc25-d1de-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652351603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351603, "uuid": "d0177efb-7e4d-44b9-9349-518df669958f", "comment": "Malware payload (AgentTesla)", "value": "731cf746a56c9a198cdb198679ed6311", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351603, "uuid": "2456965f-7754-4f69-9b10-f7f9826748fe", "comment": "Malware payload (AgentTesla)", "value": "60207148ad8dc1c3de32439255a241321d4f3da64c82990e871edf28e3eca804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351603, "uuid": "b23d45ca-682b-4fb1-8757-7313a70bcdd9", "comment": "Malware payload (AgentTesla)", "value": "97a4ee3724c97fd226a545663451a35e02bc35a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351603, "uuid": "cde24cff-b4d5-4acc-9589-0bf0206b657d", "comment": "Malware payload (AgentTesla)", "value": "d36bfc7535b7acac4a71f2a246c0bd8b8d265d897fdd3d033c915a36530434c91e0087ca416e987f5d81f005b31a112e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351603, "uuid": "8ea42591-f485-4ab6-82d8-f7276faf1761", "value": "T13AC41209BA57A622D08D4F77ECE410DC0376AF4ACD13DA9B1A9931CD46333D64AE2B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351603, "uuid": "aab2e7e1-84a6-4d76-a4b2-ae3f9ef6ab34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351603, "uuid": "0e2b9a84-0279-44eb-ac3e-70a7f53d68e8", "value": "12288:QiK0DYOkXFwQ/38WmMketoxzEsVUk7bW68Uq50/JMZCpygVzT3b:cXWQP8WV2h2WoUdRQaycT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652351603, "uuid": "079deb11-98ad-493b-a2f2-21c36d350000", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652351603, "uuid": "987f3035-b472-487e-9571-0984e0da46ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351603, "uuid": "e7621c58-74b3-453d-a526-dacee06a0b2b", "value": "Quote.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2597e4d9-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337085, "uuid": "9abc7a3c-1a6b-4589-8482-079d4d347f31", "comment": "Malware payload (SnakeKeylogger)", "value": "7b951c643159f9898a13d72490b92b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337085, "uuid": "f0bb60ba-0265-4df4-8ac2-801f03d680cc", "comment": "Malware payload (SnakeKeylogger)", "value": "6030c4836fae1877dd0b6906d812a0db5bf9901e6eb9c0a6a6a3f7b35f59a2ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337085, "uuid": "c47cb098-436b-4626-9718-0a7c5f6de437", "comment": "Malware payload (SnakeKeylogger)", "value": "fc9f7cdcc881f51c8688d4c6bee9ee357e8fdd8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337085, "uuid": "cf871689-baff-4a95-a70d-33c529b720bf", "comment": "Malware payload (SnakeKeylogger)", "value": "ed91284979a229010b25843904e576f353b59a1d59ad46bf176bf4105311034238e909aab03193f4998eccf0532f22d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337085, "uuid": "3772dd5f-5585-42ba-a1c9-33e68edb9faa", "value": "T1733518987254F9DEC857D071CA685CF0AA207C6AC31B820B50173E9EB97D683DF219B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337085, "uuid": "63df01f0-c861-4c75-9718-5b4bf20ae17b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337085, "uuid": "66c1d6e0-5aa5-4705-bf36-7ac2bbb9fcb0", "value": "12288:dqiSfxt7J0ZpQoh95lW9uMGEXvWTERlLIebrWJTQ8fthpBgT+Id0tAeEjielX7FL:8r2Zp51lcgszLISI8Ttik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337085, "uuid": "cb0d0480-f803-442c-9fee-12e856e8cec8", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337085, "uuid": "7dfc623b-6a9d-4362-8542-85980cd3b7e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337085, "uuid": "d7415854-bdca-45ee-a9b7-0bfc02cbe174", "value": "Scanneddoc002pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4ad7ed-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338784, "uuid": "459f69d1-8285-4c47-b47a-54489ffd7380", "comment": "Malware payload (Loki)", "value": "7b10c9a7011cd20420dca7c2ac7495f7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338784, "uuid": "621e44ac-19c1-4ff1-9f3f-cd561c9fa177", "comment": "Malware payload (Loki)", "value": "6065bf5bd4ab9595d154930599667d323f2a5e620f674642394e92b3da53a150", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338784, "uuid": "5045f2de-3458-4735-b973-69a5cfb9e09b", "comment": "Malware payload (Loki)", "value": "42e57dc7f125fe9b6d4fca5cc6918df684992435", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338784, "uuid": "e5eccf77-33e6-4b8e-bbb7-c0261c4ac2c5", "comment": "Malware payload (Loki)", "value": "28e984644f71c8160d7cc7a22db0c6473027c24a4642f93cfaeaa1de169655847c8d2e4721178adb043dd2adb47adff8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338784, "uuid": "101d3a8d-118b-4653-a0f3-6e4736ddf328", "value": "T119D312F43340C0AAD6F12EB2E6B5D04887D9DC196D72E34E64D5371BE6B0CE235D2560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338784, "uuid": "29b30227-e130-4f7a-a97b-e6304add0ac2", "value": "3072:SQsKCm+ruJQZqamMEUuCNEcMLstDRaxk/Y86:CKC7ruyMamRgNEHLWRaxc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338784, "uuid": "4e615eeb-8a69-4e7d-af2a-8ab99db36241", "value": 134760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338784, "uuid": "1cc58200-cc1f-44a5-a29f-15ddbe79c701", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338784, "uuid": "0b495bd4-496e-417e-a9a9-a63f48db0ddd", "value": "shipping doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821669f7-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340676, "uuid": "d8dcda49-4ae3-447f-9378-702c1af15c4f", "comment": "Malware payload (Loki)", "value": "943a92b0b61eec9be60863ae6848f2b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340676, "uuid": "43ba5c14-13e4-4d19-a827-6914ece6064d", "comment": "Malware payload (Loki)", "value": "60e7b7da05ecbd0f5badda6f55ddd865c73453b620067a0dbfc4e7cc76caf416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340676, "uuid": "7688381a-2368-4e59-93d6-7beaaf3af71b", "comment": "Malware payload (Loki)", "value": "42076d3cae711e804795fc4e5852e8f1dd9fd934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340676, "uuid": "a55f9bd1-4764-4bd7-867d-7b1b6f34ed26", "comment": "Malware payload (Loki)", "value": "5cc44acfb36881f4233854b7dc9de770f4c54b7f5d1f1fd7800da2f3cffa2b1ca44b880aa50ecfaf2858c67f898acd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340676, "uuid": "8719f591-88b3-4a54-83aa-0a415b11ecbb", "value": "T1E2041250A2A0D477E8F24B325D3397374FC9D51594728B2F1B803ACEBE62951A71FB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340676, "uuid": "205ab717-68fc-4e58-9253-8294d26ecaa6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340676, "uuid": "f295357c-1ab9-4aee-9c51-caeb4d169b04", "value": "3072:LODZGPEounbNNVf6WGEByGqGMPrtBRETL8uZ0KBTpC3MtWtUhFk:LOtIOHVCgjkrt0T7NpqIML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340676, "uuid": "4c119a3f-44f3-44c0-ada6-32cb3aefb507", "value": 182378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340676, "uuid": "217fae4d-d197-449f-9a3f-d7561a66dd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340676, "uuid": "2804db5a-1e8a-49cd-a56c-5180688f760e", "value": "943a92b0b61eec9be60863ae6848f2b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf1beba-d212-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652373821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373821, "uuid": "a81355a2-b922-4294-88e1-005e3adcf781", "comment": "Malware payload (SilentBuilder)", "value": "9eee92b6bbaa6f671bde28f28b4ed808", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373821, "uuid": "09d6cc13-cce9-4250-8f61-db1be7970a65", "comment": "Malware payload (SilentBuilder)", "value": "61993811a28d20292c8a33605006aa1193c569ec88c651a404a8dd82b7301106", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373821, "uuid": "82717a3e-5274-48de-85b5-04ddb7219e72", "comment": "Malware payload (SilentBuilder)", "value": "8d2c633d986a4231795cfb2b3b8e13a2e690b4f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373821, "uuid": "bec7daad-b67f-4338-9d6f-a3b87767fa31", "comment": "Malware payload (SilentBuilder)", "value": "29db3464c37fe9780ed595af42cf27e9285e31847cb4864a54a17caf33f91686a19cb00af1cdd923794a02c1ff927f70", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373821, "uuid": "1ab846a6-ad53-4ccb-a53b-a10dc6c5a493", "value": "T1C203834ABA5A985DF925C73448E743E9B322FC105F6B0B873645B3A57FF49A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373821, "uuid": "f3d15c63-bfcd-4eaa-86b1-a005862ada27", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgA9CBn9kC+xbPcfmBqGOtwvcVoclE:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652373821, "uuid": "4d1f0c3d-2008-4db9-ba82-5cb1ac76b6e4", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652373821, "uuid": "f1ce4736-74a9-46f8-a97f-f5102ec7ac56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373821, "uuid": "75d93059-ed70-45bd-ae72-0e790a93c8dc", "value": "PO 2022-05-12_1207, United States.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf859c33-d1d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652345530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345530, "uuid": "fabb0b2c-c149-4a4c-b4ae-f54ad9657357", "comment": "Malware payload (AgentTesla)", "value": "58e50e85801850d8e571ac660b0f3aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345530, "uuid": "1ce2eb30-dd66-4ea5-8072-d4fc60d15d72", "comment": "Malware payload (AgentTesla)", "value": "6201b0b40a56becc8b7089416a38e27fd15c6e7829ba72117b0973333c18f1f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345530, "uuid": "b87fb53b-f54e-4c23-a54b-fb555a885297", "comment": "Malware payload (AgentTesla)", "value": "c06f78468722b1914742c11973ca825093b642fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345530, "uuid": "543fdfdf-f0fe-475b-9b4a-d07b717ba145", "comment": "Malware payload (AgentTesla)", "value": "eccd976ce2083ead3d4848e3845f30839cfdf4a9eab94a3939717accfae186e849877a61af2f7a580bd9ac1aebd201d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345530, "uuid": "145300c9-880d-475b-8f6f-c5aa5a968b3e", "value": "T123B4239C9B90B83E3320D9D31D944A8FA663A043F99A6FF253241B5D2F47150A71F3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345530, "uuid": "d53d50ce-d79c-4020-994b-c9a5f263a5f5", "value": "12288:RxTPsawGCy1Qg2i2Khnfpbzc+4Toe8CEyF0s7kok4FZi:/YawGz9bhfpbY+4k2LCo7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345530, "uuid": "e41cf845-2851-4cf8-aa52-39a9b3ebf336", "value": 526072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345530, "uuid": "69c91169-08c8-4cb6-8a37-8b2d29d367e8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345530, "uuid": "1a61dd2b-1923-4b56-8cbc-f7fba09857ad", "value": "TELEX BI 14226INS00075.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55045c3b-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652340600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340600, "uuid": "c8e433ae-3c1d-482f-ac3b-f41ecc70579e", "comment": "Malware payload (Smoke Loader)", "value": "dec80a3ef2682b0a170a327b0b03ae85", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340600, "uuid": "d4628b8e-e807-49dc-9dcf-46ef2ff8ccb0", "comment": "Malware payload (Smoke Loader)", "value": "620da880b98724ec56687fea9569efbbf73305ac6e921463d0649160f1ede244", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340600, "uuid": "ff043524-94ca-4f1c-b8cd-0a3c8a1c57c5", "comment": "Malware payload (Smoke Loader)", "value": "a4b202a7c0e207fb1ce117da492f619f2144b58f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340600, "uuid": "7aee0ac5-019c-4ce2-96ea-13b008621cfc", "comment": "Malware payload (Smoke Loader)", "value": "b5075201cbfb65c1a1a12e090e780e3bb4cd0bdeb715dc692823f443efe8cf235f5f7009cb1858ab70713085eac4537d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340600, "uuid": "5ed2f3f1-7538-4c40-a74c-8f7a485a1660", "value": "T1C3449E10BB90C035F1BB12F48576C3A8B92E7EE19B2451CB62D53AEE56356E0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340600, "uuid": "0738587c-db81-44bb-9ed5-577a9d18c55c", "value": "03d741c0997afad4183375be70028b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340600, "uuid": "6127e2e9-cacb-4fb7-81d0-bee66d177f2a", "value": "6144:ZoYicqr7Pz/0r6Q9V5eIPGCtIPfppxkZxDUM3fe+tGkDo:W3NjYuQ9V5eIPGZPrqPUMPe+tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340600, "uuid": "499650ad-2bed-4cfb-bad8-45c9f9f44f60", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340600, "uuid": "e81c8efc-51d0-478a-a159-2b124fb01cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340600, "uuid": "d4856eec-b430-406a-9c58-9c07a716a6c9", "value": "dec80a3ef2682b0a170a327b0b03ae85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae2ad4d-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652341066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341066, "uuid": "95da1785-9aea-4ed3-b818-6680b88ed272", "comment": "Malware payload (Formbook)", "value": "8991f969a42186536525d306b23b62d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341066, "uuid": "9cfb1927-c7a5-49e9-b0a4-dd5ba7d70e3a", "comment": "Malware payload (Formbook)", "value": "62422d7709489bd4bfe5e5feb34bfd22f0a91269b9b8e8246e407dd597d3f79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341066, "uuid": "efde8e59-9f09-4db8-84bb-c7cc2b274796", "comment": "Malware payload (Formbook)", "value": "cf86da29a2b953cafb3d4a7d5b7d168ec81c999c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341066, "uuid": "b8a741d0-6857-45b1-b047-a5143e44bae6", "comment": "Malware payload (Formbook)", "value": "37209fee234d1251c2e1d7e7f7042cccbb4d436e4e50646a60f53c7344915338cb0e665edd5b4a0a7a8666557d7043d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341066, "uuid": "95bcdd51-6590-453c-9312-2e423b794dd8", "value": "T12F05AE22F391C43BD073D9B85D5792644835BE102A78A88A3FD81EB85F39FE13935297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341066, "uuid": "e12af559-4a89-4e63-98e7-66098eff6107", "value": "018a80c00aff107bf9538dc2e44950b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341066, "uuid": "4d237a8b-8288-414c-b158-872590a03ed2", "value": "12288:PDVMCvQQIQzSswvpYTT4GhvcQLGSzX9GyT8ipYdaQHOJ0qKcFxilF0uFC1Vv8E:PZpnUpyT4G9cQxxgirOgFNY0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341066, "uuid": "d7910778-17a4-43f0-a02c-a8981f426725", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341066, "uuid": "88a6592d-8259-4253-a24f-79dc6ccf17a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341066, "uuid": "a6a8d31f-74ee-4ad9-8b11-caaa2257fdf9", "value": "DOC053662562566.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770020d8-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652316605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "6a7455e9-e491-4020-b854-5dfe306b2a09", "comment": "Malware payload", "value": "f528cd62a52bc0744ff951b61fea1557", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "5b05cb27-b91a-43b7-9142-47ea634d2c5d", "comment": "Malware payload", "value": "6250c52bc107d3a43aac8aca4b18948c3923dba73792a30423dd6ff76f78daf2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "8b846762-10d0-49ff-88ec-cb7c508d985b", "comment": "Malware payload", "value": "715c628f33051e050e38053642563c54a6db0ce7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "0aee9b57-18f4-4ac6-8fb7-4116922a3940", "comment": "Malware payload", "value": "e4d9640febf7e07d967a05248a8ca17102ca17b720634f6c60d91d1735ad8f70d68e80784e651adae593cb205b2d7564", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "799ee360-fab6-4e55-b473-a3be4caf0cda", "value": "T18812935A8891E4FCCC6CC2BD12E7FA389532B41D2296705533A4F727DDEED621A2D011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "a2ac35c4-ded4-4917-8ff2-b325070cf64c", "value": "96:GJ5DIPM6FeG0kXnsY8IvcJUohPHHLh/z4YNeLvaBXv4+GVSN8cNu5nkyr4mTJpYv:GrLkXnX8lZpLh/z4m8LgKrXY41mDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316605, "uuid": "1aed8d9d-7488-4654-8025-9200ab434624", "value": 9208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316605, "uuid": "7d5123ce-3b8f-4455-9e91-102753677d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "1369aecc-2389-4687-8a5e-00e491111457", "value": "Ugliest.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe6c0ab-d1cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652343974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343974, "uuid": "9d810a36-5ae3-4039-8c64-ac2bcebebb81", "comment": "Malware payload (Heodo)", "value": "07789098ca56ebaa8522b34fe3b9882b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343974, "uuid": "f4f79193-f864-4094-b31e-588fdc26362a", "comment": "Malware payload (Heodo)", "value": "62752c07ac41f13f70eda37038600d1de62659286efdcc3e9584680a05e0d845", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343974, "uuid": "2ba1a37a-548d-4d19-a9e5-27dfccdf67a8", "comment": "Malware payload (Heodo)", "value": "9f1faaefd5c0425419ccb1ef7968f6116948dbc2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343974, "uuid": "e67fb9a0-f4d1-483f-aaf5-000bcf50a6f0", "comment": "Malware payload (Heodo)", "value": "0d556bb09e6a2c791ed0d479e4bf1f6941dcc3b5ff443f3c7920edd321dd4c442d7b6350f5f8db0e8b55bf9a5823397c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343974, "uuid": "23593730-eae9-4276-bb50-ab4d87f6856e", "value": "T1C0F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343974, "uuid": "30467442-4901-4d18-85cc-036a438dd0f4", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343974, "uuid": "eec16966-108d-44c7-9747-3f238c3d9eb6", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmS9jNwgraKRT61cKGNx:S4DzZKnH4IRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343974, "uuid": "aa34ffee-94b9-42da-80ba-2e1ef5dc7c89", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343974, "uuid": "fea130f8-4b82-45fc-a2bd-76d1a2bf9937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343974, "uuid": "53b70140-21cd-44fd-8014-fd1f603189aa", "value": "07789098ca56ebaa8522b34fe3b9882b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19423aff-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (MassLogger)", "timestamp": 1652337064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337064, "uuid": "fe03d48c-ba44-4c0f-a2fe-48c5ccdad030", "comment": "Malware payload (MassLogger)", "value": "478613909f1fde5a08066394bdc45207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337064, "uuid": "f77cfbdd-942b-4645-a873-c95a5dc5c102", "comment": "Malware payload (MassLogger)", "value": "631e10037d983f0bf57d606446801f41402919f8b93016a814192c5d63ec42b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337064, "uuid": "a9508b1c-5e2b-4e6c-9ed5-4688f642b0e9", "comment": "Malware payload (MassLogger)", "value": "65ad71f7a3d242b07c704d02d5022ba3ec387a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337064, "uuid": "b274c47d-e7e1-4187-8977-fc991c15dba2", "comment": "Malware payload (MassLogger)", "value": "76d35797625ab054a53a23fcd1764fd04c055541901fb7bba8cbb887b5e5a88c06248ea2252573ed45cfc5f95b6d5074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337064, "uuid": "6a05c21b-4f3f-49f0-8e29-9ebe95fae47e", "value": "T10F75120573EC9F1BE97E57F81571009257F7A96F2621E3881EC220EB2261FC482B8E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337064, "uuid": "1d42a545-c0ce-45c5-8cba-6dfe0151f0f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337064, "uuid": "282cd0ac-11c4-41ed-9f88-168febeee899", "value": "24576:Uwc2RsdOwEDaBJVreUrGJssqPcb8cGzUpS/a6D8o/SzUww2mTxvb/Rqygz:UEa6WNrBCqZciMAFD8o/f2mxvb/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337064, "uuid": "d29fa023-13a2-486a-b200-9fc12534d8e0", "value": 1604096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337064, "uuid": "fa8a23f4-d72f-42c9-b93c-377a512e55c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337064, "uuid": "76a968f6-953d-4a63-b94c-b3c9c5055287", "value": "P-2797654347829873000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d959d62-d235-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652388772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388772, "uuid": "bf760542-c15b-4baf-9f09-2fd84aa806d6", "comment": "Malware payload (AgentTesla)", "value": "20557d8b534b624b67bc6c659519d1e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388772, "uuid": "fd9c8d04-b6c5-42a5-9ec0-639d0a39ab03", "comment": "Malware payload (AgentTesla)", "value": "633b04aa2a794fab5b0e23cb77b1d7a2bc2d69b1f2ec258b02317060d5731681", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388772, "uuid": "9a964dc6-cd3e-46b8-9462-5c7764eb8e46", "comment": "Malware payload (AgentTesla)", "value": "721fe4138bf30bb457be01de4fa02effe891db09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388772, "uuid": "30d75ffa-e79d-475d-9497-47d10f32359d", "comment": "Malware payload (AgentTesla)", "value": "841780764a8345ed80d4dff25e03d0330e5a55cf0678859c8af2a11b5895e81d92767bb1649e76890ab64c9725e0456c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388772, "uuid": "c89eb17c-de4d-4e58-a9fd-673499b48486", "value": "T1F1D33A40738BD6A2E645913ED7EFC2F81373DD929941DA8B6763BF1B3A323479909240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388772, "uuid": "f942830b-5ae6-4528-b1af-59d3f8e73400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388772, "uuid": "1bed5d86-aacb-4471-83c2-27f03e7bde33", "value": "768:AggEakQhT9VmoVK/bHUyhDWIKT5Ydf9QuDdwzXik7RNi3CVL:takQhTjT4/b1hDWSUFDTlNpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652388772, "uuid": "f95a0d3c-13c4-4186-841c-fc50331a2ca6", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652388772, "uuid": "62c10435-4358-4491-b557-3874e9787954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388772, "uuid": "4c78ba88-04d6-43fc-af3e-27e29e4250e9", "value": "SecuriteInfo.com.Variant.Strictor.272503.21222.17787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8cfc8f-d21e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652379049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379049, "uuid": "40299dad-965e-4da3-b9d2-270f86bcada4", "comment": "Malware payload (SnakeKeylogger)", "value": "1be350e29d09c723f5c320aefc32700a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379049, "uuid": "5984c06a-bb9e-4468-98ec-e71e34f47fd3", "comment": "Malware payload (SnakeKeylogger)", "value": "63aac65cf5874a28d91d06f01e6f7d706e73956e091b132b27a09f839ac54543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379049, "uuid": "4f5bc87e-b2ad-4dd2-ae17-9bea721e5459", "comment": "Malware payload (SnakeKeylogger)", "value": "cff8a2ee5d225aaac50e9b56202f07f4aa6776e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379049, "uuid": "595e1c78-a1c7-45f8-99d2-caf578e28bd3", "comment": "Malware payload (SnakeKeylogger)", "value": "17c8e6d64184915b7b0be46b1db4d5a67025630c54b6b4f7e7f06d7fb7fafdbd3418700d86b774af8fe6ec41dfd1af14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379049, "uuid": "bc4bcf89-e9cb-4bcf-a419-0ac037b87cd8", "value": "T1F30523A933E42B72C87997FD45F1245603F852326161F79D4CC6B0CB9AB1F4A0F09AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379049, "uuid": "4bd15b83-efd2-4abd-8297-a7e8d78a5bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379049, "uuid": "454138aa-bbb4-4377-bd3f-0a58ec8f6450", "value": "12288:0tzLMRszTGDNvMX5fB5wlqvIBUyjOB55yqI4ifb6JlyMB2v6lL:xsvoveV0qvIiFzu4iWJlyE66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379049, "uuid": "306085e4-a8f1-4162-bd3a-97b8e0f35eaa", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379049, "uuid": "5c6a7ff3-05c0-400a-8dc9-475c383d6a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379049, "uuid": "50939b7d-644f-4ca5-9788-bdde03aa840d", "value": "KvC3PJZ2DDq5scp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00937a27-d24f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652399729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399729, "uuid": "f398238b-7954-4e34-bc48-33c2e2375540", "comment": "Malware payload", "value": "8a319db3032495f33ea2bdc5f18e8b25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399729, "uuid": "a47ae3a9-878d-4123-a514-0123e3ed1ada", "comment": "Malware payload", "value": "63b42e3ea754fcde63a639a23c82b18aec0802b63a50364df8a02a0c5c90602c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399729, "uuid": "735be8e0-af7f-46c5-b753-430de1be9f6d", "comment": "Malware payload", "value": "121cc481fe3b4cc03e9e9c4e2f7952d28e195847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399729, "uuid": "b0613f3d-11a5-4592-87d5-e617b1e54036", "comment": "Malware payload", "value": "74214871f4e79865507446617acb6b3351eec98cce6629f70285d92c691d7ae16b294a096c747a0dc7b1984da9ac37b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399729, "uuid": "18fcc41e-11b8-4195-a142-09997cd5b03a", "value": "T1BBC3080AAF610EBBC86FDE3746AD0B0A34CC450722A97B3A7674D52CF54A54F09D39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399729, "uuid": "59aa1be0-55f8-440a-a72b-f6bd875f5ef7", "value": "1536:GPuOZEa7zj0idvrLG22psgm5s2yShZmeKL4LqYAp6naw3fC:crYid15s29htr5quK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399729, "uuid": "455a41cf-e161-4e4e-886b-6eccd355c1f5", "value": 118196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399729, "uuid": "324a3028-da7b-4c58-b032-786e7a7232b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399729, "uuid": "95c83367-e6d6-41fb-af53-b8ef948e6b7f", "value": "8a319db3032495f33ea2bdc5f18e8b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5733d489-d248-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652396868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396868, "uuid": "e5a4f3d2-bef3-49f1-acf4-8f2e01e8a2ca", "comment": "Malware payload", "value": "c813f4c274e207076c39673837b2cafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396868, "uuid": "d5034e6d-8947-4f60-807a-c63fa53ca50c", "comment": "Malware payload", "value": "63bfe1516e028ac09c8fe950548a9e277a550ef01860d00e446f281b31b34f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396868, "uuid": "6289208f-9ba8-413c-9177-0ad35e861849", "comment": "Malware payload", "value": "58578a449afc3b99c7a62b3e9ab6c93beefd990f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396868, "uuid": "b6b95390-0c06-48bb-8523-a07988b7e9ee", "comment": "Malware payload", "value": "d8f87ffef54a8dbc790c05c2d5411d40d7d982696599cc1c7af351f783f25812e5aa97184a48624cae26067c0c802118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396868, "uuid": "d5d0c5f2-9f37-45b4-9156-2d183aded9e5", "value": "T147E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396868, "uuid": "bc5ea5e4-492d-4484-af68-f87b7b43e431", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396868, "uuid": "dbc8a83b-4b33-425c-9c33-a079a3f71c58", "value": "6144:mkajLyaPIvW1TFpvzYNB1M6B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8v6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652396868, "uuid": "bd2545be-8664-4f83-a47b-152d4c9c4e53", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652396868, "uuid": "d40c6299-49d8-4f57-9e3e-3cb1b7fa9c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396868, "uuid": "92ee9f2e-f8d3-4c9e-add3-25007bc1f4ff", "value": "c813f4c274e207076c39673837b2cafe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7302c2f1-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652334638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334638, "uuid": "1a453492-7da1-4eeb-95b6-d26319b64023", "comment": "Malware payload (AgentTesla)", "value": "25a897438664cc3d358e0a2ee4a24019", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334638, "uuid": "1e658d76-c328-4264-8682-f0bb8c2ea851", "comment": "Malware payload (AgentTesla)", "value": "640c647769b22714c9bd5029c10cd5d3c1d863c5320b24911371183e285ebf4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334638, "uuid": "bbacb3c6-488d-41f3-977f-df7332fd4190", "comment": "Malware payload (AgentTesla)", "value": "8beab8ce6a22a34df47cdaedbd66b2c071a77705", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334638, "uuid": "4e6f61f0-01c5-4985-95d9-b58d7127fc9d", "comment": "Malware payload (AgentTesla)", "value": "689a25d6baabff7304631566ae480a57c04a237fe6ec25c409127a7c544aa439f77114f03e1db20ecd540e4462e3d2b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334638, "uuid": "531404d6-832c-4a6d-ad08-fe1f2986c42a", "value": "T1D9C4222666706332DEAB2F79CD5090EC13386E86DC34E62F3CA1B4DD8DB2394465527B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334638, "uuid": "64dcd016-117f-4540-8c12-1447bf40bba2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334638, "uuid": "a0418b1b-3818-4f82-8daf-56f59a3ac620", "value": "12288:ZM5WFWRLRUSNR80sjCzf7kfptH3Uiel6laEe:Oi4mUK/jCzf7YJedE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334638, "uuid": "1a8a6d30-0baf-445d-aeae-4b3bca903123", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334638, "uuid": "ad11d9d1-c6b6-4f3c-a328-5bc2c4d6b2dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334638, "uuid": "570145a1-7b87-4fbd-a0d0-e61253422560", "value": "TransactionAdviceDetailsReport-20220512-091440.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1ec532-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652345657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345657, "uuid": "b161fd8a-347f-4c8a-a341-ccf33ac1136f", "comment": "Malware payload (Heodo)", "value": "d49ab61aa94b9080668e50cd942654be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345657, "uuid": "ca778160-20a8-4acb-b72c-522800b3ccf6", "comment": "Malware payload (Heodo)", "value": "641ee217ba57969924929c3d6358ecaed0d024a673bf765270a48a32216a95e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345657, "uuid": "9cbdf721-a742-46cc-be4c-e9e862b3221a", "comment": "Malware payload (Heodo)", "value": "1c2e17025a41190efdbcfed661f07a5dd3f00be8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345657, "uuid": "53d3042f-eb92-4f5e-8cbb-75b95d71c23a", "comment": "Malware payload (Heodo)", "value": "1c7f715d609a8da8a1fab6904ab4aea40f4ce70234d48ac9d8cb8cf99940db4b9cae08bd3c9048ff4f94fdee640f0735", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345657, "uuid": "6f4b1887-592d-4b5b-87e3-910773468262", "value": "T15EF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345657, "uuid": "1541ee64-453c-4b29-96c5-696d20a53f8a", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345657, "uuid": "297a853f-ab4c-415a-94a4-e6af73e84e54", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSTjNwgraKRT61cKGNx:S4DzZKnH4KRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345657, "uuid": "236f1d64-7dec-4f9c-ad0f-74b891ddb004", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345657, "uuid": "3c0002e7-0fb3-4927-b31c-0f332f0a96e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345657, "uuid": "97301875-81a4-4fe4-8477-ee1cb7a02e64", "value": "d49ab61aa94b9080668e50cd942654be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0150b9f-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317990, "uuid": "68e8dd65-bc46-420b-ad62-7a464c3689ee", "comment": "Malware payload (Mirai)", "value": "8197a50e4233ca2a2d282ad486299799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317990, "uuid": "93f62e4b-67fe-4f01-90f9-4a71bab0eb33", "comment": "Malware payload (Mirai)", "value": "652a26095aea955a8d492c3da6e18cc007bc675284f46681686962092f6ebc0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317990, "uuid": "97ee9cdc-362e-43b3-a5e1-efbdcc30bebf", "comment": "Malware payload (Mirai)", "value": "2223d876253342966ce0c5793c01b12c503c2a49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317990, "uuid": "8713f8f2-c024-4b03-9110-39b231259fe9", "comment": "Malware payload (Mirai)", "value": "34884ecff88ac198b2b5321ff54ea1b17e4ef645e6aa57c0b11dcc6948b9d5ddde1309e7a101b648f06068950e8882f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317990, "uuid": "6fc5236c-8823-4958-bc55-75ce8febf6fe", "value": "T186736C21BCB62A27C0E4A4BA12F34711B2E2674E34E4CA1D7D720F8EFF247A02557675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317990, "uuid": "ae9d1a5b-364e-4301-bb2b-492742f63e9c", "value": "1536:4fZuueLSVxYUU27jmzaeu6HhoUJxCDOV+9d5XC7RP:4Bj9SUhW+ORuDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317990, "uuid": "1df6ab90-df22-420c-ac6b-7a67cf465a7c", "value": 76104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317990, "uuid": "54656358-768e-4779-8060-56f1cb51911b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317990, "uuid": "e7a8727e-c9c8-44b1-95fb-0d4ea98a16ed", "value": "meihao.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83aac65a-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363442, "uuid": "05816f0d-2610-4ccf-b03b-00f820e3adf8", "comment": "Malware payload", "value": "26f4abd6d8969ea1a2b56082330268da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363442, "uuid": "b1229002-4ce0-47e7-ae0a-3c937b819a3e", "comment": "Malware payload", "value": "65baddfe30933375a901ad953d45960ad4eff51d76f6801c3271c2eeb96fcd6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363442, "uuid": "9db4c1dd-c344-47c4-a2a8-5cda427ca5af", "comment": "Malware payload", "value": "7d6bca1bbd79b6a4433694e7bc52b2ac061dde4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363442, "uuid": "97782121-8875-424a-97ae-8add02e1362d", "comment": "Malware payload", "value": "998fb20c9e57fc615d61c8065f7ac85f4b721c9e3ff1dac94edf59559e5058569840113f1e3bcb49df946966f77ae3d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363442, "uuid": "9e7cec1e-fdef-41fd-b702-1c18fd3d0cf8", "value": "T1FB56CE729311C676D7D33776D06B5D2F22052130A3EF38AE97059EE89E9B2FDC521A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363442, "uuid": "73dc1c29-2b7a-4156-be2c-540d4048d151", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363442, "uuid": "2e61e83c-c93f-48c8-b2b7-1f1ffe104970", "value": "196608:tnWYGFsPiEy1jqjYErQN+fZAyOw/ml/tqpiotndoGQUe2UuX+xYWP9p:tnWYGGPnjBroy7/mllPEdUwxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363442, "uuid": "a1147fcd-1144-4f77-903d-e9b1bb18ecf9", "value": 6364640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363442, "uuid": "fd3fe331-7555-44f4-b359-05da288133b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363442, "uuid": "3105081c-18ce-4393-be56-ebce72637b43", "value": "26f4abd6d8969ea1a2b56082330268da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15198315-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1652377430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377430, "uuid": "9095f6de-10d9-487c-b942-b47cb61fe0c6", "comment": "Malware payload (STRRAT)", "value": "76c812061132b42126805ea9034953bc", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377430, "uuid": "e5d33754-1840-4b8c-94aa-a40f0978e1eb", "comment": "Malware payload (STRRAT)", "value": "65caf68cce79fa953e7fea1f7be0ee3e14104f23ea16c10560fb9af9617ce4eb", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377430, "uuid": "0529d63c-9ee0-4825-883f-530e07d6b21c", "comment": "Malware payload (STRRAT)", "value": "19f2604ab13124bae540437d4c97cd37d29e7ff3", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377430, "uuid": "96ee9dde-c444-4168-84cd-4ffd3c6924ec", "comment": "Malware payload (STRRAT)", "value": "1ea67d883f0dfb64524478b538cdddfa7b4118ea79559e03fb11f6883037dfba77896f64ed6b29a5fb000e7d0945d584", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377430, "uuid": "5b9b2ff5-5d0f-49f7-aec7-696b2fc0178b", "value": "T19074232B947F7888E59D7AB45CE1B1BF0434A6D38E89F338EB0415175E089D8D8EBA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377430, "uuid": "2e761939-e033-4310-a499-76746c306acd", "value": "6144:8uiHcNdLSjo25EwdDj9bLtDlBlsLa8kqvlq18ZC13gQqbMrEDhEs89ZuSWK68:WH/hEUL7B58kqvlo8EFgbAEeRLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377430, "uuid": "bae6e475-9435-4d2c-a8b1-f4a699b62b4e", "value": 362950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377430, "uuid": "6d54602d-d771-48a3-97d8-972d4832e3d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377430, "uuid": "c7896064-06bf-43d9-980f-7843dc82f802", "value": "76c812061132b42126805ea9034953bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fba0702-d21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652376991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376991, "uuid": "cad22d4e-94c9-4c7d-afda-276344a5768a", "comment": "Malware payload (Gafgyt)", "value": "e533dfc194fa5e81699f4aea098433a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376991, "uuid": "abde1100-14ae-4ac0-89dd-934c08d30790", "comment": "Malware payload (Gafgyt)", "value": "67c44956996df95d113ff77d3bdd694b6a86400b6ed7c554322af0e8d12c961b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376991, "uuid": "810f1afa-6742-4c23-82de-da9b7610ec8d", "comment": "Malware payload (Gafgyt)", "value": "746384095701f583867568350f4286d7b25a578f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376991, "uuid": "7f568143-6ffb-412f-9096-60c7c7aa4505", "comment": "Malware payload (Gafgyt)", "value": "27860849422d755ef8cfdc61cf45dd317887a16638321bc56e3c032662280c8b526a3f746cfaa1e760fb212f7fc5f33c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376991, "uuid": "ddbbdfa0-dd75-47f9-9566-0529a5f81f67", "value": "T1EBB33C44F9408727C2D327BAE78E438D3B3556E467D733115A34BEB42BC67992E29930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376991, "uuid": "04b243fd-fc11-4ff9-90d6-e02dfb74bde2", "value": "3072:dHaJTsHBtaLl/PyTr+A6lm8rrQAhPECXFke:M2BtIl/Pzm8rrQAhPECXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376991, "uuid": "0b910b9b-e48b-4588-a21b-08a1d39f679a", "value": 113603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376991, "uuid": "51f1c0c4-c4d6-4176-a957-3bfb2d75cc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376991, "uuid": "d22e287e-fc44-4efb-a454-cfb165b44128", "value": "e533dfc194fa5e81699f4aea098433a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b50731-d1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652349938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349938, "uuid": "937f90ca-2c06-45dc-9cb2-d53cdf08c89f", "comment": "Malware payload (Formbook)", "value": "9fbf93d251043fbac2b20334b53e3279", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349938, "uuid": "f3df7a3b-e0d8-4349-ae27-d0590101cb81", "comment": "Malware payload (Formbook)", "value": "6908d05a5e734b118d80b1fbeb09c3470681cbe17ad1e63ce230e15de1edbb54", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349938, "uuid": "26437685-f205-4a9a-9212-bfb8ead00a7f", "comment": "Malware payload (Formbook)", "value": "1b5a9777eac8b6dd9dc56d8adc79ce2e9657a41c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349938, "uuid": "6e39ee1e-d703-479a-b443-a1d5949168d3", "comment": "Malware payload (Formbook)", "value": "c551c81c67fe75543e40d70700c5df7e321b22023498cdb51f6fd0f89fc9c4eac51037f784bfdd9e95aae7f91228faed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349938, "uuid": "2a2ee7b2-d888-46e8-8f36-b7adca146782", "value": "T17B0412707D4F4BC6EAA6083AC926763EF026EF1EE478DA0F70983A4C2631555252E57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349938, "uuid": "87255bd2-11e5-4118-9f27-60a9de3c2ace", "value": "3072:hiXYmNU2OuCd9PjVcmT9fedaXoKmkm0fmtVL87Cc+obd8qYIMxAe76T68wKS4I6f:oImNPO9T1QoYKmkmjt987CcRIxd6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349938, "uuid": "d8b4bc2a-b9af-42be-8837-1fcc91da7ca2", "value": 188312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349938, "uuid": "19b7ee4e-c33c-4d1d-97bb-ea53ef5320fd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349938, "uuid": "45b21f9f-d0cf-4f27-947c-249d38236836", "value": "orden de compra 12-05-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1896bea7-d207-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652368846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368846, "uuid": "075bd6c1-5b7f-49fc-8cf5-fce0a853a297", "comment": "Malware payload (AgentTesla)", "value": "16b14a1bdac86efd0e4b3bece35a814b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368846, "uuid": "89fa0ae1-adb4-4cf8-b879-5faa588ecf69", "comment": "Malware payload (AgentTesla)", "value": "699ec5563b21f148e04ae32c3d90f65c72baebad9da052317f665d18bc6e20b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368846, "uuid": "644d2a56-946e-4bf7-aef1-1e6f3e28b4a6", "comment": "Malware payload (AgentTesla)", "value": "7034d5ea4aa3d4ce13d714b8250846a159578c8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368846, "uuid": "dfbfad2f-c4f1-4ef8-a07f-9b22d32faae9", "comment": "Malware payload (AgentTesla)", "value": "eafc1607956b323aaa98d9e265db70e450fe586a2ddf90ae06b8bfeaff49aa7225671cec39aa31deeaff33408c32bb3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368846, "uuid": "5aa6ebb4-2309-48ca-b999-f6015bd9a98e", "value": "T1BB25DF22B74CBF65E67AD3798150881083F1A31FFB2AD55A3C7724CB1572B8593A2D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368846, "uuid": "8eb954e5-ea3d-4546-959a-21f60fb32bf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368846, "uuid": "8cfd496a-38ee-48c6-ac38-d8342b8e894e", "value": "24576:QGn0/U4ys0tmXUuVl80gxd4VnuWR95cYtYNA:Cs4ys0tmXnf80gxd8SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652368846, "uuid": "38a91736-7127-42df-a270-e51f249c01b4", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652368846, "uuid": "00d23536-175a-469a-8de6-7bf428382100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368846, "uuid": "59701d56-978f-4bae-a9ec-5b53b285b673", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c871477a-d1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356256, "uuid": "55cf62ec-62bb-4d12-b5f8-8a55dd469a12", "comment": "Malware payload (Mirai)", "value": "a6f717fa60dffb8a291a0979210f4a76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356256, "uuid": "e359afd0-d2ff-4492-a057-6ea82f70ef2a", "comment": "Malware payload (Mirai)", "value": "69a7ffbd2ba1a58dee2965ab7ddc2ab48f397b58e5e09cece95df2fce1dc3410", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356256, "uuid": "eef75b39-b3b8-48f6-8779-40c46b5d958e", "comment": "Malware payload (Mirai)", "value": "7b4f7f3ba2a495f60bbc432f9da082430bc9222f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356256, "uuid": "27b91ba8-fdf0-4093-9ccd-149591383cba", "comment": "Malware payload (Mirai)", "value": "5909a77afd7d6304494ae113ca18e4c56846c2ff30746966068a3d1c821140ccc01f579c91c6386d321bf5acaf4b071b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356256, "uuid": "002df242-d1b2-44ae-b487-fc2691c9d02d", "value": "T15ED318D3B900DFE6F40BEE7604D34B25A230BFA11F921666720B39679D361D6282BF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356256, "uuid": "bedab910-d3c4-4f0c-91d5-ef00441e7343", "value": "3072:51ki91TtgXd/kfqig/sytL7Nem9/stubwAGTLNg:5yeL8lkfqi7ytXgm9/stubwAGTLNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356256, "uuid": "ac5a699b-a66b-4420-b5e2-58fdafd433c6", "value": 133330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356256, "uuid": "207f0a49-6128-4092-9e70-c2fc6a875142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356256, "uuid": "539039de-d770-4a48-b7b9-f5228070cf56", "value": "a6f717fa60dffb8a291a0979210f4a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc719c9-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338736, "uuid": "e99fd545-bf80-49bc-88a0-7d81e3458f77", "comment": "Malware payload (Loki)", "value": "fe7ecf031e64746581c33567d35efab4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338736, "uuid": "f3328d9b-f831-44eb-b6fa-40907c8b3058", "comment": "Malware payload (Loki)", "value": "69ad48bfc18f79ecfa5762b89773e9cb2226efeab938b6571b6db3a48abaea9a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338736, "uuid": "cb82be04-4f84-4ec4-ba97-983ff1668d03", "comment": "Malware payload (Loki)", "value": "33f8802b4492e770edb2c26d27639fb5804994a5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338736, "uuid": "32548efa-dcf7-4b3d-a9eb-7f2befc1b8c9", "comment": "Malware payload (Loki)", "value": "4796b1e25c63bfb82e4b8f02aca479d17fdac0c07ddbb8d9e181fefc0e12ebfcedd081ec7067881c2cd23e3cfccb11a4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338736, "uuid": "b937cff1-1370-4689-bd9c-7b5795bc1a40", "value": "T17C04122C7BAEB5D3F249E5F97C0860A53225FF62086524D0038F3244B17EBD41A7A96F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338736, "uuid": "b540f355-a6ff-40d1-842d-b817a29cf915", "value": "3072:lmf9zkzdAzjX/gHUUrlEkgtHxkli2ny1CogCCg4aYe/42D9q1BQBECSm8ZswW0v9:wf6zdA3X/u3+kqkxnyrgCCgpYe/oqEC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338736, "uuid": "190ae49c-bfc8-40b8-9645-5332a815b8df", "value": 188056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338736, "uuid": "75151255-8fac-40f9-9d3e-456a5cf5138a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338736, "uuid": "c7ad55a0-505d-4b46-ab12-407c1d5b65c1", "value": "payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67953c8a-d1f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652362965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362965, "uuid": "d3d8e3f9-d305-4ec3-959a-f54ceb7af8bf", "comment": "Malware payload (Heodo)", "value": "3a6546cc33d3a5aa20b97597390cf6b1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362965, "uuid": "c679e049-7afe-4635-a52e-0b444faedb4f", "comment": "Malware payload (Heodo)", "value": "69dc6e0bc0601743cc8b8f40e7be6d6e5b80c6e988be9f81d9fba333348024cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362965, "uuid": "18b92cc5-8557-486c-b44b-6366174a5cc9", "comment": "Malware payload (Heodo)", "value": "fd4e3a9e2fe5845322d2635caf589ad4f4060148", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362965, "uuid": "cbc6b011-fd14-48e4-bfc9-6a21102f778a", "comment": "Malware payload (Heodo)", "value": "abc3eeec090afdbc70968b8aab3a4af9109161dd76da712bc0a34fdca2acb05e59d0e1a828045574efdece31127d2f42", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362965, "uuid": "373c283e-fd82-431d-9c7a-48c166dfc462", "value": "T17FE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362965, "uuid": "c5215252-d2c9-4480-9a81-13136892754c", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362965, "uuid": "ec324248-e5f4-4cee-a75f-978ff7f8bb5b", "value": "6144:mkajLyaPIvW1TFpvzYNB1M3B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8I6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362965, "uuid": "bdbfad31-1c32-4af1-bd9e-fa46a0b7420a", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362965, "uuid": "fb5053ed-3bbf-4d98-8c32-dbc59b3e5d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362965, "uuid": "833073a1-d7eb-4d27-b5a5-d3f026094cca", "value": "69dc6e0bc0601743cc8b8f40e7be6d6e5b80c6e988be9f81d9fba333348024cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d517a81c-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338668, "uuid": "bab61de2-e119-4258-82b5-83f0a99d6cc8", "comment": "Malware payload (Loki)", "value": "7bed90cb45c11d5e71593a2931166402", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338668, "uuid": "67a270fc-f0ac-4a28-8d34-4518c9203796", "comment": "Malware payload (Loki)", "value": "6a8cb8026828ff7dcdcb2002dbd13743de2064e065aea6d416b348894acb5073", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338668, "uuid": "3f59cc03-a541-4c28-b6f8-9c7a98142534", "comment": "Malware payload (Loki)", "value": "2e229a67d261223c1da3fb8b583e711e3dab592d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338668, "uuid": "93e5a90a-bfd0-40db-9966-7618923b185d", "comment": "Malware payload (Loki)", "value": "53acef4c4cbeb4851e5f89243d973195bb5ce6ead45b1d24ac1877874aab78fe7808fac37578c402c5b1d413e29fad10", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338668, "uuid": "6a46c55f-049d-4012-a350-5b0e6a188117", "value": "T12404122ADF038F96CD45B63DECF14687A2D2ED86812D5A4771C7B02F5236CA7F812152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338668, "uuid": "2527f55f-c277-4ab1-bc01-6b112918913d", "value": "3072:OX0szkOAQUdzQE3KXZCDCSzS7s6h1zUOLwfXX0Z3iSHKCnJNX8LfFm/kjKOIuKl6:IkOWlp3EZCDVzT6h1zDGn0ZqCnJqf0sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338668, "uuid": "a335b935-f771-498a-aded-69db0d9c469c", "value": 188136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338668, "uuid": "a2d81daf-702f-401c-b2fe-a5bc8992d7fc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338668, "uuid": "55457af7-f1dd-4a67-8ca8-e3b61b824932", "value": "MV PRIDE PACIFIC 2206N.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69f38d2-d1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652353649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353649, "uuid": "3e496798-93aa-49b5-8e56-9030aa750573", "comment": "Malware payload (SilentBuilder)", "value": "2bbb2123f13fb02235672be0161e6868", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353649, "uuid": "b7dd9f3b-18b8-47f9-baf4-4b76d42d26c5", "comment": "Malware payload (SilentBuilder)", "value": "6aa7a18e06e8abe9bf7f6831816717e89a1f7a62ed5aa8cdcfe9d7366210ee36", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353649, "uuid": "11487297-365e-445c-9ad2-baf50acef026", "comment": "Malware payload (SilentBuilder)", "value": "8639729f958e0d56566cd5f2190cbc4df94f46bd", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353649, "uuid": "1c009dd6-4255-4f95-b74c-48e8316ff876", "comment": "Malware payload (SilentBuilder)", "value": "daf51fe45c218aa590773cdf24bbcd1cb9d61a1197c3bcb57ea63dad6d0a9662d0ce10369d0b33419f39b9987f100a34", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353649, "uuid": "09dac754-757a-4d43-9736-09874258d365", "value": "T15B03834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353649, "uuid": "33af9875-dd42-4383-a40c-2aa547fa29f1", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353649, "uuid": "7051b597-6276-49f1-b71c-9ac286a1bbad", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353649, "uuid": "195ce174-bfcd-4b3a-bfc3-34622a529463", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353649, "uuid": "888c0888-2943-47a2-aff4-dbdd781fd8b5", "value": "Rechnung 2022.12.05_1247.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddd33c4-d1dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652350359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350359, "uuid": "03ba94fe-d7b2-49b9-8479-1c8e14fd2ac5", "comment": "Malware payload (Formbook)", "value": "63024416555335f0668d2450f16fed17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350359, "uuid": "0eb316bc-5e4e-49a4-bacc-e46e9879438e", "comment": "Malware payload (Formbook)", "value": "6b19bf1ec55b55f38c00c74fd66dd45c8d7e12eebebca913c4d21152ed0ced8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350359, "uuid": "b96ec188-55d8-4383-8920-6598d0e5e0ce", "comment": "Malware payload (Formbook)", "value": "aa758a0388cbdea9894cc0527e5fb1b9bafbde6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350359, "uuid": "bded7906-9b5c-43e5-b71d-b1151f9ab775", "comment": "Malware payload (Formbook)", "value": "1ba783ae5c24abd88215b07d379ca88f17d7ac87899b8f1a2c19d17463d064e97a7cb973575d52c117f08abcae06c069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350359, "uuid": "698eb8c0-6fa6-459d-bf66-a92f1de7cb39", "value": "T12644120037D4D433E9679B722E7B77329BFBD9206471915B43852069B8A1F82EB2F943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350359, "uuid": "d4ca2c8f-6238-4b2b-968e-fec639e2adfc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350359, "uuid": "f5e4961e-0eb7-4783-9b77-eb9381357a84", "value": "6144:LOtIO+SAqp9EJ/L6vVccSnGvQDrUKt506fVz:LOLpAe9EVatQfUKtXVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350359, "uuid": "1ceae5ce-d5cb-4f36-b67e-18041490358a", "value": 259244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350359, "uuid": "f862a281-07d1-42ae-9c38-97ea17fe5d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350359, "uuid": "7488f8dc-992a-4abf-87ea-6262f65df722", "value": "SecuriteInfo.com.Variant.Jaik.72878.26519.1384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5190570-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652345942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345942, "uuid": "0aa34a5b-c082-48e8-bd16-81fd75ed219f", "comment": "Malware payload (AsyncRAT)", "value": "e37f44da74b35a4e474e1d1f0c92e29c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345942, "uuid": "64b1e03d-251b-4d21-8155-e7657532eb5b", "comment": "Malware payload (AsyncRAT)", "value": "6bb030430aef2b33ca1f8db61690c001754e9c2dae78e22b11a178959cd4c7a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345942, "uuid": "b01f27ce-57dc-49f4-bc54-545d4fc95067", "comment": "Malware payload (AsyncRAT)", "value": "1b862334cc0b1686eb5dd91a42bd6fee0ae22d55", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345942, "uuid": "b7c07341-caa4-4727-8abf-8dcc44ef9d18", "comment": "Malware payload (AsyncRAT)", "value": "5e0ac13abcafafecc36d49e75804ac64684dd7011e23458ff4b2bbb778cb828463671a00374a5dc78fdab352c735b0dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345942, "uuid": "6371c516-3819-45e5-bef5-fcf44089db83", "value": "T197231B003BE8822BF2BE4F7899F26245467AF2633603D54E1CC451DB5613FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345942, "uuid": "ec31bf0e-8ca8-452d-b2c2-3c7cc2f80849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345942, "uuid": "61909231-5b4b-4157-9a80-238d6dc049be", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iQN+p+GSepRnoPDBDZSx:vuwCfTgp/2OKYDy3bCXSX/SIRnEdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345942, "uuid": "d0dbf0bc-0d45-475a-bb67-1face5cedc21", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345942, "uuid": "abe9f8f4-8f2f-4875-b296-940d94cee4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345942, "uuid": "e8dcfd08-b056-4f16-b1d9-6538432a1ca1", "value": "1b862334cc0b1686eb5dd91a42bd6fee0ae22d55.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535f9af7-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346181, "uuid": "3be0966e-529e-4a7c-9d14-d591dacdedf3", "comment": "Malware payload (Heodo)", "value": "8fe39938ff49780a19460d5d972eb7a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346181, "uuid": "982d1183-db3a-43f1-8e35-90eb88fd9b1b", "comment": "Malware payload (Heodo)", "value": "6bc2f9e7d55d51b927cc9a408c94a0e800e9d5acbe18c4c5cfbc47cd549f49fe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346181, "uuid": "25b90631-c5b4-475c-a500-fc4856483f86", "comment": "Malware payload (Heodo)", "value": "d42a738b57365d30b2152adc4c2c2abdfb7c1d28", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346181, "uuid": "559af90f-1838-43b7-a833-a09366e61237", "comment": "Malware payload (Heodo)", "value": "9448f16936c457dc49713569645ced67a721851dbc241a0e8c207d76e1b8b47101c86cfa7dad6c8c681cda1fd06d75cf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346181, "uuid": "6559dbfa-8986-4e66-a757-5c938303921d", "value": "T1CAF47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346181, "uuid": "0f28a0f4-a95a-4fff-9417-7bd043b0b9bd", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346181, "uuid": "5b5490f4-eff6-412b-b6ad-0fced1dd36a9", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSojNwgraKRT61cKGNx:S4DzZKnH4RRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346181, "uuid": "f26e8752-011e-4db9-86d8-d81a596408a7", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346181, "uuid": "a23b1191-ff7e-419a-ab71-fb11e8ac4ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346181, "uuid": "3ad08e0b-5e4c-4f26-b5fc-83c9925252bf", "value": "1TmvQ6AybXBrbFd1QG.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6a9553-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652343570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343570, "uuid": "61de45f9-386b-4b1f-9d95-d9e8f050cba6", "comment": "Malware payload (AgentTesla)", "value": "437b101f38a084c920efda9fd6524095", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343570, "uuid": "9266ed1e-b658-4c1b-b1c1-c0d42918caff", "comment": "Malware payload (AgentTesla)", "value": "6bea799e3f2be459add6fc3bf5e36cdaa17e2c6aa3381e8f0731b39de96fde33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343570, "uuid": "d2b82065-2b17-4fbb-9639-251a5318b41f", "comment": "Malware payload (AgentTesla)", "value": "e71685790cbfb8618c06203fd3fb5c5eec421778", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343570, "uuid": "14ff748f-baa7-40ee-9c24-a2f421fe8a2f", "comment": "Malware payload (AgentTesla)", "value": "28dee2370e4c1282751e8d07387486f2ef5005c92cedc2ed5e406fcb6ad9023cf3569c49ed2c8fdaf9cbcc538817b5cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343570, "uuid": "c168a072-a48a-43ad-8cf1-0d12ad7b8801", "value": "T126C41215291712A3F9AA1BB5CF5040DC1BBC4E1BBC57E23FCF85B09A86B270D41929B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343570, "uuid": "642e8b90-4cd3-40d4-906c-407659da9cab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343570, "uuid": "7c38f1cf-b9bd-460a-8efa-d35f1b6ea4e9", "value": "12288:FhpWvX0bcG30nrFfTQ19BA3C34IBAPveUb8P0gQlrUv0P9GfBKcCZe:F/doM0kBh2eU+RIrUv0P0cck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343570, "uuid": "b923dd70-d353-4f16-b973-a5e37b10ca91", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343570, "uuid": "de5934eb-be73-4570-b195-6f2dc03f101c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343570, "uuid": "3f8bcc33-7cd2-48b9-b384-cb15ba317ce3", "value": "S\u0130PAR\u0130\u015e - 2022 FAB 0100 Fiyat Bilgisi_TugraMaksan A.S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d68e21c-d1eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356828, "uuid": "426887fc-590e-46e7-8482-10ef03d69d63", "comment": "Malware payload (Mirai)", "value": "46231c7bee257ce93728796bdc708e9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356828, "uuid": "b65482a3-c6c0-4786-af02-28ecaa82f014", "comment": "Malware payload (Mirai)", "value": "6c8635362b14dbe4b9e8652565410e230ba2ec7082f69bbae4a344fce0cfde59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356828, "uuid": "3374d560-743c-421b-ba41-d7c4717550c5", "comment": "Malware payload (Mirai)", "value": "6aa0729b40e1937569c10cace72897e2f1d12c3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356828, "uuid": "6b531d45-9487-4214-bd53-695a4e4e619d", "comment": "Malware payload (Mirai)", "value": "b471930d2fb42275e33db4ca2bfe9e1d5afc9c1221381943a76ccc2c083ea249b60319bf0749605add2d922a7ccf397c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356828, "uuid": "36f12829-e929-4539-bf7c-066d990db8be", "value": "T1A623F19DC5954935DE23D133BFAF338B86428893F20A46A3E2D474E3ADFAB155C486C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356828, "uuid": "357b11f9-2090-4dc6-a5b4-ed37b6ab1131", "value": "768:Kb5bkjptv/ekXVu6/ssPmS2uQfcfYhx/Mgpjva4uuUnbcuyD7UGQRjVZgDDTB:Kb5I9tvTjHz2u6cfYhxEijvcznouy8GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356828, "uuid": "fb0c6002-91f2-49a5-b68a-57d522430678", "value": 45864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356828, "uuid": "3f29e404-2da7-4f9d-b05e-f672a10196f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356828, "uuid": "a5112a0c-05a8-432d-ad60-00990b5264ef", "value": "46231c7bee257ce93728796bdc708e9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554cd3b2-d1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652347473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347473, "uuid": "41712285-ad6a-44f4-80f4-171da27ab09c", "comment": "Malware payload (Heodo)", "value": "cfb9d1848a01fd134ede7181103f2319", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347473, "uuid": "78730d17-75dd-4686-9a99-d87dc813a53a", "comment": "Malware payload (Heodo)", "value": "6c8c9f56a21fcf51a6279adae765a8ba9aa9d3419d75858c4f803c85831ee365", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347473, "uuid": "7a15c0f4-dcfd-4c62-922b-fc2791a578f1", "comment": "Malware payload (Heodo)", "value": "9bebc827758d47c0763ecabf193da40c098a9b92", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347473, "uuid": "5654c571-cf96-40bb-ba9d-d9cffa1dd3d7", "comment": "Malware payload (Heodo)", "value": "6abfca30e3fe6063d4b1cb93202e160c576dde560965fc41d5e42c0885acdf775a1cd51011de89b87c88af6e3736f699", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347473, "uuid": "82b30e22-eeca-44d4-b78e-be2a574ad3f7", "value": "T1A5F47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347473, "uuid": "827dff97-ef3c-4e38-b76a-1f8500c22a12", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347473, "uuid": "abdfb24b-1f72-46a8-863c-5a96833e71e0", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSRjNwgraKRT61cKGNx:S4DzZKnH4ARGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347473, "uuid": "60df1395-22fc-4197-8d2d-152c7259eda5", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347473, "uuid": "24e61aeb-0906-49e8-80be-9ba713231303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347473, "uuid": "3f90ea04-23c3-4208-951d-90d5c6946c71", "value": "PKoqqIExkeMfBRjyk7rH81x.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd52f1f3-d23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391053, "uuid": "5cab59a6-6815-401b-ac48-65e599cb199e", "comment": "Malware payload (Heodo)", "value": "21aa9ddbeaa38eaa0a6bbb15fbd5b04b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391053, "uuid": "8895670c-fe00-4241-98ee-f6338fea0871", "comment": "Malware payload (Heodo)", "value": "6c8ea81ae915769571f31baa14b34dbbc115cb3c929e5b34022e82dae6c6adc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391053, "uuid": "852cf7d7-2edc-4c45-8bfa-67d7d5d4617b", "comment": "Malware payload (Heodo)", "value": "ae70b9a1d4fd0f7cdef88953e01160ec23143172", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391053, "uuid": "c76d87ea-ff0d-48f3-9559-0de0c1559944", "comment": "Malware payload (Heodo)", "value": "f858fd45c9bb843ac54243ae651dc65b81516e4bbb6b2931a887be826ec9d0aacf84c7cf3de48caefeb45674dfce52ee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391053, "uuid": "aaada6fa-11bb-438e-ad0d-457d12a1d762", "value": "T196E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391053, "uuid": "2188bf11-15dd-4471-9414-3db3851c3810", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391053, "uuid": "eaeff924-5473-4308-adcb-86fdaa98e947", "value": "6144:mkajLyaPIvW1TFpvzYNB1MMB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8V6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391053, "uuid": "357e358e-b1fa-4fea-b33c-8eb1afdeeaa2", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391053, "uuid": "0631c562-83d6-4e49-8955-53706ed41769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391053, "uuid": "9e067e63-4d6a-44b1-8dcd-5f5a3cbcfc96", "value": "21aa9ddbeaa38eaa0a6bbb15fbd5b04b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1791ed0-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338715, "uuid": "c51c762d-b73a-4a70-b2ff-d1eb42c409bb", "comment": "Malware payload (Loki)", "value": "3290ea2f8c25969576ef448c349d21b9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338715, "uuid": "033f972f-0fde-4692-bfbb-0ce09496f2e8", "comment": "Malware payload (Loki)", "value": "6cf15f8e49bd45f59eb307638cfa3cf27c0f2af263e3ff1501166629938fc26e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338715, "uuid": "4da4760c-6f98-4afa-8b31-686db7810dda", "comment": "Malware payload (Loki)", "value": "c8804509a5d3a303160eedc6f30cd7e9b67dd5f0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338715, "uuid": "8eefde96-61a7-4966-a393-5fe66e1a2b41", "comment": "Malware payload (Loki)", "value": "632e9019e8d4b8be114b5c143871157df9611c5119b42d838608471a52a15ebfd83ff830c19db4f1caec5ab80240d544", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338715, "uuid": "b313973d-db28-4508-8e4a-7b05fb4b4c12", "value": "T1D404128EAF15D6E4F2E1E07D51B66690911EAD57327C370EB05E36B4883D0D102737AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338715, "uuid": "822ce36c-3e13-4281-ae38-ec8466920b15", "value": "3072:KRj/2L0Ko1P+o4hmfgN8z5SwjJGejhhCHvUyBdpX82fTnp0dgzgEdVSHO3otO:euLSP+oCjO5tjh0MyBfTp5zVSHO30O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338715, "uuid": "f933bd9c-c91b-4ef8-b191-30e5883beacf", "value": 188200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338715, "uuid": "1833ed82-960b-4425-affa-7933691e0a49", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338715, "uuid": "fb6d6c12-3c61-4304-9abe-b4c279a452f2", "value": "Remittance advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db76bdf-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337071, "uuid": "c07ae789-7c10-491e-a5b1-fdb2ba3ba2bb", "comment": "Malware payload (SnakeKeylogger)", "value": "3c425a6ea175f573153ad66e2d3ab7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337071, "uuid": "d39912f0-2511-4f75-ba9c-b66c6315fc03", "comment": "Malware payload (SnakeKeylogger)", "value": "6d1c0e7f2785ec21d95109ad79b519851cb81f6b82a4cb8b9bb4d9f8d7f81713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337071, "uuid": "8c8fc65a-46ab-48b7-ae13-03616bc87e6e", "comment": "Malware payload (SnakeKeylogger)", "value": "594505c47a1504444e007f5ff2e90c142de16930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337071, "uuid": "f05c94b9-d7e5-4315-a3f2-bedaba72f434", "comment": "Malware payload (SnakeKeylogger)", "value": "97d83e4f91a1bc9b0f1a5713fdcbc94f7654ce555aace766156424f9e60e1d619ba4bbd3135acdee5ccbe2d096438cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337071, "uuid": "2d64b2be-4704-4a6a-bdb2-85d10487c466", "value": "T12844121063A19077F8F35B368D778F3B1FFF856A09A84B26179061897CB21C2685F662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337071, "uuid": "b96120ef-4856-4b2c-90ca-2bebbc4a819a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337071, "uuid": "8c6e6588-ab2b-4e1d-9d43-e0b9e121889f", "value": "6144:LOtIO1AZD9nzE58WvHgmXTTT4r+8i73psH46vD4rH:LOL1AZD9noWigycMGHPvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337071, "uuid": "f8d5eb95-489d-4fde-9280-0bf6a6433e48", "value": 275407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337071, "uuid": "c3a66a91-284c-4a76-910b-aeab63ed1344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337071, "uuid": "35633b4a-c358-4f46-a2e7-094a92a7a3a2", "value": "INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d169ce13-d226-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652382470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382470, "uuid": "c2487e76-62ee-4388-8eab-afe43557e2ea", "comment": "Malware payload (Mirai)", "value": "a8f74c61523e5132dd040850e050e03b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382470, "uuid": "76b4ea1e-b999-48f4-8d07-6cf8542546bc", "comment": "Malware payload (Mirai)", "value": "6d41836479ba5d953139efc90f580c58eeb3c2a83d32e5bc46f913825514be88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382470, "uuid": "bed455d9-5e9d-4f70-8161-9e6945595fee", "comment": "Malware payload (Mirai)", "value": "4a17fdaf2bd3431302fe6bc6474e2e514d155a50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382470, "uuid": "842d47c0-38d3-428a-8d20-7bf3559a7bbd", "comment": "Malware payload (Mirai)", "value": "77e4b073fb634a598c859880d2ce4927409b7a0cb9b3bcad65cffbd90f0455bf0c09264e03bacec31c6345a8734503a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382470, "uuid": "80b7de5f-7851-487e-92b8-1f974b563172", "value": "T13553E781BC41A629C7D11777FD9F559E3700A3C9E1E932538C240BA07A8F94B0D6BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382470, "uuid": "9a7dfd88-3802-48e6-8b46-62dcd530de75", "value": "1536:GogI5uRJ7lshCKotdsVKQRddy33eZtQqQotu:GogI5uRJCQsvXy3w3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382470, "uuid": "e859cdf6-c769-4e50-96ec-f8d5a3e036b9", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382470, "uuid": "99a6f090-5225-413f-ad69-103c244fa407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382470, "uuid": "319aa697-5d9d-4506-bd18-310e2c21c942", "value": "a8f74c61523e5132dd040850e050e03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b462e8-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652349279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349279, "uuid": "c62a8b0a-f63c-4026-bdc1-d76b2b33f0a5", "comment": "Malware payload (Gafgyt)", "value": "5cac0f729ac7583e810ec6510d3f2c9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349279, "uuid": "640fab8d-cc37-443f-bb41-d693b82eddbe", "comment": "Malware payload (Gafgyt)", "value": "6dc64c4b24483041dcf64893d488bb1c9361819f8ea493509205957a463cd765", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349279, "uuid": "7a4a1f26-8de1-41f4-8d2a-e78312535872", "comment": "Malware payload (Gafgyt)", "value": "aace21db7339315b59e3e87f1848594a1b646d23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349279, "uuid": "1db4fe98-9daf-4614-a184-0a58b05a4c2a", "comment": "Malware payload (Gafgyt)", "value": "1561be4dce85a0a8d23583027db2956ab31ab3c2764deb72b2b773ddb5bf275aa97c5f9db5193f90dec594cddf866944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349279, "uuid": "e3e84a33-2ea5-4661-a431-e3303cc5ec84", "value": "T14BE31805E561471BC2D223BEFB8A419E37332F68939B33255A347BB81BE17AD1D39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349279, "uuid": "7f043384-a628-4d4f-9efa-45e892da4237", "value": "3072:u8CIjUZ7tdneRo0SablCvPWAcCbxhLL++Xegm3k9mlVQdFRYCNb:upFnKCaUvPFL6+XA3k9mlVQdFRYCNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349279, "uuid": "45ad7a64-076c-4f41-9dfd-ef9d9355217e", "value": 143929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349279, "uuid": "b736233e-63e5-4db4-a7b9-811fbed089c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349279, "uuid": "773a2894-19b2-4846-a854-c1663c4f0d3e", "value": "5cac0f729ac7583e810ec6510d3f2c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c23f73-d20c-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652371250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371250, "uuid": "76f051e6-f780-4031-85b2-b4f72b6527fe", "comment": "Malware payload (YellowCockatoo)", "value": "aa08d0c41568d2c709ede00552b4d184", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371250, "uuid": "a243caad-2356-4593-b167-e60b6517378f", "comment": "Malware payload (YellowCockatoo)", "value": "6e96dca82fb927c4cbb3e96f922130a3aa72b1a5d1660bc997f27dbd90006a88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371250, "uuid": "0008f242-27f6-4de4-9c8c-3a38bfefe823", "comment": "Malware payload (YellowCockatoo)", "value": "847c33fe29ec952553ddfb76540b02c178c04f81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652371250, "uuid": "520b7913-7ff2-47c9-b765-468e7231dd15", "comment": "Malware payload (YellowCockatoo)", "value": "dbb92363f4fc9d9d364ed64542947515d4da44d9428b5f4516702e8ae215c86b3fcac3770f5fe5587a436d2d8e0014d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371250, "uuid": "24bf6285-a1a7-44e1-9589-ad0915c20027", "value": "T104F49A61BB8CD9909F2C1FE8209F2F34C316EDA7C442B79369A170F1FA299545B112CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371250, "uuid": "a56665fa-2cf8-4786-a478-250771e33429", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371250, "uuid": "cdad0c55-f884-4ee8-aa13-71b12ad4f7a6", "value": "12288:hMIv8rxnRMwqNwiTInfbHsapu1ZemE5zEgOePd5MRE7KCL:tLTInfL+gmg/OePzhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652371250, "uuid": "c3f166c4-365b-4051-abab-4d50b4fbecc0", "value": 734880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652371250, "uuid": "9c2955d2-625b-4fe1-8dbd-c715f79cda39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652371250, "uuid": "cafa2be8-ad44-449e-b7aa-c29699f2f66f", "value": "6e96dca82fb927c4cbb3e96f922130a3aa72b1a5d1660bc997f27dbd90006a88.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c3e49e-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340742, "uuid": "630f4f7b-88e0-4ab4-a706-ed1d0c773972", "comment": "Malware payload (Formbook)", "value": "bd445ce54588f3ea14c6ef52fe6470e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340742, "uuid": "32f60e72-8591-41a5-85c1-d986a4212d65", "comment": "Malware payload (Formbook)", "value": "6f1306a431ab5e872fffcd98420fb4c8d4e0959b11d2923891ddc31b226297d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340742, "uuid": "39caaea1-7d5e-41dc-8ee1-1b3e127e52d7", "comment": "Malware payload (Formbook)", "value": "650674b010d83efca4a7345de18ba5875f61bbfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340742, "uuid": "0b1d0ec1-4427-43be-b24d-a141e60b3d8b", "comment": "Malware payload (Formbook)", "value": "5a12dc700421060b55b0e143886e7fa26443ad0316c09839c8b755b2ab4f04b18a4e8cd747cf2589de9579fcae6a4836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340742, "uuid": "aac98972-551f-4fe8-a5f8-b1fce52acf64", "value": "T187441274A2A5D773E5B217716E3A2F2FC9B3C521A550921B0310CBA878B73E1E50F687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340742, "uuid": "48592bd0-0773-4a66-9ceb-0517bc7f52b5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340742, "uuid": "e3bf9ac9-c886-453b-97f7-2b36d99c56c8", "value": "6144:LOtIOhneXvag3D7xc0ZV+jhB1WiHWyOl/W+qd7e3+tG:LOLh6PD7Oz0iHWJHs7ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340742, "uuid": "b4aeb0c1-04e9-4316-97c4-d44dbd907e0e", "value": 274634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340742, "uuid": "c43970f2-53a4-4bea-88d0-31a2f671d4b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340742, "uuid": "1cbcdb76-42ce-4996-8d53-b450517cc746", "value": "bd445ce54588f3ea14c6ef52fe6470e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a467100-d203-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quak)", "timestamp": 1652367265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367265, "uuid": "762df537-c181-4849-a637-9ba4f97818ca", "comment": "Malware payload (Quak)", "value": "3c0447ddd99de6f16b987819421fc039", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367265, "uuid": "19600539-d18e-4dce-8cdd-d6f60dc33c23", "comment": "Malware payload (Quak)", "value": "6ffe6cc4040d5b57a7d45764c361f671025a82261b5f653233687acd27c1a805", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367265, "uuid": "6c9a71e8-751b-402f-8185-a10c503ab9f9", "comment": "Malware payload (Quak)", "value": "35f03a5523febaa6999a24fccd4051fefc084681", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652367265, "uuid": "fd426b72-f454-47f1-bbb1-4ed9a9760a67", "comment": "Malware payload (Quak)", "value": "eb47b3c3955a99e4f45e1f4ff25dcf80f7bc3d41d4e679116f006e87d5b90caa4fa55c7d0e8e592822d8a49b8e2b556b", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367265, "uuid": "cb387bd6-83ec-4d7f-a9df-0690e9fc176d", "value": "T1E7059E22F7F1443BC1B32A7D9D7B63A5882A7D012D78948A7BE40E4C4E356517A383B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367265, "uuid": "dbc39ece-3aab-43c0-a3a0-e6c6ce76740e", "value": "2a66b42b84311cd61a2b1eea3a6a1d9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367265, "uuid": "b0aaddea-a82e-4d45-aed0-31792d27445c", "value": "12288:Za/XnRl4R8v0u5snt7/JTRSrJ3exDKgu63BThvkIdIhOhs6j5sifQu8:MvsR4o9XSNuC63B1DMX6OiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652367265, "uuid": "61839491-ab91-44de-9bb3-095715d8709e", "value": 833682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652367265, "uuid": "6bf3cecf-a40f-4235-93e8-0e1cfe8a02d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652367265, "uuid": "4c7b724b-ef6a-4d55-8682-16419c51b9dc", "value": "6ffe6cc4040d5b57a7d45764c361f671025a82261b5f653233687acd27c1a805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b376571-d1d4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652347026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347026, "uuid": "a979d3b1-4c56-42d6-828a-9cf8a522e496", "comment": "Malware payload", "value": "12c0e44d6002f381590e1c8c55a0c7a6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347026, "uuid": "ad290167-efe4-4171-bf04-419e208b98ea", "comment": "Malware payload", "value": "7067fce8e28dd60f4ebd31602a80525eb9c53a8d58a759ce97daaf4f7c3f2b68", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347026, "uuid": "7256f7f8-77d9-4218-86d6-f1b77726b196", "comment": "Malware payload", "value": "9b5e8c4428dbb884825e2e4105a4f6de9689524d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347026, "uuid": "ee886e11-2b05-4aea-819c-915c4a068d08", "comment": "Malware payload", "value": "36b8c909fdb5b2b15cc2279c0d59db5f2cbfad4444a931ff7bfa751ccc56db17b7ecdfd43c6fd4a65c2b75d98d65fc4e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347026, "uuid": "b4bc1309-32a6-42be-9e76-370d5b7606e9", "value": "T1A1B6128BBB18D92FF4369032C5671237F2679D0619839BF6350CB30829779495F1ABCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347026, "uuid": "d047aad2-59a1-4c09-a172-3094da61bba3", "value": "196608:lMoBgFWvu4Bppoyq3WOw1LYoPb/h8xYbnv2Nf791JAN:tBpvuKlquXrC4nEfLJAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347026, "uuid": "4c1f781f-f534-4c11-bf0d-0929cee8e3b8", "value": 10591098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347026, "uuid": "1e53d1a2-3e63-4429-9ef0-4086f42abed9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347026, "uuid": "e2271c7a-2017-4ba8-b2b7-f78d0edcc566", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2286b31c-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652377452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377452, "uuid": "a739b142-c6bc-4e9b-b7ce-9e2c75539d0f", "comment": "Malware payload (Gafgyt)", "value": "3064d5d9c336b5ae3adcc7e141279afd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377452, "uuid": "22087fa4-a206-41e2-adba-8ca5bccb47de", "comment": "Malware payload (Gafgyt)", "value": "7086ad077f9492c1b5a1708dc8dfbec32bc8301182ebdff829fb346ad9b5998d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377452, "uuid": "852b6918-ba17-4150-bbc6-628a72c1ebfe", "comment": "Malware payload (Gafgyt)", "value": "24ab151f344081803f1004243a1a8bfd2c7a5b30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377452, "uuid": "c68f51f0-dc80-4eca-a027-e4175f292ae0", "comment": "Malware payload (Gafgyt)", "value": "4c3250da8e2b2e24e341bcea69384b882b75cc371cc41060d9ed592a2cafa74c0185851b1fba3025f1d57571f4692233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377452, "uuid": "ea9b1c97-70bc-4a11-b14c-d1ed45d0abe1", "value": "T192A33A17B71C0B53C48B5AF11CAB3BF18B69B5E112E26185A10AFFD44373EB12912F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377452, "uuid": "9a3b1a88-6d46-4a82-b7c2-1228debe3a22", "value": "1536:jQdeg4zTCNvfZ/1U2dA2cGLAC0e/PgIhjBhaZUm/VVqDrsEKfz9e:jubWo/102cGZznzaZUm/VVqDrrKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377452, "uuid": "5004f00d-d582-43c9-89a3-ccc2b4e993b2", "value": 101341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377452, "uuid": "3ded1c95-0fbe-49e0-bef8-b6dceb107e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377452, "uuid": "7f49d48c-55e4-4fb9-92b7-537953bb638f", "value": "3064d5d9c336b5ae3adcc7e141279afd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ad0641-d212-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652373641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373641, "uuid": "48563aab-b8eb-41cc-9b8a-1f390e8f36da", "comment": "Malware payload (Mirai)", "value": "34690b93f066e0530b729909de0ac76f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373641, "uuid": "45366796-893c-4609-9bd4-21135ad91710", "comment": "Malware payload (Mirai)", "value": "709e1588bd275dda9ce6a30e110fc4fc62333d4fec02295773d3976e8e5da6ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373641, "uuid": "5d241c30-7a46-4444-b16b-fae39f7b08de", "comment": "Malware payload (Mirai)", "value": "086c7dbb163712ea7a026d5b4a0e137502dc41a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373641, "uuid": "353a8231-1d49-41a2-a6cf-74e37dd5f3c7", "comment": "Malware payload (Mirai)", "value": "7d877d28fcedb9e052c6fcc5cc01ee0436002aa712cd8b5745ee4bc99623b00f83b69ab31d4f79214590d6802d147843", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373641, "uuid": "4c4d068c-d982-4a4a-ba42-c19426821766", "value": "T1A3C2D19ED9E0BCD3C95C1CB6829D29A3189931A033D6177C7B266CCDE7388B2BC4D951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373641, "uuid": "6a94ca48-5269-488b-b107-8b8de56bdff9", "value": "384:aW+ETVLoV9mcN+pCovFMPj2rloEzZUqNZnhujMQZLaRcS6AUQmkT65P9Siy/RWGX:amJLomcHP6rl1UQZnQNL49UQXoPYWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652373641, "uuid": "51d4896b-7c8a-4cdf-aad2-b4fc22f539a5", "value": 27180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652373641, "uuid": "1c0fa2fe-9501-4de3-ac08-0df030546a97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373641, "uuid": "f8d88499-0170-4253-a8d9-ba7e03ef5501", "value": "34690b93f066e0530b729909de0ac76f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ef21fd-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652341805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341805, "uuid": "1e2b86aa-7ae1-47c6-b627-9f8696927beb", "comment": "Malware payload (Mirai)", "value": "e0f924efd5092cc8c14e695261885017", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341805, "uuid": "e3ab40ed-a798-4ed6-a637-368503510f32", "comment": "Malware payload (Mirai)", "value": "71ed2ce3ba5277ed27fed3b04790c7170292759b6624011d91e51d86687a6a8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341805, "uuid": "bbfa3872-5476-4920-a990-179a79d3d911", "comment": "Malware payload (Mirai)", "value": "6225bf32e42aa3b5b8f511a042d38eb81d39cdd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341805, "uuid": "55ba95e8-752b-4b4b-9c30-6ede2f64d065", "comment": "Malware payload (Mirai)", "value": "f2e7a6196ecd5608b89b216ad58e93a76d2eba6208796304773187a14dfe14fb4411128cef218c7b3444a420de4a9e2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341805, "uuid": "d369f1c5-e70c-4c78-a2ca-651cdfe9da34", "value": "T14C635B45F8918A23C5D013BBBA1D168C3B2963F8D2DB3103DE252F653ADA51F1D2BD92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341805, "uuid": "40eb83e4-d9a9-47e5-b785-947ba85bc646", "value": "1536:Naz1bYtQhUIdrnjoQjWm8srMQk/5kFrUg6Ua10B/:NaBbiAtjosL8hR/5kdUgEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341805, "uuid": "a46deaf6-d880-413e-8adb-2a7d548cc26b", "value": 68032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341805, "uuid": "24b06333-af90-4833-b5d0-f5d670701d95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341805, "uuid": "a58f83cd-627a-4dda-9efc-b0e1453a674d", "value": "jKira.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971a1f0a-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340711, "uuid": "3261eb29-9fa5-4bee-aea4-ddc219e960c8", "comment": "Malware payload (Formbook)", "value": "b78bacf2638d6457c841f5de45d34f24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340711, "uuid": "0684a703-d141-4e25-90e3-dbfa2305a76b", "comment": "Malware payload (Formbook)", "value": "724c8192cfe63b7bb33465c0c2b1aa41b8029a714d4956ad27671caf50e7dc4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340711, "uuid": "40842635-93fe-421c-964c-451990680bed", "comment": "Malware payload (Formbook)", "value": "355c5a343e8c7cd3588232034661b73df47b241d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340711, "uuid": "55378c63-22fa-4289-b91b-936b90c0db68", "comment": "Malware payload (Formbook)", "value": "7f3b3a1bb5dc6fd71ddb6ee9fb236c1d341c75b1886d1c3c28028121208779f48c687f5228b466511912ca5abb3df766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340711, "uuid": "4066f10a-6380-4376-ba30-5d5c9aa75296", "value": "T1D44413807614A0BBFD99A3326D3B2B238FEAE97660548A271704594F7CB13E1F50F718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340711, "uuid": "f423d6fc-58d0-4376-9b37-f7fbfb161eea", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340711, "uuid": "ac1fc4b9-f9c4-4554-aa9a-d3389de45145", "value": "6144:LOtIOVi6p81QKG7FoAMEkTI+pWgVOfoY6qbHxxil5Qd:LOLVJ97ZoAM9TI+p7VrY6qbRxWQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340711, "uuid": "3e77e255-f7bf-4dcd-9e4a-87eb9b19b118", "value": 259131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340711, "uuid": "350612ca-a266-4d8a-b181-4b3afbe4735f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340711, "uuid": "deba14d9-1a00-48d4-acdb-06d4b42776a7", "value": "b78bacf2638d6457c841f5de45d34f24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f25a8a-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652376703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376703, "uuid": "9edbf228-80d2-4b1d-ac6c-bd2b66336285", "comment": "Malware payload", "value": "0177649cc256621adaeab864dede0e97", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376703, "uuid": "2c1e906a-abca-4e3b-af41-674768634b3d", "comment": "Malware payload", "value": "72bbdc37d5998adefc4a23c0bf271f17c6c8f64e9dbcaf23f53aa5b9c6691e77", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376703, "uuid": "3be64cd4-759b-48db-b139-4f092f9bdf8f", "comment": "Malware payload", "value": "a260f13f55e6232535aebff06d470ef5af32c312", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376703, "uuid": "d8c9e0cd-cc9b-473e-bba1-0f1fed015198", "comment": "Malware payload", "value": "c12841c6ffb77bf9227e954d28c9410eaa9f9cba2ae8bb21c7f232d4a5fa2e127e13860ca81c2a1d4dbb2734efe91ecc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376703, "uuid": "c801ac16-ae99-4efc-8311-730dda509a01", "value": "T1338723D7F358DE2AED77227249524131266B4D2ACB52AA47291C3B2C78736E40FCC7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376703, "uuid": "2be877b2-5822-488f-8c67-70fba1ca7560", "value": "786432:ibajdlt1L3VF2PSeXmNOh1VZw9zpJS+NraIhmyjqNa3lxrJsmoKS:2K/r2Prthp+cAfhdjcmPcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376703, "uuid": "4294be5a-2c53-453b-ad1a-5a6fcb905244", "value": 39552147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376703, "uuid": "68e3b0f5-2c69-48ac-9475-20509e18e154", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376703, "uuid": "9927a989-f9d0-4529-b405-869f84ff947d", "value": "MOMIX.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89290edf-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317924, "uuid": "48195e3f-f5f5-4ed0-b565-a80f0394a18f", "comment": "Malware payload (Mirai)", "value": "d6fc62c92c1d031c2f11c8553905e42c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317924, "uuid": "050fae39-4a92-42f0-8d05-07563ac13a68", "comment": "Malware payload (Mirai)", "value": "73ae7734a8dc8d1f6b79c847de8704a1cc37d336ee96a5585646ebfee9cfcda9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317924, "uuid": "45b27900-f4f2-458b-b579-070fbca21fa4", "comment": "Malware payload (Mirai)", "value": "63027db58fbfd4911be847f6dc5257601b2ea8e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317924, "uuid": "3d83cc21-9436-4084-b683-71d4fbc127bd", "comment": "Malware payload (Mirai)", "value": "f0ef315564c13d89e4dcc2cc3cb66c4f59aa51c98c120f16e45ca3ba9fcb52bc4cb2aed578ee59eb03399ab25b6640ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317924, "uuid": "58eecd43-3231-4564-a679-9fedb1010511", "value": "T1DAC2E1A04B416132C5E00A71FAFA87429342A5BAE6EF24A1131D10E9EBD14571F3EF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317924, "uuid": "c98dcefc-e17d-41be-91d0-42ec5062b7a5", "value": "384:4wxhjLMkxY4eqtQcpSZAue9Yy3H3+px/c3S0BFOYrimdGU5Ezz:48Fu4eqfcqYkOpW3S0BFOz3Uoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317924, "uuid": "72f06633-d95e-450d-b460-3e5ea08b6926", "value": 26604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317924, "uuid": "27bbbd93-509a-4a81-a2ea-d962b38d46f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317924, "uuid": "178bf523-0ae2-4354-bdca-71f4989ffaca", "value": "meihao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3cb3a7-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363616, "uuid": "80935ee1-a6c5-478f-8de6-4806dd3cac0b", "comment": "Malware payload", "value": "4b415f2681948a994dd3d299479ac89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363616, "uuid": "92f5b689-6c6e-45bd-8c15-909d349bf0ba", "comment": "Malware payload", "value": "73f764de0ec4a6f02b27fb8e6eab27dbe9bd4c0f5d43464c997f1f437c0ea996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363616, "uuid": "3aebc1b4-85fb-406c-a697-5f38a3e36a42", "comment": "Malware payload", "value": "43f36716b656dfab5e1cd287f404878be54e296f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363616, "uuid": "2b253675-cb56-4fe1-afa3-052c2d8e48e2", "comment": "Malware payload", "value": "6651b658f1b0ba52c99eae58e47ee835ce296b223e79eee29bbf49aedd865287a5fbca285c161f6630a5540fdf6b5ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363616, "uuid": "5c1b6ab5-dd75-4419-9db3-f7a6ae618841", "value": "T17892E70137C48222D6BE0F79C472C7388B3DDD451A22EB1F5CECAE7B7D6A6858A14671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363616, "uuid": "89b493ce-d58f-4efb-b4a5-341e70b3fb39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363616, "uuid": "11bb2771-e205-4b1e-8492-cf99c1f9b810", "value": "384:HpmJRTSf71qz1SdZd5zGOirQ/Q8qTcTdb7DDuNTnJuud24J:JmJRTSf71qz1SdZd5qZ+Fxu04J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363616, "uuid": "5671a631-1e62-49d1-b174-d8a5d08f863c", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363616, "uuid": "d0d191d7-8f18-4296-86a1-40f0baae1835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363616, "uuid": "57637890-c7a6-4abd-acbc-92e8ec70cea0", "value": "73f764de0ec4a6f02b27fb8e6eab27dbe9bd4c0f5d43464c997f1f437c0ea996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9719a56d-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652337275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337275, "uuid": "e8a8cb16-a6e1-4773-b27c-df4d814f4acb", "comment": "Malware payload", "value": "3b846d74f72668b738143f6151a2d16f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337275, "uuid": "03b34792-018e-41d2-98ef-b9e66c638cc6", "comment": "Malware payload", "value": "744bc6bbc861cc8c7fc7048e0bfa7cc1312ad687c77f734681d1db70edba8b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337275, "uuid": "8ef5f587-ffe3-4488-a287-7213d389a71d", "comment": "Malware payload", "value": "fba0bded26af002ebaeedaf010dca814245913ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337275, "uuid": "5b4f907b-5fb7-4df6-bc16-1fbd6bbaf41f", "comment": "Malware payload", "value": "52ffd969a3525436db0524d1611dcd4833fb422979560ed40e7228a15ae75a17d7dd22c06798cba8f2680d9f2ad1dc3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337275, "uuid": "cd44d93c-542c-4810-800d-6f0087aa9553", "value": "T1A00612BE6248375CC41AC8B54823ED09F7F5661D0BF4E6AA71C7BAD07BDB805E602B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337275, "uuid": "207fbff6-184b-4ee2-9d3b-63a0db0231e9", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337275, "uuid": "002c824e-19d7-484f-89f0-1359a1651a36", "value": "98304:4/zq2YlrotCEo46V4bGLeWq3u+NwrcgK1DGYsD:4tYlIlo46WeeV3u14giE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337275, "uuid": "00a3befd-e38b-4ba9-80d1-ccc00e191ac0", "value": 3684352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337275, "uuid": "4a72af9f-860b-4157-a4b9-3b4157385b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337275, "uuid": "db05d290-39bd-4d1a-a503-3be4cc6616a3", "value": "3b846d74f72668b738143f6151a2d16f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7551159-d23c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652391983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391983, "uuid": "0b061b8c-335f-48ea-a2c7-25ec683e28e0", "comment": "Malware payload", "value": "01fcbfca263b93cd045959954e91c0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391983, "uuid": "e6970025-8f90-4a9b-a904-3eb8ff609acd", "comment": "Malware payload", "value": "74786b31012fc87e502acccb3e33629a53a8d9ce1e3f41e693272026a9f78501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391983, "uuid": "cef6eefd-13da-454f-a27f-bab433d2edb1", "comment": "Malware payload", "value": "60a696b25262bd81152eddeb797400aee3a674e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391983, "uuid": "0a0146c7-38a4-4afd-8a51-fda835288399", "comment": "Malware payload", "value": "9a2653a0504503821b79138b382e9cbfea68966224517dcf871c4538582a432770e913c10973a9f8be2f61b1b7d08d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391983, "uuid": "5a8322b7-7529-4c7b-bf0a-55a4bbb190d5", "value": "T136D4E9207FEA4529F1B2693DCDBB2233C3AD72631B17734A751122861E135A9CDC36A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391983, "uuid": "1d94cd38-4f1e-4d56-936b-838cdedc384c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391983, "uuid": "20a95274-750b-466e-bcfb-bbe4bb881027", "value": "12288:bwsOfw5XwIFz20S/DEZzQQNXZJJ8c45nVx9mJGJgahg1a:3wIQ2XTh45nX4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391983, "uuid": "1ccef806-2326-44c3-bc82-8f839fcb6053", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391983, "uuid": "3780ab93-6b4a-404b-b38d-9a18b1387f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391983, "uuid": "779901c3-5c55-41fc-8a21-df7f72335fcd", "value": "74786b31012fc87e502acccb3e33629a53a8d9ce1e3f41e693272026a9f78501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ae3900-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652340308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340308, "uuid": "91068a73-7b1e-4b68-94aa-9e01951c29ee", "comment": "Malware payload (GuLoader)", "value": "2fc6f3477035823ff7864187b5b2a5cc", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340308, "uuid": "a2313557-0199-4f6b-b50f-316a85d834a5", "comment": "Malware payload (GuLoader)", "value": "74e1b9fa91b0840706b7418b8604d76efab886fec1704b8810ad389aa6a9cb9b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340308, "uuid": "43d0c9bf-83c4-4f2a-ad82-b3c99a5f02be", "comment": "Malware payload (GuLoader)", "value": "8e6db7c18a5725e795d7421baf84cae637fbcc53", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340308, "uuid": "af793456-7b5a-4295-a22f-8f787381bf1d", "comment": "Malware payload (GuLoader)", "value": "b12122611439538b219a0fb5e4f421c839184c0b6446d14c5b6a936bb9398d0089bf03c0187c2f71d7bd9c6a90b1f847", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340308, "uuid": "345772fd-90d6-4815-9b7f-1955b8b8f934", "value": "T1C6449B9182B1AFC891F93EDFCB0E8621B2409E65D3D7F1585AE110BD7FDB2E95306290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340308, "uuid": "df7ed46e-3d07-459b-a8c6-d2d89abcbcee", "value": "3072:JZ4QJqxguxSEbvyZItIzvQd9EBHBD2WUZ0EZkBY42AjaNBQUkll0Z:JZ4GIgubKTcE2W+QY5jrQjllk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340308, "uuid": "10c69f84-c555-46f4-891c-1f2c8e4e7995", "value": 256454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340308, "uuid": "5f4a2740-56de-49c8-b29d-2a81b347d69f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340308, "uuid": "3f649119-8403-4a98-a1da-c0d71eab7a0f", "value": "doc_65398086_4190362045539.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ef419e-d228-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652382984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382984, "uuid": "f64dcecb-8132-4fdd-b328-f403bc2a095a", "comment": "Malware payload", "value": "787d5448bee6ba087c0bc270bf67d0ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382984, "uuid": "22cb2d88-1189-44a5-a3b6-644ecee87536", "comment": "Malware payload", "value": "755eba67df20bbbc9159b339eaaf96352b37db1009c493df1b352271a02d4d82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382984, "uuid": "307c026d-3e8b-4d46-adbc-7e9d6028ba1b", "comment": "Malware payload", "value": "d3c9b774c0fd616d6e4c8fdfae28424fc8cde959", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382984, "uuid": "60d92615-022b-4d34-84f9-c9c81b1f5b9a", "comment": "Malware payload", "value": "2044d23c99b5eff9c80f6f22495ada6b395f41fcc1837e54b3a47c57199c7ce7a261c23ebebe790fbf02ae24365028cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382984, "uuid": "6d9758ee-737d-483d-bd41-2fb48b85e688", "value": "T1342402247BADDB1FC3584676BBE106A43360D02D7B037B6FAC84828D5C863F85C64B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382984, "uuid": "11762e2d-ce47-4fd4-905a-2c54e4873c97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382984, "uuid": "faad650d-62f9-46df-a18f-3136dc9a20f7", "value": "6144:s/N9AgaFmEJGls4W07ujo0UNwn9SxSj87s:6OFFDJGCtjo0Z4ojl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382984, "uuid": "17d96a88-10b0-426d-88a2-9201bd7c8dae", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382984, "uuid": "5912a439-413c-44aa-94db-eaf98a1f2e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382984, "uuid": "241029a3-002c-4588-81d0-3aa4b3576f4a", "value": "787d5448bee6ba087c0bc270bf67d0ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871b65d7-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340684, "uuid": "92ce2ad2-2195-4a1f-bf76-c080be815e85", "comment": "Malware payload (Loki)", "value": "e2257ee2a1abc09410b4685fbc9ed0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340684, "uuid": "e0c7ae9a-f5fe-48b3-92c9-aced82f4c518", "comment": "Malware payload (Loki)", "value": "757fc87b84637e676cdde3f95c42fbead2a1cce23c9b0b8026bc16787c12d216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340684, "uuid": "77017cc8-a148-41e5-94d9-afa6cff9af6c", "comment": "Malware payload (Loki)", "value": "f956c7eae8129bdb61d2c821181b673ed4318786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340684, "uuid": "e42308cf-7677-47b9-8ad8-47a67e9091f3", "comment": "Malware payload (Loki)", "value": "718a3f748321b9cc2e61a559c1b34d70b4d5dd85ad82650a1f1a2a97ee4925bfc15e7301de8cc4e40fd76541b59d7839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340684, "uuid": "51168c6a-9978-4ae1-8a68-9ec6e158e825", "value": "T199449E10BB90C034F1B712F5497A87ACB92EBEA15B2455CF62C42BEE56356E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340684, "uuid": "329ed759-3c6f-454d-be2d-f6b7708fde2d", "value": "dec01b4c0bbaeca92c394d5a0239de06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340684, "uuid": "b9b43372-423f-460a-9f33-e082ca9c2f10", "value": "6144:su6feXkrvlUyagKJ0+iGZxo8ysYuJy+Hlb2o:s6ENUylKHiGZhysYbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340684, "uuid": "24793775-9168-4c29-8be6-ae84ee1494f5", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340684, "uuid": "748ed5f3-f422-470c-9407-daaca979ade9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340684, "uuid": "04133db8-2b23-4f3b-a84f-adaaa8b4f4cc", "value": "e2257ee2a1abc09410b4685fbc9ed0e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18c44a2-d19f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652324515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324515, "uuid": "4a1fea2f-0eef-45c4-ac4f-be15cf1c08b4", "comment": "Malware payload (RedLineStealer)", "value": "82d65f29a9c8a32b0cf05cd36853cc8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324515, "uuid": "9d0626d6-0b32-402e-8f03-77a9f93f49fa", "comment": "Malware payload (RedLineStealer)", "value": "75a619f46f78e4ff021ee5adc139fda3ef3b68b0c9bdc73c04c387b26b66e20c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324515, "uuid": "0213a8bc-9f39-48ac-9f4e-566b8e220626", "comment": "Malware payload (RedLineStealer)", "value": "9d720ed8a0ad1bd948822c77ab8c66fd7d154dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652324515, "uuid": "cbad809e-8390-4953-a4b9-7f5e061d5782", "comment": "Malware payload (RedLineStealer)", "value": "f66acb871b53d4d9eaaa12c5409e673c4522c3ebf8642fb31d1b7d21585a0a147b9c6c1cf004ad6fd2e35a40c6985a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324515, "uuid": "060bf347-d9c6-4416-87f9-4442fe349eff", "value": "T1895548BBA701E52FF213F070915D9A25682227312A1FB89B67165AACD32F1C1CD35F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324515, "uuid": "bc036285-103e-487a-aa21-660ccbcb6221", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324515, "uuid": "c5a3ce9b-de12-4405-b46e-6593e48697c5", "value": "24576:mKz1hqnBov4IKFI4KteCF/rdPSVUQoxvkTruXMldMSbeY4zqrUF/vYP/JYgdy8D1:dRhUov4IKF9CeCdPlxc/KeH4zqrUFoXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652324515, "uuid": "e7170e0d-78ba-4f6c-9329-293d1ed84eab", "value": 1399288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652324515, "uuid": "04877b62-28e7-4bae-b8e9-7ff3b3093540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652324515, "uuid": "91567e33-f432-4596-aa7a-bd5dce1813c6", "value": "82d65f29a9c8a32b0cf05cd36853cc8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a95b2a9-d1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652350085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350085, "uuid": "7003ac07-fd67-4f0e-87c8-e171b89fe0c5", "comment": "Malware payload (AgentTesla)", "value": "11df57ea001a507aa325e15f015cf45f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350085, "uuid": "4d94d202-4110-4d1a-b060-f3274eb0873c", "comment": "Malware payload (AgentTesla)", "value": "75d2387a0e554538594c51228aeebd51676043b25de90da4140bea4b4c065e75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350085, "uuid": "b102ca36-9751-4be1-af65-c48c1984a71f", "comment": "Malware payload (AgentTesla)", "value": "9c1150ccc121ecc10a7539893b7cfe63774c30c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350085, "uuid": "e80016d9-ffcb-4767-bcaf-8cc820986565", "comment": "Malware payload (AgentTesla)", "value": "8f35a791147dc69d5a80144fca380214aee596266a8a92a47606f8f8e51a44d7d5bc38cff289965c75f05c026a2ccbd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350085, "uuid": "3ff0a7ec-9e55-4b04-b6b2-b7cf99ce2a07", "value": "T1B3F2A4D27FAC9214F2D3B63E86F2D14052A3BE565872C31A74B5F30A1D32356DE7A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350085, "uuid": "07916623-5ba8-403e-b2d2-abc6408afe62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350085, "uuid": "784b98f5-b77f-48ac-9857-ffe023763f02", "value": "384:s+jtNMOL3A3wBB0Z1T08vuREQpEObkbLmWUUuShzDmTQKMqWWc4FQk7fs:vtNMmB01vEE0E5bLEezEXeUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350085, "uuid": "0fc62698-b297-4d62-a868-754bdf72d536", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350085, "uuid": "4e1f6803-4b80-44f6-b9b3-de2b75d5a738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350085, "uuid": "239cbfdb-aaa8-44b3-836d-424f286b9675", "value": "MT02573003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d14d65c-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338762, "uuid": "a4260675-c1b5-404a-b8c4-818434c13a64", "comment": "Malware payload (Formbook)", "value": "fa7ab264bf53899976f66115bf6617de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338762, "uuid": "68c70a98-d2a9-45bc-8b89-4ad44937127c", "comment": "Malware payload (Formbook)", "value": "7773e5bac184ea9cc17f975d498d57036928f680ca842acba387c0d3bf46ec16", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338762, "uuid": "58f97df8-851e-422f-8aa5-3b781c9d3f11", "comment": "Malware payload (Formbook)", "value": "f7c2606a1ec47aa1181cbbf8d74ec7da42547141", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338762, "uuid": "c7b0bf8b-f5b5-463f-8b30-66ce1175f832", "comment": "Malware payload (Formbook)", "value": "a2611deba39336665870cf3bbbe2f4af76a661a5c99ff117b53507f24f5c811b37514965c87ffe1c5251616416ba9721", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338762, "uuid": "01a0ade2-e03d-42be-9a4b-6dbe8132e4fa", "value": "T1A22412F4BFC4E892EEBBE4BC0CA3C1034AB2DDD84A11A05C911531BAB771D3566A5637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338762, "uuid": "1b8e5109-469b-4814-a5e7-86e147374456", "value": "3072:SZWuM+2rlI7NW60GXDucslQkUWsMJg4g28JJvMQZN2JgsXiURpEk7Hr2RMZlRgj7:DT+2rlFGXScHkzo2mvMyoIk7GM3ijM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338762, "uuid": "eba5ff28-5c88-466c-b5ae-cb1be7edd1ae", "value": 213304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338762, "uuid": "e90177f2-fd13-4fa1-92eb-a3633a1a223a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338762, "uuid": "6d8296db-a0dc-4838-9ee9-2fb013dbe36c", "value": "EmailCCRO59INGB000099990522077721726280.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cf6d37-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652366443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366443, "uuid": "d9887e89-f43a-47c1-996f-1263dd0c8606", "comment": "Malware payload (RemcosRAT)", "value": "dcb8bd0c581417e956603b7e140979fb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366443, "uuid": "c7c30b4e-a761-4b86-929a-58697cc9ceb0", "comment": "Malware payload (RemcosRAT)", "value": "77c2b80009f8dbe9d42283b32bb93decbe26179a171c233c078c49bd629bef6c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366443, "uuid": "d2114e4b-d430-4ee6-bf2e-746693253932", "comment": "Malware payload (RemcosRAT)", "value": "d3a39dd604492f6d35530e15db917fb320ab4797", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366443, "uuid": "0799de12-864a-4156-976d-4d3ff93c7301", "comment": "Malware payload (RemcosRAT)", "value": "a2681494b5b8f0898537f02a37c657af4f5dceb542231c750e742088a19e226c1bd6be2377acc1c8dc71ca83adb65d2c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366443, "uuid": "8662a704-d390-42d6-850c-4555bd28da82", "value": "T122040252FDE687DAEBABC87A94428C3A5A61FE300E375CD070423F19177A951129BE13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366443, "uuid": "de5b28b0-fa9f-4656-98c3-8d9843006884", "value": "3072:Eg19eFD/gpjLDAJhu6uMHJeArq9/BjDcIqdEead70ZXk9xHYFombk2CxsXUV+8:RUB/enViLWBjXziZXkvAjdC+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366443, "uuid": "407c6255-baf0-4f39-bfee-600838326da7", "value": 188136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366443, "uuid": "23558cc8-2256-49cb-8f16-002b09902a41", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366443, "uuid": "e1b7bf4c-3771-4c9c-b664-2a20474ad65c", "value": "Invoice-TransferXDetailsX13052022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b32031-d1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652364252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364252, "uuid": "89b3112c-4389-4095-aebd-6c971d5f4dc6", "comment": "Malware payload", "value": "502b53f7a1a6067e9c3ff6ce65887210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364252, "uuid": "6ab4321a-6bbd-463d-b1d3-3a750a929454", "comment": "Malware payload", "value": "77ce8480231a3e56131d919584b8661028e8c5dbfebb76cbfc64416c3589e8ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364252, "uuid": "1f51299e-1329-43cb-b25e-f957fc08962a", "comment": "Malware payload", "value": "31235fc78aac5b366142514cfc9a2e162d506ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364252, "uuid": "72eb3da6-f029-4804-b6b4-bf6b6a1c1881", "comment": "Malware payload", "value": "d6bd001d9ec9c40d6d8a616e23ddc5ecd48deb39378d790f10b2a6e7d160d4b4b7172210118d5916dac59ff9e7cdbe04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364252, "uuid": "3a3e5ce9-a66d-46b2-a5d5-88f65d718a16", "value": "T1C244BE5213FAAE0FF8AB2F3CE8637519C6F26F352D25B93DC99C30A614315C44A46762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364252, "uuid": "c2fe2d0f-d93a-499c-89e2-e636f0e07eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364252, "uuid": "5f389c04-ea1c-4927-b463-848b096e174f", "value": "6144:YRAA/cALHzDLqiRTON/vY47++t1MC4R/utYa99S2UH8:6AsLH3LqiR+X7vdEW6a99E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652364252, "uuid": "8c1ef74a-6d08-4ea5-9b74-c138a99c8333", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652364252, "uuid": "bd5e1b0f-88d8-4edb-8bd4-88a4f37bdb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364252, "uuid": "a57f1f6c-91bd-4032-8bad-db4d7646127b", "value": "77ce8480231a3e56131d919584b8661028e8c5dbfebb76cbfc64416c3589e8ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2331ed-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338765, "uuid": "b677d482-5b88-497e-b199-30fcc21a4286", "comment": "Malware payload (Loki)", "value": "fb26e6ae46c7c1db4767e850094ab1c4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338765, "uuid": "6b0f2fda-7d13-4ad1-8852-0efff8ed28ac", "comment": "Malware payload (Loki)", "value": "77e19ff180227804bd4d821c8be7c67c0c1a9a676e24a12bdb5096fa5db8c40b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338765, "uuid": "1ef74ce5-4f14-4bb9-a650-0d7a61416c39", "comment": "Malware payload (Loki)", "value": "dd719a00296a06544b0ea456772fa6ae9aefa827", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338765, "uuid": "cf43eb5e-0653-42b4-bfc1-a5ac55dab1fa", "comment": "Malware payload (Loki)", "value": "4247c5e5794de4eb5779f9a9a4ccc99169269ba18fc0e5c8455b7cbaa5d0b55783e40b871e0fe5af28e9bb3b2cf907f3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338765, "uuid": "bccb3fa4-4fe6-4123-9610-21152f14e951", "value": "T15F0412EBB7E28514C0C475795795BE133503FD0AC9284E6BA6B2321F7A78A4F9824378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338765, "uuid": "70f1e87e-82b7-40fa-be0f-97c2468f9451", "value": "3072:6Z2GV2tTWja53oqPRZIPJr8tW4Sm4MmJyI14a0u1vIHqUXAcgtx0/JrVz/E5:e015oWy6WXhJlA0AHqUXAcgL0/b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338765, "uuid": "5346a2fd-1f8f-4020-8488-3d1888be62ce", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338765, "uuid": "fd70556a-6887-4790-a357-ed8030ae9fe7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338765, "uuid": "4f6db432-5599-47e8-8517-3a13ec1476e0", "value": "Statement of Account April 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a4547b-d1da-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652349884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349884, "uuid": "a17b839c-03ca-4dd9-945d-b7f7d3d0b0b0", "comment": "Malware payload (Formbook)", "value": "d53dc7108fa60b2e36925682ba2b4d50", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349884, "uuid": "473fdd8b-8bbb-4138-afa4-919c943d99ec", "comment": "Malware payload (Formbook)", "value": "7808c4468b4ff213a5c783a4710b5079ae108522cda4919e8d96f19a88a819af", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349884, "uuid": "122139cf-0a5e-43e0-ae04-59cf47667551", "comment": "Malware payload (Formbook)", "value": "a356a19835e8882691fe47c9d89374ba363c9ca5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349884, "uuid": "4ec0fa4c-c519-4d74-955a-198a92d0895a", "comment": "Malware payload (Formbook)", "value": "b2b6f7b48d7da4353fcf12e60df5a084b5216c4435e0e1d20dc9a70de7e94613cce87f982d42593691cf36164901a2e0", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349884, "uuid": "4ed60680-baaf-4229-b33c-cd0de335d83f", "value": "T195A4231DB8EED917B3EE928710FB4A0DC807D97384CA0944122E6A7393EDD0B7269573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349884, "uuid": "43b1a4b1-138b-47ba-ba68-0fedf6e23d0f", "value": "12288:yrq79ImD9o8OmdSjBumxwH4gni6Cm4XfES:eq7uM9o8jSjMmC4gi6B48S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349884, "uuid": "ab034ead-8b16-487d-b546-608ff1103e89", "value": 484370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349884, "uuid": "8248d74c-e14c-4225-971d-45a93b66dd40", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349884, "uuid": "56723ded-6064-4aab-b782-d8c728f4b6df", "value": "FedEx Shipment doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8d1d50-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337095, "uuid": "36208d63-0df9-43e1-9ace-213825da7175", "comment": "Malware payload (SnakeKeylogger)", "value": "c5d03ed43a588514999a66c8eddf089f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337095, "uuid": "251be4ac-fa14-4ecf-9899-59e72bc47a8d", "comment": "Malware payload (SnakeKeylogger)", "value": "7a7583b26129c041b992ebf8aabc52818b9429a052089108b8b09b353fda8b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337095, "uuid": "4bd170b8-57c0-49ee-b580-69d2e2874013", "comment": "Malware payload (SnakeKeylogger)", "value": "40f94ee5185aa5ad37c06889f3acc1974fd3ab57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337095, "uuid": "e3e7b8ec-bef3-491e-90bc-21730527c685", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc742aac6e4fbf1fb0d9a6211fd395f0f811984a0593a10dac50982b580e2cfd2380314f2821bfd448f36bee0eab3cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337095, "uuid": "2a817e93-6406-4c6a-be33-db91c350ad21", "value": "T1EEA4D04A5BEC6C21D13D37F5CB69A16282F2E0C72932939F448590FA5F71B849F816B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337095, "uuid": "7959f783-1a25-49ea-bd35-fc16b8316ed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337095, "uuid": "c1dcd7a1-99d2-4aec-9216-b17799883abf", "value": "6144:4ETMfpi+RMivwBCC6FlQtqTgTg9NGgV7/mr04Nh+YiH4XkrzjY/BEZecV:4KkRwmjQt+TPbV7mrPPi74OZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337095, "uuid": "b55b7ebf-8f1e-44b1-bbea-bd3add012e25", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337095, "uuid": "9e586312-3188-494b-8be8-156440e84e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337095, "uuid": "b5a57833-9230-425f-bc89-dfe91bb91be9", "value": "bank transfer form for $357,270.00 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce93cf3e-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346817, "uuid": "4cb884d3-81c5-4566-9e57-c96d5bc4b660", "comment": "Malware payload (Heodo)", "value": "f1a6efedcb2685ff4842e685b7adae8b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346817, "uuid": "400d1289-64c7-49c1-986a-aaf2554edda0", "comment": "Malware payload (Heodo)", "value": "7b08be616e7e2a845b0108764914907aaa0b6bcb3721a6b12b5e8290261b6c13", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346817, "uuid": "e452964b-31b2-4152-bc17-a7d2a789628b", "comment": "Malware payload (Heodo)", "value": "9121bfbab70b3eb6c9ac3aad7411316371850d7e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346817, "uuid": "8817d244-4349-4438-8ef7-70d8fc93752a", "comment": "Malware payload (Heodo)", "value": "9a7845ba9238647b8613def2471de688153985042c2f26e995c45eff7f7eac24e52620eb74fed2cdd9e56521f5516cb4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346817, "uuid": "7ae10d79-03fd-4fa7-9bc7-ad24b25b737a", "value": "T1DAF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346817, "uuid": "0f47098c-ec53-4bb3-9d1f-148c1d05fddf", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346817, "uuid": "ffe13b7a-add3-4e18-97e5-6fc7b8feab81", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSljNwgraKRT61cKGNx:S4DzZKnH4IRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346817, "uuid": "8e1b75e6-3571-43fa-afa9-3061f2783cf2", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346817, "uuid": "a94c0bea-b771-487e-940c-8de696de3c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346817, "uuid": "2a829be5-9593-43d1-8280-0521b9c54135", "value": "f1a6efedcb2685ff4842e685b7adae8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1b396a-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652349286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349286, "uuid": "ee1e8cc0-cd0a-4195-a907-bcd913500abb", "comment": "Malware payload (Mirai)", "value": "2b7b6c177702ef579f3f1dabcbb9e31a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349286, "uuid": "97b53fd0-fe78-4eef-8a69-2622859ac758", "comment": "Malware payload (Mirai)", "value": "7c83cd4c910b9453d7fc56662c45798c5352e530ee766d4d015e497a7f1ff37e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349286, "uuid": "e5c2ec3a-607b-4928-be49-3a5fa99a2ce4", "comment": "Malware payload (Mirai)", "value": "3fced984599dbf2e7decbb0e9890396ae5a7b262", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349286, "uuid": "c48b6f51-c305-4a34-95fc-2e07782dcbe5", "comment": "Malware payload (Mirai)", "value": "44b9b36fe323a3d0b2a69c9f46a82a0fee09aa6577b77b9d2e8242bd89b9d6b4900efbabe39d5a4a345a84fe16c818ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349286, "uuid": "8bc16715-dc1f-4b17-bb37-d73b7d1fb2df", "value": "T12B335CC4BA839875F4922D32B0679B3247B6E56B1025FB57F37E9732E913B01A21720D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349286, "uuid": "8347e7f5-4d08-453f-838b-19fd583f6193", "value": "768:mmgiFv77uxuD6niAKcaNEaLoxgKzSxkJQGo3iau8j2/yDhT8QBS6gsAXI3N:mIaIDj4pgKqCAu8q6DhNBS6XWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349286, "uuid": "b1883b77-613e-4fc7-b217-f0654dc49dd9", "value": 50480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349286, "uuid": "4ac36858-a4ec-4912-8c79-655d67a8940c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349286, "uuid": "07e5eb58-f33a-4612-bf9a-24b8c588432f", "value": "2b7b6c177702ef579f3f1dabcbb9e31a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96fff91-d1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Blister)", "timestamp": 1652328367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328367, "uuid": "04a0e5ee-c250-47a4-b86c-435e826e829a", "comment": "Malware payload (Blister)", "value": "f3e60f43ffae0656488bbea2861b0e31", "object_relation": "md5", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328367, "uuid": "8fc4f335-a39f-4426-afc4-afe791a91330", "comment": "Malware payload (Blister)", "value": "7cd03b30cfeea07b5ea4c8976e6456cb65e09f6b8e7dcc68884379925681b1c4", "object_relation": "sha256", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328367, "uuid": "1f10a751-ece9-4720-abbb-2a9e4d6b8aa9", "comment": "Malware payload (Blister)", "value": "a3574879c1e0f8543571e22bf4f08ac784f69f54", "object_relation": "sha1", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328367, "uuid": "d57c1afd-142e-48f4-8962-63818decf8ca", "comment": "Malware payload (Blister)", "value": "4ad11251e64e4f1231beab7aa742abb83dd72592d730c38bc6ff744815c1cec2ab6129d51fe08b8ad946ba8f9094f288", "object_relation": "sha3-384", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328367, "uuid": "669814c2-dca2-4106-87c5-ab247f777d1e", "value": "T12CD48D232EA31636CC4FB07695BC63B5E6FCC979C36E537759B0D2716AE1280E624708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328367, "uuid": "bdabc91d-ab8a-4642-93e4-e7839ab79345", "value": "94de5773e8ced8d2906298c9cc253c07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328367, "uuid": "28e3c6ab-58d9-4054-9e4d-f9b50263d8a8", "value": "6144:o8ATpR2nC2z5mMFeKt5Secqr1LGYoKNU9Ne2xIAVmJbLSsT0pUj9:opDCiqcqrNZE1x5m5SsT0Wj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652328367, "uuid": "e7e17f1d-a67a-449c-b3eb-b9fbd2550f15", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652328367, "uuid": "3cb854ad-136a-41e8-9580-86ee10fce073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328367, "uuid": "ddaf3cae-102e-4bac-9ee1-e9be39527127", "value": "7cd03b30cfeea07b5ea4c8976e6456cb65e09f6b8e7dcc68884379925681b1c4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c63c7a-d19a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652322351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322351, "uuid": "c94fcb51-773a-4140-a6f2-2964d414a7d4", "comment": "Malware payload (Loki)", "value": "9cb01794d692106202d74e6d8cea3694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322351, "uuid": "f6ce2dce-f95e-47bc-adc3-088988ba0eeb", "comment": "Malware payload (Loki)", "value": "7d15cac8a6176efbe5b7dc8c4e2837e707237e0e439248b01e3c23a5725accfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322351, "uuid": "333cf1c4-bee8-46a1-b70d-c4f559f4eac5", "comment": "Malware payload (Loki)", "value": "467f0ab84462bbb3b2536cad8519f29789d1cf98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322351, "uuid": "81dd9690-1941-4672-bb40-bbc8e7144c26", "comment": "Malware payload (Loki)", "value": "01f6a90f63620c3d98e64d4192e10d1b220f278142aeb38209bac9727ce1c5c50269cb14844efd92385f2ec50de0bd0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322351, "uuid": "343f33fe-3fbc-4955-9237-ac4ee194e318", "value": "T1A6C4F16D31D4B6EEC86FD976497C2C646A303877622B921F8543548EAE4D783CE242F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322351, "uuid": "3760e9d0-c89d-4b6a-a124-7d96cf5b5d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322351, "uuid": "9888ace9-c55c-4dc0-a70a-7dd8d82f75a7", "value": "12288:c0XptpjyjqqUgPwCYTKMIYiLwsZCCWY7iCPnvfp:c0XPUjOAjYKfZ7iC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652322351, "uuid": "0588e3a6-9656-4463-8bda-d9ae64e5cef9", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652322351, "uuid": "816b24c4-66e5-4301-a1c4-1022ae1db886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322351, "uuid": "9287f96d-2468-4df2-b6c8-65c1a14bf412", "value": "9cb01794d692106202d74e6d8cea3694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f43af1-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338724, "uuid": "e30ec68e-1956-41db-8a56-6099b1baa87e", "comment": "Malware payload (Formbook)", "value": "b1ccc3738197460dbc3d72c7af1a2535", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338724, "uuid": "85412d5e-ce60-42d1-b691-fbee3e533bde", "comment": "Malware payload (Formbook)", "value": "7d174d2c7dbecaed290f03727a401da74d113e1053b92c674cbd7d5930555692", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338724, "uuid": "e1cfde74-89bf-435f-bbd7-20e7290c2540", "comment": "Malware payload (Formbook)", "value": "d989617060d31a22ce8e9ae42614bc8e07da5ad1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338724, "uuid": "53ae77a2-a23b-4f65-977a-1bc4f7437bdb", "comment": "Malware payload (Formbook)", "value": "0846e244690b3e3aa0d346040288255faef5d43fe29fda786cdaf4f43b6842025ed33e2d87f0ac634f954209e560fbb7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338724, "uuid": "794ab42f-17fb-4a73-a2ce-236546029882", "value": "T171D3F18A2AD3A700EDDF2E31A656FA2CBEEAEC468927CF1D144275811BF18BD1D51314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338724, "uuid": "569a768b-7205-40be-887b-1f84946bef56", "value": "3072:FjEamgjDpQd+W/+KUzYajjF0x6pE68UQxkNUYF+suJ:m1gJQdr/Jkl0FLzxmUO+sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338724, "uuid": "07b114c2-470c-4437-8140-70b29eaaddf9", "value": 134680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338724, "uuid": "a64220d8-ed21-4d7b-a933-b8865938d7f6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338724, "uuid": "04515d40-4b0a-4b1f-8af7-33d8a96f9295", "value": "MRC DIRECT ORDER LEBANON.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f743bdd-d202-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652366683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366683, "uuid": "f179df5c-feb4-473a-860f-a23b0faa8092", "comment": "Malware payload (Formbook)", "value": "a7aabac01443911373da10f0d650aaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366683, "uuid": "9ccd36dd-b809-47a4-af92-51fde7aa8bad", "comment": "Malware payload (Formbook)", "value": "7d89765d93937e2344ba112a9c2b1b60802e7c1bee70bd083d025d4b35864f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366683, "uuid": "5f281633-4a75-4ee7-8a4e-a8a0fb397cfa", "comment": "Malware payload (Formbook)", "value": "ebe0d75c7737dc15557b09a65a263ee83c8e0dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366683, "uuid": "b814cbc2-853a-4fe0-9849-44db70f5b27a", "comment": "Malware payload (Formbook)", "value": "cb87be766a67ced0b31a6de7b90e998ab587408888d336ea7050c787f061edea8670dc791af1903299fb5954a93f9746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366683, "uuid": "f2c662e8-da76-4957-878a-42d47aff3cf4", "value": "T14D54236193A2D0E7F9A286310A3F5B660EF9C4B340A9449747E06F4CBCF56815F2FB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366683, "uuid": "84434b11-8d18-4ad6-ada4-7bd9544431eb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366683, "uuid": "8d212fbd-994a-48fa-866b-f1091c491600", "value": "6144:LOtIOgqXTy2q+MlBuy0b8eM72gw0UnH7yNM+nn8qOn17IAfqGysu:LOLd24yUXm2HTGS+ngSqqbsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366683, "uuid": "21d9895e-aed1-43ba-af70-7880e8fe6ac2", "value": 304855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366683, "uuid": "ff7846e9-1087-4207-ab3d-442cc24e918c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366683, "uuid": "c651d61e-0bac-4b93-864e-2add46cb7798", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956bab8f-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652340279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340279, "uuid": "d69b1483-a1d9-4bc2-840e-b675fac05f21", "comment": "Malware payload (Vjw0rm)", "value": "a3b5a2ad93d0cf5fc55df082aae1426a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340279, "uuid": "1d29f825-74a4-4cfb-8f9e-81361a28a5bc", "comment": "Malware payload (Vjw0rm)", "value": "7e290fbf13d8b6ff04da876acfa39bf6896854ed78cffa4e2fe7ef869895d61e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340279, "uuid": "2fe173ac-3cd0-41cd-91c6-09a3597ebcde", "comment": "Malware payload (Vjw0rm)", "value": "14eb4de196342142a2344fabe647b6c6d3a3ffcf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340279, "uuid": "d0700977-31e6-407e-9c46-bf0c78236451", "comment": "Malware payload (Vjw0rm)", "value": "41e7a61deec5411f5b052b95e154b661edb3e604131ab1ce8a0e7f7ffb1e8aa5f8b745ac2deabcadb803e096918c40c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340279, "uuid": "f394b18b-f2bf-4854-a3ea-5cfc48c72cd0", "value": "T1298309E4BF81A09794104123FD29689587F01316D961B2CE365F76132B3EFE9EF9E488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340279, "uuid": "572f877e-30d8-4e51-99ca-e9c8eb581835", "value": "768:B0a5VFUiJhQr8D0+IwhjAKaxAJ/zbYs61KyWCJpaGVDT4C3s+3rQIJXO+IrK:B0kVFBD0+FVFaxAJbbYb1bWQLQQUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340279, "uuid": "9eaf401b-120b-4cb8-9fb6-71841a83ee50", "value": 84505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340279, "uuid": "1b7656ed-5d68-4681-baf8-370a492f288c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340279, "uuid": "991f2640-c597-49bf-84cc-0b5f9d7e6eb3", "value": "PO_30751122.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813e16d0-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340674, "uuid": "cad44435-6d50-4381-bf6e-c1335ba7bfbd", "comment": "Malware payload (Loki)", "value": "f5f2de5391dc5dc8d55697ecc2d85e0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340674, "uuid": "51991045-2605-4ee5-9702-3bd205489de1", "comment": "Malware payload (Loki)", "value": "7e7fb389420084c8d186307502d05cb767293ec80fddabb73d7b1fe9e3654bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340674, "uuid": "008fad57-a6c8-446f-9ab2-736334766c41", "comment": "Malware payload (Loki)", "value": "fedf81c45aeb814ed5afb667f95168bdb39e1c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340674, "uuid": "5cf05444-b866-4aa3-8999-d042de733f43", "comment": "Malware payload (Loki)", "value": "edb50ac69013474d54027f5df6c66882841b34859a4ac32467f418901e8e38cde6368be712d6c3784d01e5a29b914acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340674, "uuid": "30a79c98-f0c8-4092-bbcc-1a66572c4ebd", "value": "T105040160BAE1D0F3DC71A3360D369B628EFDC63151A0A71F4354259C7EAA650EF2AB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340674, "uuid": "e9f3941e-a302-437b-82b4-4564ec067d4d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340674, "uuid": "a03c3cef-5598-46c1-8638-00494a11be9a", "value": "3072:LODZGPEounbjO+ajrG5vTU0h8XnjND0WHdQt0uYNc4B3uNR1SY7+oOckvAY6+Iby:LOtIOFajrG5vD8XnjNACdaJYWw+0Y7+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340674, "uuid": "247c7f53-41a2-417b-97f4-d86f64efa6a7", "value": 183330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340674, "uuid": "1dabed22-a00e-4637-979d-2e6606433407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340674, "uuid": "1b958909-7587-4f8f-95fe-3cb5fe186f00", "value": "f5f2de5391dc5dc8d55697ecc2d85e0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77c3789-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652340390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340390, "uuid": "9962d554-8b81-441a-b7dd-6b1abcf84b46", "comment": "Malware payload (GuLoader)", "value": "746317ad3672cbd82d6c27c85259157a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340390, "uuid": "a2a9859f-6436-43bb-a895-a2da552f3bff", "comment": "Malware payload (GuLoader)", "value": "7f8c325a18b7d3705bb19aa6db444a42dc69a03dd1ae79bdbfcb9405ecd83584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340390, "uuid": "0a2a85d3-8681-4209-9a7b-a2a64a365346", "comment": "Malware payload (GuLoader)", "value": "4e7456b6ca4e428e169f77de9c1e6cc05f409058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340390, "uuid": "866f95ed-08a4-496a-b66d-355457ffbf5f", "comment": "Malware payload (GuLoader)", "value": "d43c2a4e84eecca582401be95acf9c25eb90e0c82784ecd7d6811c7f03ce011c33e6d6b3fdecdffc7d8b251bc4a87d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340390, "uuid": "1d0c80fb-d2af-4960-a62a-e7c690077ec6", "value": "T1230402946730D483FC654BF18F36936ABBE4991A2AE0475F23605B8EBD22341D90F35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340390, "uuid": "d2481315-0d06-4c05-a958-fed5a87551c3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340390, "uuid": "237b29e9-0477-42f9-ae0d-0aafad697602", "value": "3072:gfY/TU9fE9PEtu4bTt2frtsIo9EJM6BPQPmUzo+cPvYbfGCOBVi11v2:2Ya6wTIxeH6BJKMPvYbhMev2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340390, "uuid": "cef6222e-4af7-4e0e-a38a-75541c8196e9", "value": 185272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340390, "uuid": "31fc8ecc-87ab-4e09-85ab-b1168ac48aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340390, "uuid": "99ab26d8-2e4d-4cfd-b56d-b3d663fa23b9", "value": "SD 2477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0ac1f0-d1b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652331967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652331967, "uuid": "1f6b3688-bdfc-486e-93b1-3aa03bdda67f", "comment": "Malware payload (njrat)", "value": "c3b5b082a3aa2ba15f5ea7971d837b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652331967, "uuid": "be163229-5695-411d-a73d-ea670d8e748b", "comment": "Malware payload (njrat)", "value": "7f9ffa637f4e13d1919bea687ac61c2263dfc762ee6bc95bdf6b5ccc4b7e8b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652331967, "uuid": "51a9bba0-9efb-477d-ac54-7539efd49d39", "comment": "Malware payload (njrat)", "value": "11a0c3e6806abad641ebb234233c34edade0d8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652331967, "uuid": "b9826506-6e07-4df1-8f01-040a74a37c93", "comment": "Malware payload (njrat)", "value": "8f706029bee04e9b0153edf4cd40e4a0fa57609d4277404ed89f1cafb9c848763716052b88b79d80a6f3554b618a642b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652331967, "uuid": "374c4edb-9f50-48e8-b1b1-f050622ca1c6", "value": "T167752302BDC195B2C4621C33675AAB10B93DBD202F65CFE7A3C46E5DE9612D0DA306E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652331967, "uuid": "40185211-a69d-421b-aa56-3a876689f125", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652331967, "uuid": "162b750b-d8d8-4e40-bd58-8858629e4dd8", "value": "24576:+TbBv5rUlIE+iKpZW/cr8eAMD6Jf4+MJ04Pc3VHurvl7cDhYABa/znSglHI0UsTB:ABRE+ier8edDiNwDmV07c9YBJuIS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652331967, "uuid": "f00113c2-7a7e-4ad4-ae30-92df0e4a4f8e", "value": 1619900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652331967, "uuid": "3f8f98aa-86b2-431d-b345-d0b55f862851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652331967, "uuid": "7ed91d75-1ba0-4dc2-a812-01b083311121", "value": "c3b5b082a3aa2ba15f5ea7971d837b00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db6b638-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346198, "uuid": "be38bbe7-2cb4-49f9-8d6a-7751fa31d040", "comment": "Malware payload (Heodo)", "value": "a8314dd923274e136937551f9e886beb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346198, "uuid": "9d063894-32bc-4fcd-bcec-276e9d005c7e", "comment": "Malware payload (Heodo)", "value": "7fa2b48352d3b3978964d95d73ea10901dad767f88238e47be0935a4990e586b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346198, "uuid": "d5c53659-dcbc-4bb3-9796-cbedd0898dcb", "comment": "Malware payload (Heodo)", "value": "e34c18e882f19765683cbc63f7463a3ce0524992", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346198, "uuid": "45f1a824-53d7-4be3-9341-1337bdbcfe2c", "comment": "Malware payload (Heodo)", "value": "fe4e52bc1b6dec49b92011e8ac8304985a260a15cd5d64f73c888b62b920528649b2a83e1d8241fa3cb55ff9371348c2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346198, "uuid": "648b8d1d-423f-45a7-b165-7b3e9c5755e5", "value": "T112F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346198, "uuid": "d93a2af4-0ec6-4c00-bd70-0ff56b85b606", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346198, "uuid": "261ed8f7-42b7-4968-a515-54d2ba0678d2", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSBjNwgraKRT61cKGNx:S4DzZKnH4oRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346198, "uuid": "180df5c6-14b4-416b-af17-67429ca43113", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346198, "uuid": "77848d1a-d454-4b83-8c23-bb55277e3d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346198, "uuid": "d45521dd-1c5e-45ed-a38e-8d56279b5d3b", "value": "wK81Oualih2UmOKR9K.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61452cf0-d1c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652339762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339762, "uuid": "e764d326-9bdd-4306-8d46-3fa5218dddf9", "comment": "Malware payload (AgentTesla)", "value": "59d58eddc0cea13703389ba817f9d553", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339762, "uuid": "209acde9-9363-4977-8a24-885b47f759ea", "comment": "Malware payload (AgentTesla)", "value": "7fa76d57fff1250ed4ea7a02f76e716f1465b63ab601967b723f36d4acab5f28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339762, "uuid": "1a560fb1-2927-45cd-b88d-54146b9a89e2", "comment": "Malware payload (AgentTesla)", "value": "47d8198941515a6b12f862f05cb8c623fac7f4ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339762, "uuid": "12f0062b-cf3e-43bc-8bec-ed50ee10f084", "comment": "Malware payload (AgentTesla)", "value": "0238344da77ff25102e7d07bca077e9763348ebdb7b8064e59386ec7d803cb5ef6a5a7f590e6b895efff346e4280c446", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339762, "uuid": "a4fb72c4-a968-4657-b825-0ac96dd8dc86", "value": "T104C412387277E522C66A0B7BDCD420CC0375DF076D63D74768C8366A9A327E249D0A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339762, "uuid": "7c7ab4f2-60e1-4b37-a49e-4cc7acc7718e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339762, "uuid": "89cdbf8a-b8c4-49ef-b934-db3a4e5845d1", "value": "12288:tp1KEOYE20QZG3pkW5lkpiBkuDLdBlgx/Mfme:tTVtxZG31BD+/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652339762, "uuid": "8dafa6d8-3bcd-496e-994e-c5d1eb92a5f8", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652339762, "uuid": "223b8534-cb0d-4f40-ad32-5c6275a1b807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339762, "uuid": "e9cdc308-1cc0-49c7-98aa-ecc81d2e0aca", "value": "TNT AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a69d20-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652344420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344420, "uuid": "7b615925-9b33-44a1-8300-7667a7bd420a", "comment": "Malware payload (Heodo)", "value": "c2c77fb5e3310e0426c2cd7ceae919c0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344420, "uuid": "3583a23f-1414-43b9-a841-684133859b36", "comment": "Malware payload (Heodo)", "value": "807f926e160eae6885585e98714b6432d5ae84a858416decb2e1cbc09ce580ab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344420, "uuid": "aed99eb0-3000-443d-b126-7d7a1af1fbd7", "comment": "Malware payload (Heodo)", "value": "46e064ace6109131f4c2871c43b90f5be2c5e2f2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344420, "uuid": "7eb6c9b2-2932-4d9f-b3b1-166fe29d2b9e", "comment": "Malware payload (Heodo)", "value": "01449dcfa08d7090e149c3770fcc579d12f62ec57d17ad834fd1559d829d462cd1718e1af7ca9b978e89cd947f01cd0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344420, "uuid": "26cacd4c-dd37-42da-80f2-c632d109f9bd", "value": "T111F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344420, "uuid": "aa6acfc9-b15f-430c-b2e8-29cb49a5d782", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344420, "uuid": "fd147c0b-269a-4e77-ad82-c1aa5f64562e", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmShjNwgraKRT61cKGNx:S4DzZKnH40RGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344420, "uuid": "ef2a48b3-6f96-4c4d-aec0-e99e1f109320", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344420, "uuid": "27361164-ecbd-4991-82d9-2733aab01bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344420, "uuid": "4468b105-c742-4648-b5d6-f91432695464", "value": "c2c77fb5e3310e0426c2cd7ceae919c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7862d380-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652316608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "3c96d141-5f98-47c2-8c13-ecd9b2f9fa48", "comment": "Malware payload", "value": "9a6aa62bf03bf004adf3dc5d84d61369", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "d50b339e-8d2b-47ed-860b-1a7dfd0d41b8", "comment": "Malware payload", "value": "80a01a865b3317d22b5e717ad5d97f5a009a637e341cb00447421c88df19a44d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "6560b46c-84f4-41a7-9373-b61a705ba0cf", "comment": "Malware payload", "value": "a6594851ebafcf536d193bb154ae1141055a8f22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316608, "uuid": "74cf8902-60f4-4b74-9d44-dfde762f844f", "comment": "Malware payload", "value": "ab814876ecfd8d128740684c4a053b97b332068de286a106e26ca30c8bda10bc33e8f43724255f726767553691f58485", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316608, "uuid": "b71e71c3-231c-4592-9099-3a71c47e8000", "value": "T14B2294C6B906AA07CAC48136B70E839DBF225709F2EF330767177F9165479370A67449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316608, "uuid": "0cc8e254-93f4-400b-8759-d72c0ea35b13", "value": "192:i+CCeR9Ag1ya8hWOKSPT+rwtsgwaS6LYTm/C4gGA+1v3kEZx4e:i/Ca9AgsdMO7PT+4o6LYTFkvFx4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316608, "uuid": "2ed5d82b-2a88-49c0-b825-5a356bf21f87", "value": 10388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316608, "uuid": "24e7d5ae-bb91-43d1-90ce-e1c546617a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316608, "uuid": "b891a1f7-82a0-414a-a225-c496f8ab1dc7", "value": "Ugliest.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad40fc6-d229-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652383506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383506, "uuid": "f453d702-9c25-41e5-adb0-50500c91ed49", "comment": "Malware payload (RemcosRAT)", "value": "50abda236e90598eceb5413670e4e79b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383506, "uuid": "67ba756c-ab69-4521-b8e5-11113a3f7b6c", "comment": "Malware payload (RemcosRAT)", "value": "821be9512b6cfcb9a82986924e896084be0dcfac185efaa0c4e9fe999272edc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383506, "uuid": "5194503a-2bc2-40c6-879e-21e139060fb6", "comment": "Malware payload (RemcosRAT)", "value": "a2bfcb696e146e0bb3b2ec6c60916eaed389ef6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383506, "uuid": "401f240c-ab6d-4427-8fe4-4e59baba8ea7", "comment": "Malware payload (RemcosRAT)", "value": "a28306a9ba68f05ee62ec9c1ce2c271e7c14c7ccd4d9fa8fc6cdc03063f44f5b64224e786b31c4892e49d2da8154756d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383506, "uuid": "d0ea27ff-73e0-4682-b1b1-e3d1c78e6eff", "value": "T177B4C000BB90C035F5B726F449BA9368B63EBEE15B2051CB53E52AED56356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383506, "uuid": "8db239d4-a65e-474a-9e0e-547c60f9315a", "value": "596d37d4204a892e1beaf308978c4c2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383506, "uuid": "3455e374-917a-4463-8301-fdddf1c2229e", "value": "12288:KfbvH+vO4q7NAoy2jyniR8E6fYTn0MlwMoHPne:KDf/J7NAKjy3HYT0Z1ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383506, "uuid": "e39d2e5e-a2c6-4ba0-9181-4a9027a6f305", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383506, "uuid": "da6cf1cb-a387-423a-9feb-919a4ede931f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383506, "uuid": "b261e1cb-5767-4e18-b003-e90cc5cdb212", "value": "50abda236e90598eceb5413670e4e79b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdec28d-d1f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652360639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360639, "uuid": "49257752-1a56-4da5-9286-fca0327e4004", "comment": "Malware payload (SilentBuilder)", "value": "f2260c419e2896b4941344ae7034bd3c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360639, "uuid": "10552b73-9bf3-46d9-8251-03696d18184d", "comment": "Malware payload (SilentBuilder)", "value": "8323be4f8c9e0efd3293c68babb89e1d374a1eaa3bc799f3b6827aba3f965884", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360639, "uuid": "9380d3b0-65c6-48ca-aead-d33f412a95ed", "comment": "Malware payload (SilentBuilder)", "value": "d31203e831232fee1d9177b4dc257c53eb6e810b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360639, "uuid": "4b860aae-6642-41cd-ac72-928035d6d90a", "comment": "Malware payload (SilentBuilder)", "value": "80782249ec8698e06b8a484d3c385b15c1a787b5fa03feabb0ebbd2045d5b850abe32c3a78702e962891fc1cd2cd1470", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360639, "uuid": "ad7ebfae-1871-45ee-9326-cb799389ea46", "value": "T19603834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360639, "uuid": "8094af34-f694-41a6-8d99-ae1e04fc4138", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652360639, "uuid": "6dbd2faa-2356-47f6-a4d9-185d7cd15c8f", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652360639, "uuid": "77b469a6-5ba0-4321-a7c3-f10af5f25a6a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360639, "uuid": "ab01a66d-b83d-4408-bf4f-49cda1fb3edd", "value": "N.566 ZCE 12.05.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7919b718-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652345815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345815, "uuid": "575f83b2-2b09-4527-a556-0e10f907102d", "comment": "Malware payload (RedLineStealer)", "value": "df4f131787f755ef6ded07ed5aa9435a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345815, "uuid": "d58440bd-db34-47d3-8b19-369eadd40dc5", "comment": "Malware payload (RedLineStealer)", "value": "836cce144e9ab3657a48548d95791d4ea64f3b6fbfe4232db450aff517a671b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345815, "uuid": "dfb90334-367a-4988-a92d-aa27f7e2c948", "comment": "Malware payload (RedLineStealer)", "value": "b729860b993cf39784153301932ee20ef0565919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345815, "uuid": "c106824f-7c73-479e-960d-d58a33dd7b37", "comment": "Malware payload (RedLineStealer)", "value": "d54538c703bd48cd85f1922fa21abb96be21076e4cfa1d162777cf4e9aac1f0eb597da5f419b4453dc21b9a81e230c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345815, "uuid": "3943aeee-7e92-4b33-9518-4534ed750cca", "value": "T1DE84DF00BBA0C035F1B726F4497A86B8792EBDE15B2454CF72C52AEE56356E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345815, "uuid": "5a7e964a-48d9-4801-9f06-f26f5e695154", "value": "9d2be27d94f95f3f34e9faecb5708347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345815, "uuid": "8ed0d6eb-df7b-4d75-896a-590fccade3e7", "value": "6144:8fS7H8OX8GANnPa2bzVnOrjbo8xiKgLWvjijbOx013YekiDPAup4eo:Iw8OB4nPLbhOM88KJjijbOqY7ikr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345815, "uuid": "607dcc37-c52c-4441-8d0f-738607888595", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345815, "uuid": "c7ea5eba-762e-4758-840b-5ffdf797908e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345815, "uuid": "2b25d07d-0e96-4809-83d0-17edb00d8298", "value": "df4f131787f755ef6ded07ed5aa9435a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab7592a-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652337442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337442, "uuid": "0264b2c3-7e5a-4092-a0c6-2b3c1da6396c", "comment": "Malware payload (Heodo)", "value": "949bad993d87eb1c07cc52efd8176d01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337442, "uuid": "5e71fd81-e3d9-4ada-8e76-74a8fea25442", "comment": "Malware payload (Heodo)", "value": "8399af234469c0a902a5d38cd29e9fe71e360f947cd737e04d8e6908d34f0761", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337442, "uuid": "3684c3af-5e97-4cb6-bcee-4222d09038d7", "comment": "Malware payload (Heodo)", "value": "91dc2b3861fefe64e7f88df01b5580412d8349b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337442, "uuid": "47defb02-2241-49c3-adcb-33aa7dc409ed", "comment": "Malware payload (Heodo)", "value": "30bbb1fadf9aa25e1f86aaf745d02d35a79e1f351df41c62b749769729e88222f9dac85b4a3c6f9597cb7b0859676b66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337442, "uuid": "b29d5599-c4a1-462f-96b0-cd2f97565503", "value": "T142F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337442, "uuid": "5c5c4d26-92a0-4b25-8e61-c4235e5e44aa", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337442, "uuid": "a6075140-425e-4663-90f9-008c02160946", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSejNwgraKRT61cKGNx:S4DzZKnH4HRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337442, "uuid": "31368f18-9081-440a-948c-ef52a7ea33ab", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337442, "uuid": "8c437375-da87-46b1-8818-f05cbbdb00c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337442, "uuid": "84b600fb-b0dc-42b4-b239-ca81f799ffe7", "value": "949bad993d87eb1c07cc52efd8176d01.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f64ff3-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652340229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340229, "uuid": "4f644b30-24be-4807-a621-9bf5f7f8fe3d", "comment": "Malware payload", "value": "f40f57579623acd5c105e59e23d25572", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340229, "uuid": "75b54f12-cd70-40d6-90f4-2ce56bbf40df", "comment": "Malware payload", "value": "83bbe84835486fc58812b378e3a149873c1d2404e8ba402dbbbefa48f6a18fd5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340229, "uuid": "7147b7a2-8041-4e02-8dfa-a80e635c4ba7", "comment": "Malware payload", "value": "84b7fd207f04b59a1bad3287db7c75415c53a60d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340229, "uuid": "341e0923-6a24-4151-9519-51d44725a6e4", "comment": "Malware payload", "value": "38ad4ac11d0254ccf2adff8fe91a692b1b9d1243f1d4fadb15587356ba6857fdc75d1d69ec05763d0d761b1911d93e65", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340229, "uuid": "31263a2e-5951-433d-a3ca-3292ed06f78f", "value": "T1A521210607F41795E2374E356C3AF340D721B4269E2BDB2C4484DB886CB1A08F539A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340229, "uuid": "a38e2dcf-8a46-4ea6-a4ee-5893ad4073e0", "value": "24:8NUvCXdreJ8lTyAJex+/ClvIo0aMZDUZrWBpAXD/zusmv:8NV5eJ8lt4LlAoIBqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340229, "uuid": "5c841a81-ce78-48cd-b9e7-bb3c42374322", "value": 1193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340229, "uuid": "8d6d3099-5fbe-4d11-918c-bab9df74f020", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340229, "uuid": "7f8eb012-154c-41ba-b036-8bbda335bc69", "value": "New Folder.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a6535b-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338779, "uuid": "8ca0d7a1-0da5-4672-ac95-e6f6d56eae6b", "comment": "Malware payload (Loki)", "value": "7d2dac3fbb4220b876407bd9855eab3d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338779, "uuid": "aa8ac3ff-6cb7-4dbb-8df8-eb2369ce055d", "comment": "Malware payload (Loki)", "value": "83d3937d1fee46f26f9fe123dccc2f1aec314be0b8dabec3af50f0f65fca245a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338779, "uuid": "b1392590-3f4a-401c-9fa5-8a030fbdd7f4", "comment": "Malware payload (Loki)", "value": "a7b9a5521c3bea5f2cbdc8dd5ac160407c4d2bf0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338779, "uuid": "58d37efe-178e-4b69-854a-2c547c321831", "comment": "Malware payload (Loki)", "value": "eaaa408d94d58a0e23617f951033babf7a18a8d220827b187b773b299b3b862b0e9278b166679a5c064543293e384e63", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338779, "uuid": "70015600-35cd-4403-9e10-39628cad0218", "value": "T1ED0401A433921070DE95FA317DE2C1820AB9EE37523827884C67F62F85325DF99F5DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338779, "uuid": "688e1a45-e321-4e37-b7fe-e8eda182d457", "value": "3072:rcRhb6mQhxzehNaWQHXbTjfs6qgqSXL6W+/71PXDfN8LKHLMszEmFjAykUB:ihdQhNehNm4aWW+zZp8LsdjAyxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338779, "uuid": "ceec1174-722d-4e61-aefa-0a3ecd03fa0f", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338779, "uuid": "32f7a89c-9054-44cc-8a4b-bebd4a1a5409", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338779, "uuid": "a1923475-7174-46f5-a6a0-e77cc9bf7b15", "value": "PO 0075_022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c62897-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337667, "uuid": "41f9bbac-c95a-44e0-a0f0-c470af9ad90b", "comment": "Malware payload (Gafgyt)", "value": "125f4e858ab4fb65e721ace635353fe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337667, "uuid": "e9adf6a9-a697-4b91-a424-faa7fd81e24c", "comment": "Malware payload (Gafgyt)", "value": "83f6afbea3e3c17a128806de76e653e021e1b307e1db61e3b73617bde9830e36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337667, "uuid": "4e6a0349-3f5c-4c01-acaf-f270f78557f9", "comment": "Malware payload (Gafgyt)", "value": "d5d0a3f3a6c30aa22ff24127fe729028be86be01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337667, "uuid": "9a08ce40-e5ce-4afa-804c-0444d7b4cdcb", "comment": "Malware payload (Gafgyt)", "value": "4de1300092116161ffbf4787d8b9296d94bf133962040aa81c0694348755e83cef1ac1888feefe12141afc3a9cced229", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337667, "uuid": "9910f6d1-1165-4cd8-9d96-93534e928512", "value": "T139B3842A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337667, "uuid": "da99752a-e83c-4276-9ef9-6d3a91eae448", "value": "1536:27ju1Thpq+XvYC2rKy3eY5PGEEeRYYIJ8vECRIKmbaUmkiSFxfC7xbXe:RvYJPGEu/JF8IKmuUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337667, "uuid": "8e8a101f-a986-44dc-a9a2-d44fc9f8ea79", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337667, "uuid": "03cc2d85-f0bf-459d-8e10-2c41beb5e7c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337667, "uuid": "0184cc0b-e2c5-4073-80aa-02e718e4fa1a", "value": "125f4e858ab4fb65e721ace635353fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b2b4dd-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652340167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340167, "uuid": "3833cd58-7639-40cf-bcd8-215ee546cfff", "comment": "Malware payload (AgentTesla)", "value": "60af55f38e55b51673a35139fdbf6963", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340167, "uuid": "005af8cc-1a58-4d96-be24-6c586c87eaba", "comment": "Malware payload (AgentTesla)", "value": "845552c3b6efd3b155eebf54ef7cbff7d2e5072da68575c243dfa44e39d9aeb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340167, "uuid": "5f1de5e9-b3cc-4bc3-a791-3222e185f091", "comment": "Malware payload (AgentTesla)", "value": "1442f5d904447ba9ce1b58cceefd2553a0409018", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340167, "uuid": "9c4803a2-3059-4399-8a79-c1ff63c6b30c", "comment": "Malware payload (AgentTesla)", "value": "42a357aee5cc98262f7f671c9e45f731059c57ef3817f843ec2b5677a76448bee7e1733498b27dcd45a43a0bd16f1af7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340167, "uuid": "7a9d7abf-8b03-4b5d-82c2-e57c380e93c5", "value": "T136C41214239933B6D5AE07F0CE2691ED33B41D02DE65D3A79C9479CE8673F4900A2A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340167, "uuid": "5d90d8c8-c539-4c63-8faa-d1d44c2fe13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340167, "uuid": "2d1f5845-a2e7-4253-8883-ecbf8ee13cbc", "value": "12288:Ytfy0713i1urgs5JF7tWUh/oRd6E/xV3+ZEcBvRm0rp9UhgmQPTS9dA5vmhHge:Y5yI13surgsRtjO5+2G86p9UhQDv6Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340167, "uuid": "28a25c18-a775-4c7a-a889-2d158c2cf1c4", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340167, "uuid": "bbbad361-c83f-4045-8957-0b6083af408a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340167, "uuid": "071e2787-a491-44fa-bdd4-5c1e8fb79edf", "value": "DHL Receipt_#AWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639b4856-d1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652364247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364247, "uuid": "88f0c813-32a5-486a-9d4e-22a9b2e011f1", "comment": "Malware payload (Growtopia)", "value": "f29038ae44c9fa10fa62a23269331865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364247, "uuid": "ebcfc4fe-e017-4589-ac22-fbec59732189", "comment": "Malware payload (Growtopia)", "value": "854e37d4dbfb1b78c56e0797909ffa8b8205235736c67a46a2202726183ae6b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364247, "uuid": "ebad379d-3958-45e8-a4dc-dae5bae2e54f", "comment": "Malware payload (Growtopia)", "value": "ad210df65fe94b61620700296a864ea15e1d20a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364247, "uuid": "5b0a3694-aade-4d87-9b67-b151b9b1d498", "comment": "Malware payload (Growtopia)", "value": "adef1a991dd5809a7eef9e045290fd25a1549a1bc7bfb9698071ea8d8194b83d1edaa335cf143b16390d0125c5219215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364247, "uuid": "693578bc-2beb-44af-8c80-5f973b82a7a1", "value": "T126E3D60222899F19E4BE47B891A6142087B73A937232D75C7ECC14DD0FB7B54893EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364247, "uuid": "6068fc35-77f7-4b56-9222-2c1f407309fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364247, "uuid": "2f95a209-aabc-4a10-96db-63a2ac9dc9c8", "value": "3072:LQfqyXyy+Pon7sA3fCGHOduHVdV33w2eLQ2S+TtlRO4oGgL3I6GxlVxF2/:32e02SqR+GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652364247, "uuid": "6ffedc23-a6c0-4801-973c-e62ad6edfa98", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652364247, "uuid": "5e8aaee2-9c33-442d-a64e-b4d2d44eeddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364247, "uuid": "ce312912-a54c-4803-9cdf-207feda07677", "value": "854e37d4dbfb1b78c56e0797909ffa8b8205235736c67a46a2202726183ae6b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0e4715-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652399700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399700, "uuid": "d282a2ad-6e9e-43ce-9071-cc96a64abccd", "comment": "Malware payload", "value": "b06c191fb28272be247cf23faf1829cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399700, "uuid": "8a098c02-717f-4253-a8bc-649b22fdd5d9", "comment": "Malware payload", "value": "85eb473933d1987c1e2288176535b223c174b289e31688b1352cac0eb5b0f77f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399700, "uuid": "72c5059f-c56f-4515-a56b-485231b33b9a", "comment": "Malware payload", "value": "1fccfa6782be1bd32e9d0eb4802443196b87972d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399700, "uuid": "bc1a4cc2-f006-4fb9-af74-5bfdd9cd7f38", "comment": "Malware payload", "value": "7b7f58b7e72a241ccf7cb456db1b1090614c2f8c1d08282ae06867f7b89f5dbd5c727e7bf764ea6bfd7648121f65b199", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399700, "uuid": "3ebcda24-9387-4923-951b-892f27ae5b69", "value": "T19F933ACBF800DDFEF845DB764653450AB630A3A01F921A327213396BED351A51977F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399700, "uuid": "571dc313-57f5-4ed0-96eb-6ecd7ea8b602", "value": "1536:S4DFQnkoIEgBbTLBpuuPAzeiLt78D3ypuX0b1jUwdcN8UEBuN9hudAdy3pNDt0:orgBbTyKaeiL7pXjnd88yUdAdy3p9t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399700, "uuid": "08203bfd-dc51-482d-9be7-6c68db0b2543", "value": 97356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399700, "uuid": "174dc013-3ea1-42e4-aafd-c7503fb68da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399700, "uuid": "cb9b742f-a9b8-47b2-8277-903809828f5f", "value": "b06c191fb28272be247cf23faf1829cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6210ed12-d245-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652395598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395598, "uuid": "b38ad53a-2a35-4405-8a3d-00fbb70a8ea4", "comment": "Malware payload", "value": "788963852d14bd87ea99a5635fbb73b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395598, "uuid": "b14ac2dd-a3c7-4b86-9f28-941d56b1479d", "comment": "Malware payload", "value": "8622fbe134e0c5dcc26db88565ab2e8da55acf10d9ba50bbde7353cde6cc3287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395598, "uuid": "90314347-298b-4328-80ef-80bbbee32931", "comment": "Malware payload", "value": "bd983c1b0445a6d99cee250524d84d64cc2c23b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395598, "uuid": "02815c9c-b4b0-44ad-a782-244a17bf77df", "comment": "Malware payload", "value": "ea2790fd37af63ddd5591c6a63aad8b7edca8dea23b5f35c19f26ef3c19df617f2f5ab287fb9c70c900128c98de90a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395598, "uuid": "22a7224a-ce25-4e4c-9523-6d7daa8af1de", "value": "T19164391D23A81CE5D9679239C943C265D6B2BC346721A2EF13D0CE7B3E13AE57638B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395598, "uuid": "f89c8ede-9961-4e93-882e-b2761f265275", "value": "d73e39dab3c8b57aa408073d01254964", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395598, "uuid": "6e33ab0c-727c-45f9-ab2d-7ea6d1c5fa2c", "value": "6144:Os1TRhWEO9O0eZuZVw7zjaBGxGzU5Kg3HZL4GtA9XIavGNm:Os1viA0+uZVwXjaBGEzU5fkLGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652395598, "uuid": "9f94f127-b2b7-4c23-a316-286ff32e059a", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652395598, "uuid": "3b47c5c0-788c-4b70-9d52-593aad977af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395598, "uuid": "8d215ebf-6914-43e5-bbff-4d4bca69a27b", "value": "cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57917a8-d24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652399200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399200, "uuid": "81540095-ce54-4c9d-b113-bca28cbd58de", "comment": "Malware payload (AZORult)", "value": "0a9ee4058fce2dd656f08be22701d0d8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399200, "uuid": "f63b263e-b959-47c1-9d68-36135a4a1d46", "comment": "Malware payload (AZORult)", "value": "864448901d066f7fa4835e4c12341d60bf7f610d8c45577ac5749267535c243c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399200, "uuid": "3b1b99f9-2b72-42b3-8764-d93bd2fa033b", "comment": "Malware payload (AZORult)", "value": "d2951d4aa6469c57af03e45ccd1e33b881db02c1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399200, "uuid": "2842c758-93f3-4fc6-be18-b74336899fb4", "comment": "Malware payload (AZORult)", "value": "5759d0ce05fd05c5b83ebf9058965dfb148c15bb02ec727c26c6d78d668d53c1cdff9b0ead16b9e90c0671f6b85cae00", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399200, "uuid": "316bd7a1-14c8-4b7a-89b4-a82b46eed4c6", "value": "T1B4B3197AF6C19272E02809BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399200, "uuid": "aa2192b7-d054-470c-b713-707e3c1094fa", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399200, "uuid": "d06508a7-74ac-4d4f-ab18-53e18f97f80e", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEYnE/6xg/:Zzx7ZApszolIo7lf/ipT/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399200, "uuid": "2eb3f080-07b6-454c-ad13-294733af693b", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399200, "uuid": "2e0163ad-40d2-4f43-a311-0005d47d8442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399200, "uuid": "a55bd97e-c24c-404a-9f49-cb3aeba72de9", "value": "864448901D066F7FA4835E4C12341D60BF7F610D8C455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0732d0-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652340266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340266, "uuid": "c90ac663-9684-41f9-85c5-0acf5438c42c", "comment": "Malware payload (RedLineStealer)", "value": "ae0a604568552b69066115df36efd41f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340266, "uuid": "213b193a-30a6-47b9-83a5-b9b0dd195f72", "comment": "Malware payload (RedLineStealer)", "value": "86a8ee23cb943b383835eb2ba8bc513641ee6953ba1715832a8a485931054273", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340266, "uuid": "1824f34b-b932-406e-a500-367f16b6c935", "comment": "Malware payload (RedLineStealer)", "value": "fb4f6f0110940c862b646a665b3bbd4ac698dab2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340266, "uuid": "6a72abde-0c09-4d4e-8357-412279ac890e", "comment": "Malware payload (RedLineStealer)", "value": "84eeab5cba9223492c551ec5208440afe1b6bd137c9e95e8a205601896d63864aa3b98af37597896f78c11c5c5782699", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340266, "uuid": "66f4fbd1-b3b6-416d-9637-d02ce30d44b0", "value": "T165D48E57F7C7FAB0E6BE827A86B1851C527774920260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340266, "uuid": "4c831014-5a4e-4642-9743-56a6538cb228", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340266, "uuid": "a6db805b-1868-4494-a1ad-89560ce85973", "value": "12288:tn/zDvGHAykHSzLW/4+8bzbBSreMd8PaTgFK/UqWV:BzbGHAzHAjX1MTcLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340266, "uuid": "3c806812-d2f3-4b6f-b878-0fbff8d972c5", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340266, "uuid": "1674e1ae-2f77-4572-b7bb-f595f8a9b91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340266, "uuid": "c7108055-9bad-40f4-a245-e6801d3070fa", "value": "Invoice_VC85262241.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8dcbac-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338712, "uuid": "66e8250a-c10c-40cd-b3c1-7b66e0a6f97e", "comment": "Malware payload (Formbook)", "value": "08c35377bde7cfa5940d1465473b3e20", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338712, "uuid": "381c8743-b59c-4dfd-bcb3-bb76bb99bee0", "comment": "Malware payload (Formbook)", "value": "87e813bc375170bba76c88259a4e39daf841f8aadcf5c4cbd64da69df01a9453", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338712, "uuid": "8b5d2dbb-105c-4e05-8a00-ca213512a65b", "comment": "Malware payload (Formbook)", "value": "01feff48242967c448f5b473f4f2a67afedef872", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338712, "uuid": "707e412a-9395-4916-8db3-4dd6405b5a57", "comment": "Malware payload (Formbook)", "value": "7e53a3720b247dc25263e2954275de2d699b63d63efb01c3d013dbcefa21d42fc3610f974e98fe030f83b60599e69571", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338712, "uuid": "76d4c27f-a0fa-4f19-9de9-debe284a99e4", "value": "T16304129BA6E2E507C2B317F230C9C0BA83E5FFDD9D798985B0283B49D172090758DE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338712, "uuid": "3e6f16ab-17b9-4d2c-a962-196543f695de", "value": "3072:Rd2IN0gFj713a1CRjndOnh6ROpc5RYYI0Y3MzYfa5VaJAybOMTk4VdtezY4wlyyg:VWQj71IKu4vgYGsGQinQ4Vdsrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338712, "uuid": "d5147841-cbbd-4449-82bc-63afbb6c1d8d", "value": 187912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338712, "uuid": "9f963f71-5c59-4963-ac7b-2c625fb7bbf4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338712, "uuid": "18888d7c-e69c-4b06-9941-5224bd5dda16", "value": "SO-127.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f24818-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338798, "uuid": "3df91279-d425-4b4c-8e6d-c3de9c862f90", "comment": "Malware payload (Loki)", "value": "31aee616797b6d5f409ba96ccdd95a65", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338798, "uuid": "59f00dec-4f31-4e0b-88d2-e9cb21703eac", "comment": "Malware payload (Loki)", "value": "89670324526d6008e4664eaa93c86c07bf3ffbc16c9f4d1d82228d56a197eef1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338798, "uuid": "297a5fb0-1076-45b8-92a9-5eaa43f51cc3", "comment": "Malware payload (Loki)", "value": "12339cf20af2b0cc6234b0226745714a344084aa", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338798, "uuid": "9adcc5a7-b9ff-4752-99cc-ef2fe0af5063", "comment": "Malware payload (Loki)", "value": "d39f1028d5481b4372dc26a586a75dffe0b88a6e4a3e0357ac5ff8b6a557df543e5ec40166f4fceab0335985e1b81722", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338798, "uuid": "f9e8f6a7-8ca0-4f06-905f-f315d26edaad", "value": "T15B93F1217D0457B2DE6F673BE508F10897B5DC9CAEF04BBEB98077198CB2A560473922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338798, "uuid": "e3ac5cd5-8d49-42a3-8642-80e18e880c4c", "value": "1536:uLgpRddoKQVVYP4dgmeVkwFbcg3pPmmtmkWDe5h3R4ULye1/CKq:uLURXoKMVjdgmeVRFYqBmdKHh44Nct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338798, "uuid": "e13136cf-4d48-4893-b33c-b58222df45c9", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338798, "uuid": "92930a15-fdbc-4b95-82e7-4781eb5b9ea2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338798, "uuid": "de7555be-817b-4173-a154-a554fb46dd9f", "value": "PURCHASE_INQUIRY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3654a241-d207-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652368895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368895, "uuid": "4005a2af-7482-4e31-b355-ea5220334409", "comment": "Malware payload (RedLineStealer)", "value": "14b1f20f3ec1d9fa4a7f6eb9c2ae96e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368895, "uuid": "1ab2a064-3cce-44b3-baae-3e0a4a292a6f", "comment": "Malware payload (RedLineStealer)", "value": "8a9368e459952f9652f83bdbb2e834bc7227d2f22e7d07980ab489c1df3ea0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368895, "uuid": "8f9ff6b8-8135-4310-8258-22511b10b347", "comment": "Malware payload (RedLineStealer)", "value": "48152d4d1f196723cb569fe9be272aea402edec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652368895, "uuid": "08142e25-e066-4c73-9811-a886b72113a7", "comment": "Malware payload (RedLineStealer)", "value": "89f25a41ca00975fc48ee657661c60bd1bfb242b66081a403a3c3b0e6b4469bcdb2f967a56115de9ed29f1fbcf9d45a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368895, "uuid": "2f8aaf57-a85a-4b61-96ca-61b2aee2ec60", "value": "T1E294AE10AB50D435F5B312F449BA8368763EBEB15B2550CB53E56AED97396E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368895, "uuid": "76490592-c1d4-4b6c-bbfe-46aabcf3b1cd", "value": "8e2ab8a1912a9d8e58f338a0e4e577f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368895, "uuid": "ceb11603-40af-46bd-8ac0-2d19f164ea94", "value": "12288:9M8YU48NkzOQknLD2ngxW4qTRxZV+EhxMa:9ilQRDnLD2iW4qTfZ0EhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652368895, "uuid": "3c1f4f68-db12-46df-89dc-16942bab248d", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652368895, "uuid": "00434f81-2205-421c-8f67-4ff771428def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652368895, "uuid": "5052b2cf-9058-47f8-8f74-6a6fa0fb1057", "value": "14b1f20f3ec1d9fa4a7f6eb9c2ae96e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a10b849-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338756, "uuid": "06a84e01-5519-41b5-8b33-39eb3f9a8a93", "comment": "Malware payload (Formbook)", "value": "d85ce3ee35775e80f85bd874818df0ef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338756, "uuid": "afb0e7ca-2461-4889-8a3c-0a3516dd961c", "comment": "Malware payload (Formbook)", "value": "8aa6cb5fac8af57bf2c7165a6a1e99d239f84ac86af6af31e9ad379b447b28fb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338756, "uuid": "9da1a672-3f0e-46b8-b86a-ea4c0e8092f2", "comment": "Malware payload (Formbook)", "value": "0546532736edc7a1a8c5e471f9655b8131921ad0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338756, "uuid": "b078c8dc-6574-417e-a861-1dc8425be055", "comment": "Malware payload (Formbook)", "value": "08907bab10d90b1729c832ab1fbc3db9f6ad93c02acb1ea28908533ae027b2ec19804a6db1623d3a5681b762e9d7429d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338756, "uuid": "95632db9-009e-4a07-b765-a8526510d00a", "value": "T14D1401682EE897F1C50459BB5701A0DA9035BFE2BC321F3540F1368922B2EE1D674FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338756, "uuid": "8c0be56a-28ad-4439-8863-5be7059f59a0", "value": "3072:hsiM0WzLxK9mvaZdA4IFSaw5WWUYYtVWIZ75to3kN3MySIan7anZ0bmQjGu:mjHzLgiaZuXUW7tWIZc0N3MZ7aamQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338756, "uuid": "81bbff06-ad43-49e3-a2ed-a69b80235250", "value": 190776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338756, "uuid": "735b7ac3-16c4-4325-a89b-2eefca92724d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338756, "uuid": "0761ea3f-9880-45cd-8379-a0a2c72f220b", "value": "NEW ORDER LIST JUNE 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd29914-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338707, "uuid": "b150b55b-d86f-46c6-8c83-bcf445a71e5a", "comment": "Malware payload", "value": "56190f7cdad46c7c02c1f7eada6d0390", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338707, "uuid": "10ced053-3ebe-4bf8-9ba3-ab5bef13100f", "comment": "Malware payload", "value": "8ad3e61bffa22b448fba9977b0ad72d3cc39a657e33f38872f6acc9880eb678e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338707, "uuid": "f935c201-4412-445a-8c48-85631c71226e", "comment": "Malware payload", "value": "4eed7d7348a2295f03c859fc0bd95db37d77bc71", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338707, "uuid": "8372e6b0-a827-4818-9306-ac3a3bfde7c3", "comment": "Malware payload", "value": "222cf1607fa2600eb49758b8e58d0917a326249e43137e03ebdd9323ecc71a2c4304905bab9985d6b96691ac2c6b652a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338707, "uuid": "122c0765-8844-4de7-9100-a61cad71646f", "value": "T1F304026E78692038F1ACABF12DD7826CC1C0DD31BCDDE5067505B50F6838ADDAADAE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338707, "uuid": "801f2605-ace4-4d47-afe5-08133809bac9", "value": "3072:KWWTKRdeHxgKz7coj89n2BQA9utvq6BxxkOJVJjYEv1vK54Wxufzg:XaDeKzgos2BPqjBxTJVlYW1vK54Wxufk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338707, "uuid": "c7065c3d-54b3-425c-a379-d908145dccb9", "value": 188248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338707, "uuid": "3aa979e6-2f91-4d9a-8bb6-d1e05997e6af", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338707, "uuid": "d2b96389-7fa5-40ea-9aff-209c3e6a8eb9", "value": "P O CSCL REF 1198.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f06926-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652376788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376788, "uuid": "89d534bc-c3da-42a2-9518-cb62232dbf2d", "comment": "Malware payload (Loki)", "value": "0eb62853b63f5276c9eb21fff540c8be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376788, "uuid": "e50a8436-b65b-4b7a-b8ee-c9581c9acee4", "comment": "Malware payload (Loki)", "value": "8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376788, "uuid": "6a66f0d3-2a21-4f14-8f2c-272ca79a29b6", "comment": "Malware payload (Loki)", "value": "8c112916e5b8154e964bdb2c44cd4a69515619d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376788, "uuid": "70886a54-da58-4ce1-ae09-b7cf335844c3", "comment": "Malware payload (Loki)", "value": "2b3b9cd3e9ef090f4cc783ddeef76a5cca7d848e5eb772c93818714f7d8aa14d61a24972bc1f88e2e25904c88c090664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376788, "uuid": "922591bf-dfb6-44c0-b118-d916974a7682", "value": "T1132412206674C8F3E9A16FB16E76E633DFBEC62414F0661B83D02E497C71582661FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376788, "uuid": "377da497-520f-4c80-b426-4f4f00793eab", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376788, "uuid": "f45585e6-3aae-4810-a560-1a5a92d5efd4", "value": "6144:LOtIOxNN7Va2w6yGlNTKjSKoV4vEdprDbtdsmc7KB:LOLXN4v6y5jKVxpthc7KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376788, "uuid": "d1afbfa4-52fd-4c74-bdac-0f784b9bb7bc", "value": 212780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376788, "uuid": "b948ed1f-8363-4819-8863-7fcd4cf32ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376788, "uuid": "ff3f36c2-7ffa-4503-9c16-c0790ec556d5", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f5f014-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652376564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376564, "uuid": "51374680-5d2f-4f77-b253-7e640f9bb51c", "comment": "Malware payload", "value": "51b31619ce41965065168284c27952a7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376564, "uuid": "5a50bb87-c74f-4904-8bc7-4623ebee3921", "comment": "Malware payload", "value": "8c11f82c8d0dd093b2f87dec964451396402979b6456cd04156174e926ec4fe1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376564, "uuid": "a2a2a078-5f82-44c0-9208-75e077c95bb9", "comment": "Malware payload", "value": "a92575c5d2ed03f54e9408bcc29b062e891c4370", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376564, "uuid": "69969a53-ed49-469f-b11a-af58e969fcc2", "comment": "Malware payload", "value": "7027f052443ad22c2431f69ef69f3b9f9340edddb920fc8e785ceab8d7685cc626fef0f0daf2864687e742873b60eca5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376564, "uuid": "ed43216f-d96e-4888-be25-3e802352f449", "value": "T14F37DF97F810DA46C6E89631F8BD85C037E10A7CD7C325166A21D9347BFE9CA097738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376564, "uuid": "49fac0b4-9dc3-4d32-ab7b-15627c8cd7ee", "value": "196608:gFEeY9MVLzM5MqqJ4SeskK/AqJUUuAlDCqmGX7o5HLSpAg6XZMTeO4hwywlcOLyJ:ge9+LzM/qJ/es5lDCqmG8vgdTheHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376564, "uuid": "71ac8733-c9fd-45eb-819c-284e13db1426", "value": 23680791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376564, "uuid": "ffa78044-3b21-420c-9500-6c9e80f7f641", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376564, "uuid": "31213226-d39c-498b-aca7-cf3ee996a0bd", "value": "ThermalCamera_1046_1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08027426-d1ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365382, "uuid": "4044143a-b687-4ec9-9951-8ca48ea8f0e3", "comment": "Malware payload (Mirai)", "value": "b723e4600b3fac0c0003513d9cf148af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365382, "uuid": "efb1039b-3798-4eb0-b497-94f7c6df606b", "comment": "Malware payload (Mirai)", "value": "8c38aa230d76ea71bdf29ac80cd5601fd21807fcd59e50ae9d64e5f749bc32ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365382, "uuid": "b52056b3-e352-4166-a523-72658fe23721", "comment": "Malware payload (Mirai)", "value": "88d7493827434fa2efca8c1f59769c48eadd0e08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365382, "uuid": "f703830b-b02d-4fd7-808c-1ce458beeee1", "comment": "Malware payload (Mirai)", "value": "3f28da38a9ab5c41e7ac9154ac20c546cd9161f65b38bbfaa3f6e77f10bf232edfb6fd61cf258c024f163c532f1d9d1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365382, "uuid": "5138d8e9-7563-45ad-9512-1309e816a59d", "value": "T170D2E19BC4C35C82DF77EEF82D49D14C6B91CC1D7BBAE486228A0B50B311033B95A5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365382, "uuid": "16b66e2d-c1a5-4a08-8699-8f350942400d", "value": "768:hqwA43xmHandvK0S+9F+0ypwzuSGlw9x4uVcqgw09h:hqv1HI1K0S+9Fvy0Gev4u+qgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365382, "uuid": "51257f14-be7b-4d51-9714-e786505c69ff", "value": 28708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365382, "uuid": "fb90bcca-0f1c-438f-a9c3-1382cb69d80d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365382, "uuid": "f4a0e744-8111-402f-b44e-7c9cad771d80", "value": "b723e4600b3fac0c0003513d9cf148af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9aa3b4-d1cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1652344181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344181, "uuid": "85311dcc-31f2-4c81-a0af-64d8c57e8c9b", "comment": "Malware payload (Nitol)", "value": "392f13b090f54438b3212005226e5d52", "object_relation": "md5", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344181, "uuid": "df6d9273-3ef0-4158-8fc0-c2bea857870e", "comment": "Malware payload (Nitol)", "value": "8c434f0b716f0900dd6cf6cb9444c20e88184bf64b8b7149dc70cd65e7ed22a7", "object_relation": "sha256", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344181, "uuid": "49ef0e87-82e2-4c60-ad20-4985a257cb71", "comment": "Malware payload (Nitol)", "value": "a0e1ecf7b6f16f5e5e8cf39e2c617002091f1e40", "object_relation": "sha1", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344181, "uuid": "5568a106-56bd-43e4-967e-ff7d78ea8235", "comment": "Malware payload (Nitol)", "value": "f54f6ba1e87b235b713ec089c2019dddaedbd2c6d480beb0acdba586c812c75902f44a7df4096a4455b7fe261c30c887", "object_relation": "sha3-384", "Tag": [ { "name": "20-187-86-47", "colour": "#AB2776", "exportable": true, "hide_tag": false }, { "name": "20_187_86_47", "colour": "#BBDDC9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "ServStart", "colour": "#808F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344181, "uuid": "fd4b7760-11f5-441c-a7e9-cbc317890735", "value": "T1D4837EAAE5630F94C549E13485673E306B512C986D100F7363E6FE3CB9B9AC05B64AFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344181, "uuid": "10921bf0-326c-4cf0-ac56-59470ac90b8a", "value": "6b41b49cb60c6234a51830ad22997a9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344181, "uuid": "0f77342e-227c-48e3-8cd5-850957c435de", "value": "768:Palg1w4hnK88gNkk8qx1Zna1KUvhmwz44Z/3R79rnWJK1ymlird10/n1dbwtt6RK:P0Ywk9NNLXZsKUvwwF3R1b1yt3CnT23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344181, "uuid": "cac0d8a5-e72b-4b06-8797-e9bcbb58c15a", "value": 81938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344181, "uuid": "5fdfe134-bec6-4b64-a70b-f2a563a185e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344181, "uuid": "4525f3f5-c5e2-4ab9-a17f-34de06059a7e", "value": "8c434f0b716f0900dd6cf6cb9444c20e88184bf64b8b7149dc70cd65e7ed22a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce9ca3b-d1eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356800, "uuid": "a83c2cbc-ec5a-4056-ab13-e533d10fc260", "comment": "Malware payload (Mirai)", "value": "698ffcfce4ba265d69be97fd7f7c32ec", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356800, "uuid": "b3ed1cd6-2e90-4a05-9c16-a90ef79dd39d", "comment": "Malware payload (Mirai)", "value": "8cd23ef1ae1c514d0ab8774f85afc8ee5d2170eeffb91059abec75faddf26bdc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356800, "uuid": "551b1764-165f-4198-82af-7c0167917194", "comment": "Malware payload (Mirai)", "value": "b2e8e9ea54dc3e76e5998b56c544abf5192d9ab9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356800, "uuid": "95e75142-072e-41e4-8dcc-403efddec3d4", "comment": "Malware payload (Mirai)", "value": "4d9e79b08e0f4dccba6b11768fce8ee0c800d91a540c044a7651740f06a57019adab4f95a03fa066a6f72ff4b7a1eaf9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356800, "uuid": "b824bb60-c26b-42ae-8a3f-16542a31f610", "value": "T1482302DFDD52B4B6D0B0C27302951381B90BF2291B856B738661BADFCDB55024E4D7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356800, "uuid": "cf88e8df-cd08-4191-892b-1078f780c061", "value": "768:8Vlo1OeMMg27EbV3UkkgaI3+V/ATmxUiq7LPE/Qfzjx00DCb0ARq:MlZMg27Skz219iqJffUNRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356800, "uuid": "b8c2b46b-2efd-4526-8072-30fb9e226fa3", "value": 49804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356800, "uuid": "baaa3a54-02b5-48c0-8cdf-7a2136cd6f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356800, "uuid": "ffe855eb-e23d-4b33-8247-353c86df03cb", "value": "698ffcfce4ba265d69be97fd7f7c32ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e76fbf7-d218-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652376130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376130, "uuid": "04727512-b24b-4477-b8f6-d99298d87bd5", "comment": "Malware payload (Formbook)", "value": "f8313c5969913611ffc7e90965d71bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376130, "uuid": "94d8a70d-5c4c-433a-b45c-d72ed71223b4", "comment": "Malware payload (Formbook)", "value": "8d23ed5282c92fc327c135a916a3980cb94e43aa7135929e377649de4ea61b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376130, "uuid": "68700e47-3b01-4564-b50b-4dd3b3b92834", "comment": "Malware payload (Formbook)", "value": "a5d49faabab1b5e27cd0fe7194d3485031c8948c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376130, "uuid": "a1c173ae-d955-4869-8e98-cc31aa4763aa", "comment": "Malware payload (Formbook)", "value": "4d52d6a1dbe24dc6b6a63b6780b7094cb60034eb7d2767844f5cdd8d9474e0e802aed56c176cdce0cdbfd2be0331876b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376130, "uuid": "94e6933e-b3fb-4caf-8f31-f0217657d2e3", "value": "T187542300B396C9A3FDA2A7752F374F1E0AE6E82410B54647975036CA3E727C5395FA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376130, "uuid": "ae2fb271-c751-4673-9e4d-a9c31f8f398b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376130, "uuid": "5f1ddf6c-b6ff-4f71-b18e-e86d17478f45", "value": "6144:LOtIONLYRlZheHGV3xX6T3uBeRGHMZmZVSR4BPFXglonEw/X/TEkSnxc:LOLN8RlTOSxKmldY4nE2X/XSnxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376130, "uuid": "893cdf0b-7263-48a0-8f9f-bd6fea25dd4b", "value": 306019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376130, "uuid": "57bc8bad-5f3c-46a5-9c35-038636b95661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376130, "uuid": "3dc21a0a-b57c-4855-8ac7-d2e8f70a3c7d", "value": "aku 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899d31d0-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340688, "uuid": "d3dc0393-aad9-45f0-a469-97de2cf08d81", "comment": "Malware payload (Loki)", "value": "0224eed55483ffee0211bf21a8e822da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340688, "uuid": "e7b98340-0dfc-4650-a871-52e8de81ba4f", "comment": "Malware payload (Loki)", "value": "8f4264a504f18bc7e8e8275284a1c3e91c2ccee846ebefed6a29d24a25d63931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340688, "uuid": "f713cd33-2bb7-4ffa-85db-610de4f400a7", "comment": "Malware payload (Loki)", "value": "9b4df4060e0816aa2d4e0c866f5712aa65593255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340688, "uuid": "80b120c7-5bc2-4743-86a8-ead85a0d50db", "comment": "Malware payload (Loki)", "value": "6b82ebb666673ea17d11556170c6447d62666508944c34e8911d764fb9c72db4d9f9e671ffc5e557875f31f63eb93aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340688, "uuid": "ff0786d7-cf43-4bd3-9e4a-0c3d7bbab3d8", "value": "T1F2C4121822EC9BA4D2BE2F34707921249F757D67B437E31D4BC46A8E39667828D107B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340688, "uuid": "6787e125-4e1b-43be-8166-33ec0de2030a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340688, "uuid": "cde1d069-5924-4d71-9cc1-f453af71b242", "value": "12288:QpxpElu9c7IPdKvH2ARlYM0zRd2eBOWQIs/JaVp:Qv6kgQdi2ARlufOQs/sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340688, "uuid": "6b64a34a-235d-432a-85e5-052625c1fe28", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340688, "uuid": "7d7da4a7-b317-47b2-b079-d4e2938ff340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340688, "uuid": "7b05e958-ef58-405a-ac9d-3c58e06fa914", "value": "0224eed55483ffee0211bf21a8e822da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51e88a8-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346828, "uuid": "ab7cea30-d0cc-442a-903a-c386e0ba5f60", "comment": "Malware payload (Heodo)", "value": "472a94257c4e6b56c6304bf6a5856ba3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346828, "uuid": "244ad97a-0298-45e1-a1a4-051e794461f0", "comment": "Malware payload (Heodo)", "value": "8f5bfc999e33e362e86a0873de2dbf98c16bdd6b011700ac7394596a864f5831", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346828, "uuid": "20fbaa5e-fc5e-4869-8d4c-39fad2307d19", "comment": "Malware payload (Heodo)", "value": "d246a3058e5503198c12ae57a87f17ccd8b3f4f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346828, "uuid": "a03ab9c5-80e2-45ac-b969-8016985c458f", "comment": "Malware payload (Heodo)", "value": "37efeb58a47dd8d6677c8ec3072d912a03dabbd01e8dfd6c2b6c388a726764300c60b622bbee4a99a6602035e45f1586", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346828, "uuid": "23a29e84-4b08-4e9c-83d8-d08505b4399a", "value": "T1FDF47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346828, "uuid": "91c57ddf-4f8c-4a7d-a38b-6b2c2dfaefe3", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346828, "uuid": "721abe20-aaf8-46ba-923a-c80f54805758", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSSjNwgraKRT61cKGNx:S4DzZKnH4PRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346828, "uuid": "84eba6e8-8972-409d-bce7-999efc19b483", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346828, "uuid": "1b3a5dba-1c9a-4d52-a270-1c93c45030bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346828, "uuid": "b3d52466-1ed8-4325-b52d-52834dd188b2", "value": "472a94257c4e6b56c6304bf6a5856ba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da86d71-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652334709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334709, "uuid": "f96cb113-0439-4ffd-a04a-e50dd7fcae57", "comment": "Malware payload (NanoCore)", "value": "df1dc1a245d93014003e9ecc4f654602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334709, "uuid": "401489a0-5161-4810-ac67-0eec41769979", "comment": "Malware payload (NanoCore)", "value": "8fa3b2eb7650ac7ff7dbbeed506e3f17b805d64d6932715f8885508fb6f988c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334709, "uuid": "edf3de14-f3ac-47d1-9d33-0600226918b4", "comment": "Malware payload (NanoCore)", "value": "b2f5da6a917d9535a623de61c603d03f0d225fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334709, "uuid": "59fd696f-54ae-4b92-b0bd-692b61a2bfb9", "comment": "Malware payload (NanoCore)", "value": "47570f97f56fac965a37e59bfc59e64e955c06a6c4bd260c857888272252d41ec0192fe95a79883c6aa10333ec2c1507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334709, "uuid": "a680b2f7-8b91-4781-b6ec-437adcd41f95", "value": "T14C14CF563BE98A3ED2DF85B8611202578378C2E7D9D3F3DA18D851B78B627E40A070D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334709, "uuid": "1b7c53d4-004b-47bc-9d8e-782ad3d5362a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334709, "uuid": "320f1e98-65a7-4bd8-9f9d-be901845e233", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIXJPAGTwjgaxODOeSQcY/UShKT:sLV6Bta6dtJmakIM5Ir8PxtPY/1KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334709, "uuid": "473106cb-8c4c-4c3b-b87a-7201db8e5f62", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334709, "uuid": "a2cedfb4-eef8-49f0-afe1-c2e0c4e0626f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334709, "uuid": "29286953-135f-474f-b571-3f96f9b77f06", "value": "8FA3B2EB7650AC7FF7DBBEED506E3F17B805D64D69327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1304c7cb-d1dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652350368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350368, "uuid": "dcba080e-3eee-4cae-8e01-9cf9ee831cb3", "comment": "Malware payload (AgentTesla)", "value": "361552ff52760600ee4e0641e9de35e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350368, "uuid": "325a2924-45ff-4b92-84bc-99dd306182e8", "comment": "Malware payload (AgentTesla)", "value": "8fa923cb64de15006a31d8ff349db8e227aa69080db9cfbf715efdeeb063feac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350368, "uuid": "932625d8-789d-4a43-988c-91ebeea872f9", "comment": "Malware payload (AgentTesla)", "value": "b4e61a42ab384019ca4a338468d6b9b611950949", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350368, "uuid": "b32e6581-dfd5-4f52-b293-6939362cdb80", "comment": "Malware payload (AgentTesla)", "value": "f56b162ac6a6fd29e7cee4eab417180787a8839313b4a7f838f592c9522fcd058524aa6482b1dedd5c09470decaa8db4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350368, "uuid": "f8ecff84-3664-4d93-b68c-c1dcb7c54a49", "value": "T1CB85AE107A998A24E6FE3737E7D6185017F6B4D25F32C64DB78E27920823253AC0B75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350368, "uuid": "16c6c000-0429-4aef-95b7-8bb886d1a95e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350368, "uuid": "5ef19822-ba3e-49a6-aa69-fc21544049c3", "value": "49152:oScx3tieZOSaoOv4K/Djuj/+Ttlw/nLaeDasBeooM0qv+Q4pYTC9rt0TsKfksmao:5+UYUCZEuwU1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350368, "uuid": "7da79547-3cdf-4151-9830-87e04e835f12", "value": 1805312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350368, "uuid": "1e17cc95-a25d-46c8-a5d5-5ed4c7961536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350368, "uuid": "6a0b2886-d7b2-41c4-9b95-495ed83e92e9", "value": "SecuriteInfo.com.Variant.Lazy.178938.10008.14333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfbcf79-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317956, "uuid": "6c13cc9c-e95e-44ee-b1f4-4cfd4577c562", "comment": "Malware payload (Mirai)", "value": "268eb1be6e4db3942db62d1b6d64f943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317956, "uuid": "ad8c2dd6-4507-47cb-90f6-ba2d649ad2c2", "comment": "Malware payload (Mirai)", "value": "8fcb77ad11cecb3aabb785e3ee917a0d01a782e45dd27d7f14c22913f637a440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317956, "uuid": "011974d6-3822-49cc-9708-8d7e64ea06f4", "comment": "Malware payload (Mirai)", "value": "f5bae2c200405ff1374fd58033228bb2f6d22b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317956, "uuid": "eaaa93bf-492d-495c-b6a4-8c798b51fc61", "comment": "Malware payload (Mirai)", "value": "aa8280d8cf753a35d7574ba116c44171332b4cdf5ae8284b389b2a24a2345dba096a2646c5ee6291a47cfb2bc329d644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317956, "uuid": "ff98276f-94c7-4059-9b92-46340d06ea5c", "value": "T14AE2F26B0351F4A0E42ACAB353BF0FDC1D120F7AA0A7CD8595789123BB82051759B7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317956, "uuid": "ec93da8e-3eef-4fca-b26e-5da0dd15f518", "value": "768:ub3VL5XxPtQ+VF5XYmsxUQiQvjHmFHUxl0NnJgGlzDpUYs17:2xPtvVFsUQiQ7khNlVqYG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317956, "uuid": "aed5f12a-7458-487c-b6ed-9c8eb64239ca", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317956, "uuid": "aa4feff3-329f-44bc-a9ef-2492c9d27d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317956, "uuid": "51200a0a-0a62-4890-b0fa-3c161303a30b", "value": "meihao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fe6ff7-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652337458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337458, "uuid": "43f88f9f-bfbd-4101-b1e9-2fc0c8d7e02a", "comment": "Malware payload (AgentTesla)", "value": "17ffedbfa8908e0c81413ad9186cdbb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337458, "uuid": "2ed191d2-c31b-463a-8039-c406eccab77f", "comment": "Malware payload (AgentTesla)", "value": "8fde90bce935670ac7c045c05916acd18f5005ff070cd3c88f5689e6d53245a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337458, "uuid": "ee8b172f-2d11-4bd5-a4cb-4b5b45b6d27a", "comment": "Malware payload (AgentTesla)", "value": "d42584ca759ccbcce407ae6fd05b96a03ce645cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337458, "uuid": "360acb58-1aae-4789-8e6d-c5c999fcdfa7", "comment": "Malware payload (AgentTesla)", "value": "4259011b8d5963fba75d6e464b9db2cc802668adbf1ad9daf8e92886ec6dec507698754e4b9999e6875d70dac9af93c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337458, "uuid": "901c13c1-6235-4e0d-b338-ed9402da910d", "value": "T17A241A7E13855D41C6EE41BDD0B6815811F1E703836AB38F6EE248FE1B162CEFA2A5D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337458, "uuid": "37639bc1-203a-4186-96d3-e664b155f08a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337458, "uuid": "3d7944fd-8b0c-4640-8d4c-a97c7ddd41d0", "value": "3072:k0vINhjcK79GKm3lD/dMiGeVl4UNw7EkDZ2go/CSN5DFNmqaCPpbrEQt+o:HvBaoZTdkpUNw7EkV2R/D7hraW4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337458, "uuid": "b6132bbf-09db-4875-826e-59169c825e99", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337458, "uuid": "a25b2594-032f-4432-801b-4a6012a15200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337458, "uuid": "22ed0c11-d68e-4571-ad82-bb88aa676e04", "value": "17ffedbfa8908e0c81413ad9186cdbb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989be759-d1d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652348015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348015, "uuid": "8e3a6536-ffaa-4dab-a727-795b0e7b282f", "comment": "Malware payload (AgentTesla)", "value": "661d7e4b1ae86706d423ef18623d4dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348015, "uuid": "11f06aff-492a-4e2b-af74-2d7588c8242b", "comment": "Malware payload (AgentTesla)", "value": "8fe1ee641cf70783f81797e27eff13e2d1123a2d217511701494084489356dab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348015, "uuid": "12cf20f4-8688-451d-867b-f8d7e3cf5b31", "comment": "Malware payload (AgentTesla)", "value": "4b0a2f1bd27752542ac92c1f18f37b28dbda0cdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348015, "uuid": "5bf90e16-a883-4f7b-80b2-aefa8aeec662", "comment": "Malware payload (AgentTesla)", "value": "61276d06cda0e37b6293ef559406441b2f146b3b23009202c211948d03c2395e3ad74f98ce085f98ac0c677e3e84453e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348015, "uuid": "08c5c257-177b-4a91-a053-7b27635f716b", "value": "T195C4E05E63C8FD28D17E3374ADA4A19043F1E1C71A7BD34F968581B57722B887BC12A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348015, "uuid": "7c6cd78b-2317-4322-875b-82271f48ae85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348015, "uuid": "6fb9dbd6-cecd-4b5b-9fe5-e49605f5dac8", "value": "12288:wkKkRwmjQt+TPbV7BdJHnIrs+n1QpYeDowtgi3/P:wkKkRwmjQ4TPbrHnp+gYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348015, "uuid": "6187bbfd-bce9-4486-827d-0d2507bf5776", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348015, "uuid": "6c5c3b3d-0a22-4c83-a8af-abf3cf71e395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348015, "uuid": "4463b137-0f90-4ffe-9e0a-5aa6c7ca252b", "value": "104 PICIF RIYADH AWARDSHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd92669-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337231, "uuid": "8dea5155-ed70-4fa9-94af-99b5974e5dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "33635257f9727f78242cd66cce5f5731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337231, "uuid": "3c6d95a4-849b-45d5-bae6-c2967c073817", "comment": "Malware payload (SnakeKeylogger)", "value": "900081ec8ae916aa0823f579ed08ec02b5d9677c23932287db2be8117ebd238a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337231, "uuid": "dfe21435-257a-448c-85b5-3f3eef31fcd8", "comment": "Malware payload (SnakeKeylogger)", "value": "f6a986760d0d5426b1d5f63423dd284a1952bc33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337231, "uuid": "52ce7a37-ce4c-497d-9803-aa9f6c469d5d", "comment": "Malware payload (SnakeKeylogger)", "value": "cdaa10f960e1f0db3dbeb0e9dcc4be10a3bcd76858b06139918d55a809be4e01f89bc8d9c9a941aed6d6ba8fe69cd41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337231, "uuid": "e91d629b-c426-4eba-940e-8fb94ba61a03", "value": "T16E137D81B718E006DE9A8D30DCD7D6F25A31FEA6EC40464B30A8BE9EBC7579116C251F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337231, "uuid": "0b8f4b0b-397a-4f09-a37c-24f012849e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337231, "uuid": "e29fe83d-a7aa-44ac-af55-32831803a0f1", "value": "768:4vQiODfWWWWWW4nrv1SeSdvjYGIUe0p0Fcp23+zjk:oQ5TWWWWWW4Id7aauZ0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337231, "uuid": "406f9b14-00e9-4e46-b08c-83cc5cce569a", "value": 43856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337231, "uuid": "9e678079-4bcc-4265-b77d-ae528789ccf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337231, "uuid": "3cefdaa0-f6be-489d-85a2-a8a2814c2611", "value": "33635257f9727f78242cd66cce5f5731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd85d2e-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340212, "uuid": "9b20e06b-fcf4-4a3e-9f8e-24ea70aab23a", "comment": "Malware payload (Formbook)", "value": "38c336016a18c05ebab79d9eb1ebae1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340212, "uuid": "1b114412-71c4-49e7-94c3-deb69a342d8d", "comment": "Malware payload (Formbook)", "value": "90356bb6430069175dceadbe232fc27e9bf5757edab1d3a0a92582db5cd36c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340212, "uuid": "33b5bdda-f716-4204-92f8-f70dfdbdcc16", "comment": "Malware payload (Formbook)", "value": "ab376e5f2de58d04c847831f33994eb464a1fe31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340212, "uuid": "75333101-a491-492c-9044-32640cefc87a", "comment": "Malware payload (Formbook)", "value": "e7412653fc43db857247ea53f7e28bd3ce93b4ee482562d563087202d4c088d885c8e38c59ca4650d7373634243648b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340212, "uuid": "b398818b-4f85-4358-bf77-44f7099c0f17", "value": "T110355A62B1E1D536C03256784C167EB55BB6BD10ED34A886BAEDECC84B34EE13B21353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340212, "uuid": "c545b174-209b-475a-a567-72485486edaa", "value": "a394cc215dbb58f1799a34551bb75374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340212, "uuid": "ab1cb8fa-27cc-468f-966f-dd1143b2db0f", "value": "12288:vxx+UPkKD0b5PK/Chm9pbJh8k4LYIZzUzs1WHmVDIF5+RgML9r4FKI4/8:pECA5PKKupbJhqEIZzymVDJvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340212, "uuid": "33de4fe7-6b1b-408b-99ae-ea2c85d42965", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340212, "uuid": "7273cf6a-a7a7-4d6c-b834-7c9b23e90b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340212, "uuid": "052c6b24-df7e-492f-a4d1-d322409cdbc0", "value": "Siparis eklendi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaeb83f-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330221, "uuid": "a97cbc37-cbc2-4731-9947-080b3da1371e", "comment": "Malware payload (Mirai)", "value": "b36b818086012a4d655ef2860f5f7cfa", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330221, "uuid": "ee7d4b9c-59a1-49b3-bec0-414d10afb088", "comment": "Malware payload (Mirai)", "value": "909fea0549945d6a0d6bf95ed647fb6959a28c730742b0ffcf84cd621068e1c6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330221, "uuid": "92bc12b6-cd9a-4120-b751-a74beb4fe6e3", "comment": "Malware payload (Mirai)", "value": "a97a583dc1228d60ba4f5dce4bc274fd9c321082", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330221, "uuid": "7f770bac-2b87-4a7a-8520-4c9207220a50", "comment": "Malware payload (Mirai)", "value": "b3de7a7038d96cbde1617979e2866807a93171a763d17aab98e70b08f505487a84d53d6433466cb81327f6a345f35a0e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330221, "uuid": "84285bc4-3cdf-4dec-9e0f-c67505ed971d", "value": "T1D5A38E0772C08CFEC8E7E6B45A5EA6258D32F59D2221F15FA7983F163C4DD105B6E2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330221, "uuid": "cae12fd8-70e0-4dc1-afe9-b9610d14e017", "value": "1536:EGNVCBGGsDoCjlr+JrYPlYg0ET1fNodQYCwLy9gZUEpACUlM:HVlDorJrYPlikFNRvj9gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330221, "uuid": "3922acdd-b66c-4d90-b92c-6c3da0e4d631", "value": 105456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330221, "uuid": "390650d5-d5cf-4c7a-adcc-81de89a2f47a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330221, "uuid": "e554f4b0-5535-4f32-ac83-880ac643de18", "value": "enemybotx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2468c59-d21c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652378230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378230, "uuid": "8ce1fff0-e62d-41aa-a323-edda1e04eacb", "comment": "Malware payload", "value": "8dd91e4c98613caf4034f6135c42409b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378230, "uuid": "d510f951-0e0b-4355-8f30-4e0638ddc07c", "comment": "Malware payload", "value": "90b9b520a8a83ba27bf9fe7d6b666c5cbfd3b67a6c362988f4a78a89d54faea8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378230, "uuid": "ccb4cb26-d3b0-4c42-8f36-45edff24eef2", "comment": "Malware payload", "value": "b62b3d24ca220e2d03b71cecd20ca446a178e857", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652378230, "uuid": "ffccc24f-f977-48af-a7c9-e9b10730dd18", "comment": "Malware payload", "value": "284a8378930d1013cd9fb017bef17cc2aa64bc1717b9d3f5df90b229e479b4052213bb2c128f8246c0c17368b91ade82", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378230, "uuid": "e3dadd51-2e08-4a21-95e7-c8e2223c8626", "value": "T114E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378230, "uuid": "e6cbcd6b-b536-44f1-961a-2c8dcf56f558", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378230, "uuid": "00887977-3588-43c1-8e9e-dc8f4d3ef988", "value": "6144:mkajLyaPIvW1TFpvzYNB1MCB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN836nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652378230, "uuid": "7ca7d526-d20d-4c5b-aca7-83f22d642950", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652378230, "uuid": "2eadcc11-1187-4724-9e50-e865a6839fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652378230, "uuid": "f1d0acf6-d81d-467b-81a2-0f058ccf1584", "value": "sQuUUDbggx.WTM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093cb251-d1b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652335319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335319, "uuid": "ea74ca08-7ed5-4969-ae68-636503225338", "comment": "Malware payload (DCRat)", "value": "e09927fbcae1919a4550198463579d08", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335319, "uuid": "6c22a67d-2310-41c4-89f5-1f87ce059c6f", "comment": "Malware payload (DCRat)", "value": "92f8e37e5ef9e822c86f385e482f8a20de4da03d6f1e23739111214c5774319a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335319, "uuid": "53dcbdd8-73ff-466f-a671-32d58bb54feb", "comment": "Malware payload (DCRat)", "value": "c7bdb98e123cded9b5626ba6a1856a29fbda847a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652335319, "uuid": "4a7d1de3-86d9-41d1-a83c-201b0a883f30", "comment": "Malware payload (DCRat)", "value": "b52685d36293ef1a4b83ec86f96a5bdd113b94ba9a559c9e812d2af55dd1f14970e7396841266fb4d8e4f0de13b5151e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335319, "uuid": "8745b7f9-f2eb-490c-b80d-498f5ffb014f", "value": "T1E57533BDB42E68C4D426A2F275983B03C62D3DC39CD12AE157484D627E4582F9EF7893", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335319, "uuid": "d913c183-db8d-4896-83d4-4544072dff53", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335319, "uuid": "a7a44975-403c-4706-a269-7648bc1afdf1", "value": "24576:OxW/O0pdUs1jxSMUC3m9HfWejnJiXwAHj2pp/blvLvSgg+gshuIy4+x2D1mRVk4d:cWpdUsRxS6IuqnJu+ppTlvbSjsgY+x6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652335319, "uuid": "1839a930-a43a-4a96-b382-7f597e1b00d4", "value": 1558528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652335319, "uuid": "85f6477f-8a6d-4bad-abb8-05cf792ff6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652335319, "uuid": "3c4c8b5f-8f14-4f74-b477-66868e61bd58", "value": "E09927FBCAE1919A4550198463579D08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f55b783-d241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652393982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393982, "uuid": "041b7458-ace1-480c-9431-d89e373c8f47", "comment": "Malware payload (Heodo)", "value": "e2cfeb05a93c8d6ba21ee2f59dc4a599", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393982, "uuid": "a3ac0e0e-1111-4949-936a-82c056e6c1c7", "comment": "Malware payload (Heodo)", "value": "945d318705d7291b064860a7dd292955957ef0280dbaab10a4b32dfb4ca07936", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393982, "uuid": "dc524be4-57b0-4c99-bf25-d36f2f83b122", "comment": "Malware payload (Heodo)", "value": "dd014f31c43abacad9628d17bb4a48cd1f5e9e47", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393982, "uuid": "066717ab-0c52-42ae-aa05-d41aa67da15e", "comment": "Malware payload (Heodo)", "value": "658d592730639eec52bb8d991330161f457e7739f40ed721e0f4141f35c4615a3f1985bb2e23f14095d5962fc826cb78", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393982, "uuid": "bc95bbe9-0e3b-4df2-83b8-7d868845f4e8", "value": "T10AE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393982, "uuid": "dc287399-3626-4722-a95c-20243d9bc428", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393982, "uuid": "695388ea-283a-4d28-8474-cd0a821c1fc8", "value": "6144:mkajLyaPIvW1TFpvzYNB1MiB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8D6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393982, "uuid": "1d2faed3-a2bb-4395-8f57-c780a3dc6e61", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393982, "uuid": "142ea059-e27f-42ce-abaf-ffd78f2b00fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393982, "uuid": "f1054eb1-0371-4470-9cae-8d0969549932", "value": "e2cfeb05a93c8d6ba21ee2f59dc4a599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee48c063-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652363621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363621, "uuid": "a95b8a62-2b1a-4f43-b45d-6e693b9ae212", "comment": "Malware payload (Growtopia)", "value": "8effc74c80e99510d1f76f82dbac64f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363621, "uuid": "52062c70-2299-4035-b296-8d02db2fd0ac", "comment": "Malware payload (Growtopia)", "value": "94d38000c71a6302d3151c8635347117434e96d34771fbead6b2f1dabdf1e8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363621, "uuid": "eebebdb6-ee46-40fb-86c0-67d0b3b7289f", "comment": "Malware payload (Growtopia)", "value": "ec11f9ab108224f4ae20da0e5911dc6144bfd2bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363621, "uuid": "6b742168-4921-418c-a0b1-008a9262fbd2", "comment": "Malware payload (Growtopia)", "value": "9edc3e91c4ff40fa0800b18ed061d2cd20be5bf29895baf59928d94b4e676218667f874d5eb878b07839142d6a292289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363621, "uuid": "f9663e94-8c09-4c9b-bf4f-dfc82692f068", "value": "T114520910B7E44236D5BE8BFA0DF297249331E986251ADF5F28C8125D1D367434D92FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363621, "uuid": "8c7f5a34-a85d-47e4-9621-a80b7f2d3496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363621, "uuid": "4ecafdc0-25ef-40f5-874c-c8eb91cfb41b", "value": "192:VHvcNcub+SzMl1NCSs4GwEDRwwasD9WKYHr3cjM4Jt31K3iIO6:VPcNcub+q6ls5waqwac9DYL3cjhDJIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363621, "uuid": "1e7ed108-c9f3-402b-9f43-82f388f21638", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363621, "uuid": "cbf69dc0-110a-47c9-8f97-dfd5daf75e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363621, "uuid": "cacc2568-2b3e-484d-a97b-2b5ddb992bb6", "value": "94d38000c71a6302d3151c8635347117434e96d34771fbead6b2f1dabdf1e8b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb9c734-d1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356263, "uuid": "ca80ad3e-a6c2-4dd9-b5b1-cbfae30bd87d", "comment": "Malware payload (Mirai)", "value": "42eedd893e741b0d4f1608878975e63f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356263, "uuid": "b83dbd73-fabb-474c-8b3b-cb2e66262214", "comment": "Malware payload (Mirai)", "value": "9572ec7ca1a56692559cf79c7431e4cf100092cc21cef4ec3fa8814b724d71e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356263, "uuid": "408e3dc6-3a2f-4c43-9143-800409c62d74", "comment": "Malware payload (Mirai)", "value": "a3b3f3e4d3b9d1b021e05754e21f9404713b6b17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356263, "uuid": "7db78c48-08db-4f10-95e3-3ba1f7ba6379", "comment": "Malware payload (Mirai)", "value": "27b88199af4f427f24dec2769a3c41f05f51bfcbc5b333c5133f47333eb81394eda0f840c1085a2db9247d72806096f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356263, "uuid": "df549305-56f3-4dc4-a917-200e9101a1be", "value": "T1B023F2519EF959C0C1991438CD8DF9432050F93CD11D99DFEAD072A97FE2B2C9F08A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356263, "uuid": "664692a9-c192-4ac9-b726-24215f571967", "value": "768:70hO2jd5U+ps6UnFL2slEhH0u8SBjJdE+glqzCgq5Gvx9idM+nbcuyD7UGQRjGwt:70hr5UQs6UnFL2sKhH0iF4gBidtnouyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356263, "uuid": "8e859bfd-a355-4152-b68d-1aba3e5f3b52", "value": 46680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356263, "uuid": "71407765-ccc3-4683-ab67-0872e1f10d7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356263, "uuid": "ab18ce38-960c-4314-b2a4-867d7574ac5f", "value": "42eedd893e741b0d4f1608878975e63f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cbcb80-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346192, "uuid": "f33e3395-005a-415b-9b66-221660af1e69", "comment": "Malware payload (Heodo)", "value": "a5cb2b2c5fb132ca14d6cb61e7d1d0c4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346192, "uuid": "8ec75ee0-080c-4cd6-8284-b7a30323200d", "comment": "Malware payload (Heodo)", "value": "96ee31e3435c44000cfd47f26f4850c87dfef1021cd5cd6fe89663521f43e079", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346192, "uuid": "7749ec29-25b4-4b9b-aff7-097577a17b7b", "comment": "Malware payload (Heodo)", "value": "7af2df593a522020527d1fbb68ea1b2ee1207246", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346192, "uuid": "88156cc3-2846-488d-813d-fa4ac3c4c24f", "comment": "Malware payload (Heodo)", "value": "d5daa994bac354929852b3fe1df69d66e1be6061d1ceff16eb11e5304dcb503ec89a93382c26c01c23c55817e9beb65a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346192, "uuid": "3a754de8-5e76-4f3e-953c-5352be759fee", "value": "T1EFF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346192, "uuid": "16ef97cf-988b-496a-948c-f5c3a5b35989", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346192, "uuid": "c2e88f30-6d3f-48b8-acd8-02d2c3c6634e", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSTjNwgraKRT61cKGNx:S4DzZKnH42RGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346192, "uuid": "9fc96258-9a33-4ec7-9810-e594738f98ed", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346192, "uuid": "f07c72eb-7d9b-4bea-82ac-85608f9a3927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346192, "uuid": "c5a789bc-4a00-464a-b437-55bc848540bb", "value": "eXMavB3mzVvKK6oOPXH.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a13491-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317917, "uuid": "4cbe5cac-fb0a-4b84-9cee-d5aace0a83fa", "comment": "Malware payload (Mirai)", "value": "98c7b36c74de515ce6a70e68919a264b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317917, "uuid": "254dc094-4d26-41ca-b86d-a0d482d2d0e4", "comment": "Malware payload (Mirai)", "value": "97492cd1998163b265246afde4ef551615099114a7684a2174b05bf91d8081e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317917, "uuid": "56d4c61b-a732-45bc-a5ab-c9e3d876989b", "comment": "Malware payload (Mirai)", "value": "37f3f736bcfe3de4b32864ec786457405c5a1087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317917, "uuid": "3b1061eb-edc0-41ea-a878-ccf20f462e60", "comment": "Malware payload (Mirai)", "value": "33789f07c25ee2becca92d69383ccd16f3a284901bc299e0bc4a29aa5a9723ff3a6dad0184a8f67007ef4a4aa9ec1280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317917, "uuid": "74ca720d-25d0-4f6e-9ed0-23044f4a6fdd", "value": "T167D2E071F1487530C1E48F37DB7C66467906E9FCDCC3989A1E24972C9D8B44316EA692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317917, "uuid": "cfac8743-794d-44b7-bd8c-6a394e31924e", "value": "768:30QhSv2RccBazBYdfNHj2a7pDF1zV1ub/r/3TU3Ua:30Qh6chj2atvUD/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317917, "uuid": "fcfa469f-6476-404b-bd05-f3e74d9ce42a", "value": 30504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317917, "uuid": "7a86d660-f1f0-40c2-97f3-f6eaf36a0783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317917, "uuid": "beb8e240-f173-4c47-9936-49438d0591d7", "value": "meihao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfe6e2f-d235-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652388771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388771, "uuid": "1ad5fee7-4b61-4bb7-a14c-e612b57dc393", "comment": "Malware payload", "value": "d55fbb68cccfc67b3af7b345bdeefda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388771, "uuid": "e65d117d-b3ba-4470-bb88-6c102d60905b", "comment": "Malware payload", "value": "979a8054b45d09d2c01a9e888e836a4452f4435dce06dd03be67e2b2ff30926d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388771, "uuid": "4f6101c3-4cf6-4e29-97c2-2391e3fbf082", "comment": "Malware payload", "value": "c793ca00c74365c3bfe2fef70e42777aa4b52d84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652388771, "uuid": "726ccd26-d2e2-4393-a8a5-6e4801baf4bd", "comment": "Malware payload", "value": "a441aff30e35d3cde17da18a14a7f09e34b4c0039b0191a1d83996059b06fd6e6cc922aa16c22fd88e0239fb7ccbf508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388771, "uuid": "864ff5fb-2164-4451-8304-a780f739c468", "value": "T16CA4605C7EA10A76FD4D913856030A08BB538F336B4EDAC127DB2DE887DE1D91D85C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388771, "uuid": "db8306e2-0c15-4a8d-93df-6f01be86044f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388771, "uuid": "bfc6185d-fa51-4d7f-9b51-ce041fbad8d6", "value": "6144:0OKbdc8jE6eR2OrrZDaM71SDeJ58ElMu3HYfbVoVdO2bVpDB7gbTuVedjd/2J93x:sjE6K2OrFDz1YeJ2Ju34fyVdpNxMuVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652388771, "uuid": "03300b48-7857-4c9f-a123-89e54d1acd1a", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652388771, "uuid": "54315ad4-4b04-4de7-a914-0694c89624b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652388771, "uuid": "c209bdb3-6eec-4244-970a-a809c17583de", "value": "SecuriteInfo.com.W32.AIDetectNet.01.27999.10274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e392c1-d191-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652318514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318514, "uuid": "439ce964-6fb0-4852-b134-4234a7810d50", "comment": "Malware payload", "value": "1b27c6c92d42d56bc084cd05aa8e192b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318514, "uuid": "3294cb41-b7f5-4014-9fd9-9fe93b284f3c", "comment": "Malware payload", "value": "97c57c117dcd9e867982cddd53c3b9c1ccad1ddf167723c865d637a963db0dfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318514, "uuid": "79cf9dfe-7dce-4360-ae19-7d03d7130228", "comment": "Malware payload", "value": "60c04880e9f15fcb89e10ac5c97cd970d1d9b8fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318514, "uuid": "5096062a-2244-4036-8f37-486969f68bb3", "comment": "Malware payload", "value": "7116d5324f21562c92bd3d441a5e756a516a3e97a9ad32eb419a322b6635dea5843a613ad61ad94ee4f3307b7d56e9cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318514, "uuid": "b747e6b6-7caa-4ce1-8ed6-6e7b91756b64", "value": "T132229646BDC28F02D5804139EB1F61493B235B2DF2DBB3172B256F25670797A0B3AC59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318514, "uuid": "5599a301-6697-404d-b192-de331de44e5e", "value": "192:hcYcnuOJJS8vUnvz5CK2YUZtIxAjxRlKnjiFRGPzQj5hwVRVgmEZx4e1:hLcnuOovzU3YUunjiF1wVRVgXx4e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652318514, "uuid": "6baf7cb0-552e-43c7-acfa-5caab0425dd3", "value": 10844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652318514, "uuid": "f3997c70-b400-4af3-94f5-c5f1bb5399e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318514, "uuid": "ac50b40b-48ce-43a0-9b0d-03c9346c8cec", "value": "1b27c6c92d42d56bc084cd05aa8e192b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d6376f-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1652337291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337291, "uuid": "ebf4dfd2-6b94-43ac-bd43-b4632d0ab6d8", "comment": "Malware payload (Socelars)", "value": "c8df56a53d1732c83223e3d90f417a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337291, "uuid": "26d6c7b3-40f6-4853-bb02-bce803348487", "comment": "Malware payload (Socelars)", "value": "981432ded62311c70f687d29f6b875624a8f27613636e45e0932637958e908a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337291, "uuid": "0dff0b9a-b7cf-4a96-925e-c285fd22f4e4", "comment": "Malware payload (Socelars)", "value": "eb5157bedc0c0fc9cc9ae2fa8cb87759a51e7290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337291, "uuid": "d75e432c-f61f-4c31-8f9b-b1def8ee9d7a", "comment": "Malware payload (Socelars)", "value": "50d1acd385b0157b337c832721ad14262c993cc9fdf1ea149e2407675215ed4ce28022b8407e27daf453f3e752b73b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337291, "uuid": "f1461c1f-6041-4f6d-9cc4-575d2f11b27c", "value": "T176659E11F642A036E8E3007285FF5AFE8D28BE21031854D7E3C479A95E715E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337291, "uuid": "2ad57d3c-efcf-4062-9f33-bc70c1154b29", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337291, "uuid": "dd5a1576-91f1-410f-b3bb-64aeeec308c6", "value": "24576:LJUpVuAV1cjdFq9qRwHd2d1pv6/5ltE3Ib6PG0LD0SXuWtI:WpZV8dZRyeM6PG0LD0SuWtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337291, "uuid": "1c31f867-c9e3-49b3-a762-0ed77b65033a", "value": 1524736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337291, "uuid": "560aff56-7b76-4d95-a4c1-fa3e9fb910a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337291, "uuid": "b0d3d133-e992-4656-85b9-7e61ab586fb2", "value": "c8df56a53d1732c83223e3d90f417a8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46dd9f6-d1b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652334425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334425, "uuid": "77647d69-6e49-4239-b0d1-37c2fe2415f3", "comment": "Malware payload (Formbook)", "value": "3f66c5a73f81ee5749db37036615c84d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334425, "uuid": "0fa794f8-2d87-41ab-aeff-80f714275842", "comment": "Malware payload (Formbook)", "value": "98b35d9cc910685128985f8e2cdd74e7b87014552a8d392d6e48b4aa2a33df7a", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334425, "uuid": "bc460473-c87e-4dca-9d3e-b9527e29f74a", "comment": "Malware payload (Formbook)", "value": "a64daa78c918e84b6533d9018f5b581258773185", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334425, "uuid": "fe5ad121-bed8-4252-8c7a-d31330e4f770", "comment": "Malware payload (Formbook)", "value": "39df8f82f70208d3ba06555a1c866403bf585ae3454a7b74114222eb2fc46817bacf1dd8fe67a64651ebcaf8bad62a11", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334425, "uuid": "1df0234c-dce0-492d-9318-a5e01e1bc1fa", "value": "T160542308E9679CA295DD40E692095640D15DFCC923A3FF72CBCBEA4EC877305E95E603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334425, "uuid": "71728af6-ba6b-403c-a65f-fa3c67a65509", "value": "6144:rp799RNqrzM3UEr3RSHKuM2MQZIUmpZ5glNfincn3p8u:7wrzMVLR6KuM2VZIUugf6c3pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334425, "uuid": "773106dd-c69a-44b9-946d-0655449f5d0b", "value": 295249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334425, "uuid": "595aae1a-e977-455b-bc7f-31f696a54894", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334425, "uuid": "2f38068b-6fc1-4d70-a29c-a8c0b75cb728", "value": "DHL PAYMENT REMINDER.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d400a00c-d23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652391064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391064, "uuid": "ea70b9dd-bd90-4487-a862-312cdd1fe6dc", "comment": "Malware payload (AgentTesla)", "value": "b758085536dfad4e777f338c502d497b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391064, "uuid": "6a7b4950-64e3-425d-bc38-e67673c4f82a", "comment": "Malware payload (AgentTesla)", "value": "9938dfd6f77a545a4755547b7aee8b6a5cbce2063f47080ab222038e250c158e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391064, "uuid": "371dc318-5a13-4a77-8b8f-0ddb42060db9", "comment": "Malware payload (AgentTesla)", "value": "a70aadb52a93d6d09c2a5d765293f2e3e15e8cb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391064, "uuid": "323cfb65-6353-4746-885b-cdd7f302ab39", "comment": "Malware payload (AgentTesla)", "value": "c424f742011e0db140213a1c9b1f33f2f16b81002828789131971c13f72febc99eefbfe06d314fe78929dd6f20398dd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391064, "uuid": "a1292f83-3b9d-4613-a510-3abddde4024a", "value": "T1C8A40219BB7CAF37E93C97F51610631453B79ABB2272F2959DC2A0C72060F508AE0E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391064, "uuid": "75962669-9e01-4a14-9717-461e4edcb4d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391064, "uuid": "469d8d94-fc64-46d2-bcdc-5f433fe1f297", "value": "12288:AGqSSSNs84sT8UeVWfueOhd1RVhiM0tHKcIOnP69BjYP/F06:bW8jY9h0tHdny3Y3+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391064, "uuid": "42aadfea-3e22-4aee-adf8-95448dea01f6", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391064, "uuid": "795858bb-b4b9-40b7-8071-766cb4e98076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391064, "uuid": "92a1fd51-5333-4c67-9dfe-0abe5b70208e", "value": "b758085536dfad4e777f338c502d497b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ec014d-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652334795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334795, "uuid": "76c392bc-ab46-49f0-85c9-6781d2ea03f0", "comment": "Malware payload (AgentTesla)", "value": "f3a657f058371b047a9ffe4a8b2dd68a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334795, "uuid": "f20ab11a-741a-43e8-9767-71e55aad300d", "comment": "Malware payload (AgentTesla)", "value": "99ce362c5699437565282bc8e672ce5482e54ff31c171b86456f2e5a47fde91b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334795, "uuid": "b00711e2-2509-4cd3-9075-e22f74a2874c", "comment": "Malware payload (AgentTesla)", "value": "8ffc2c31785f0d2d3ce8902280608fc60f502d0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334795, "uuid": "0427f70c-a709-4778-a0c2-efca5eb414ef", "comment": "Malware payload (AgentTesla)", "value": "a33972120809dbd4cb3e2879285ed34b6315a08f480328d5e3be07ec7c4690fb05e5a499965598f0afb15b4a64282ea5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334795, "uuid": "a839680c-e593-4b79-b4b6-3e0024a48cf3", "value": "T14D3539987254F9DEC817D171CA685CF0AA207C6AC31B820B90173D9EB97D783DF219B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334795, "uuid": "0ec085d5-5cd0-4e76-8cec-1adb4c38013f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334795, "uuid": "9d8c4cec-d483-47a9-9a48-9f2733392e1e", "value": "24576:Nq2Crw52Mq5NUX6sVfDhHeK0Vfbat7Vw:NjCrw5Ev7WfNH8Vfba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334795, "uuid": "4279e152-22dc-4ec9-b309-e9045573a199", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334795, "uuid": "7fbd5cb8-f60f-457a-baa8-f3b368614dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334795, "uuid": "6f85e117-74ff-4f5f-a44e-5113f14881fd", "value": "T\u00dcB\u0130TAK SAGE F\u0130YAT TEKL\u0130F \u0130STE\u011e\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be0a3ff-d193-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652319110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652319110, "uuid": "bac16550-a835-4113-872d-052b29348345", "comment": "Malware payload (AsyncRAT)", "value": "18ffa56615c593230c90b0a7604f7137", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652319110, "uuid": "04e9e358-b0de-42ea-b2ba-c49f7b9e4609", "comment": "Malware payload (AsyncRAT)", "value": "9a2e7210566b9018841c0569d3d20b733445408a533a88bb31c6949dbece5b5f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652319110, "uuid": "b2d84bfe-5e71-4245-be46-d7f37df7c332", "comment": "Malware payload (AsyncRAT)", "value": "b89443b6e6c038961d2a99abc001817c1a3f0f2f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652319110, "uuid": "4626907c-deed-4832-8855-0188ea78a4ca", "comment": "Malware payload (AsyncRAT)", "value": "530e3c7c0ff69f4429f5b3dd3b0b8df4e73245f71375fbdc24bade5559029ba3ca51de993f418c9309ae5a90ad0a31d9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652319110, "uuid": "9162c662-e9b6-45e2-8ec0-338bb7445e95", "value": "T178E4539C722831DFC867D276DAA81C68EA90757F931F4107A02715AD9A1CA87EF14CF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652319110, "uuid": "b5d512d9-c463-48f1-92f8-094ac4f54f61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652319110, "uuid": "a564b69a-9103-4f42-94dd-5d17a2abca36", "value": "12288:6HEuGo3GmymqYJuthQ4l0MQIxcWTKHdxdm1FysiueIEvPG8O5qVMJFs0DT1faES:CJtqwiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652319110, "uuid": "fa4fb498-f810-4242-8fd2-1aca9fcbff58", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652319110, "uuid": "6d6f3259-da51-4ebf-986b-c21c62bd3f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652319110, "uuid": "0df1ae1f-325e-41bd-b732-84e81d9895c9", "value": "Profoma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c72b85-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338592, "uuid": "0d60da21-0764-43a1-aa3e-b6473821f7f0", "comment": "Malware payload (Loki)", "value": "e25d8c752078c9a2c392368ca80f664d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338592, "uuid": "2643c9b0-18f9-415e-a6a7-80eeca8f2769", "comment": "Malware payload (Loki)", "value": "9a2f6f1f79b35686e4601c8356c2ef746bc77d0ca86a2b6b45308abfeec75623", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338592, "uuid": "67063c4f-502a-44dd-b29d-c2489e93bed5", "comment": "Malware payload (Loki)", "value": "81ac402d583d20ddc2d82b3bc11c38ee5a4d75ff", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338592, "uuid": "a21118a5-a82e-4bcb-94aa-082ac668249b", "comment": "Malware payload (Loki)", "value": "e1d1f7563827144921109a71dafd951b0351b1b29f4f9584d9e8c22eb134792f4f25d38b734773cabce221d0d03a156a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338592, "uuid": "a2906b79-8320-49ed-80e5-86b874e17cce", "value": "T1FD04125C32BA94D4F280EEF5B76889CA3725AF6182F332D4E063707EDD3195854A31A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338592, "uuid": "e6dc6632-db2b-4e14-af51-1e00f7f03fe3", "value": "3072:lgXFtOLBZBxdGJEbYi27b8oJjDMwaUTlvx7VJ42jX:CXTkFfbYi2/BHM0dtjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338592, "uuid": "f3305175-5026-4a42-bced-ebb826eb3c6d", "value": 188120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338592, "uuid": "d67ff115-e75e-4224-b413-532baec77f0f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338592, "uuid": "253f6e9c-7cec-49de-bedb-cfd91e705b2a", "value": "Scan_shipping_doc.XLSX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed26643b-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652342144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342144, "uuid": "603e587f-86fb-4bba-be25-38ce4a5c86e3", "comment": "Malware payload (AgentTesla)", "value": "2d208ca88eb382b9aa18c683d61ecc9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342144, "uuid": "5e61966c-c290-44b0-973d-89f2fdb74fed", "comment": "Malware payload (AgentTesla)", "value": "9a615f0c1b304a8198d2a714103f45173c96235798338830b045c8430fc0fcb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342144, "uuid": "d15a342e-24fc-46ed-bc55-463dcd82d78e", "comment": "Malware payload (AgentTesla)", "value": "caeb65eb95710c0eb7ac950ee82a9e5f17ceae01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342144, "uuid": "d18df84f-1310-4548-aa1a-2a62f7a63190", "comment": "Malware payload (AgentTesla)", "value": "59523c4639b7a28e5e7ad018470a896fb25a187125d0bb2296037c93f358179ddc29894c2a073f4a3a4ed6656c38c6f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342144, "uuid": "778972f0-1bbe-47cb-9d1a-e20adf208b73", "value": "T11FB25411BFE8A528F6E3B6394AB6F140A665BF166476C75A70F0F20B3F362480D73524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342144, "uuid": "017fb275-eba7-494e-b132-c574e40e00e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342144, "uuid": "4a3ac76a-4dc4-41b7-958e-f672c942c303", "value": "192:KWEdDrxFB8Vk3bXTmqdu658lIE5CEcQPVKe:KWyDBUk3bXyqdr7EuQPVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342144, "uuid": "4af03cc3-a3a7-4ba7-897e-d3d8a616fb34", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342144, "uuid": "84b8b464-a2f4-46aa-961f-256231bc487b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342144, "uuid": "dc101fa0-0adf-4e72-b9a0-6ea6dd03970b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22740.31547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2b4c21-d245-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652395803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395803, "uuid": "d475ca50-c6a3-4fcd-9285-0632b34910ed", "comment": "Malware payload (Mirai)", "value": "2f3e1f4ea42d0fc220162799eb553a04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395803, "uuid": "9af293ac-627b-42f7-b87a-d84afba07e49", "comment": "Malware payload (Mirai)", "value": "9a816196b26f82ed7dfba4f50ef4c0a3bb011a073bb7d334744c861a381e82f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395803, "uuid": "7e6dee6c-a184-4c10-80d0-22c8482792ae", "comment": "Malware payload (Mirai)", "value": "747224ebb28c9e606fd24d2216b97bb01d4c9d76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395803, "uuid": "48a33339-6040-46f2-babd-0600cacd79eb", "comment": "Malware payload (Mirai)", "value": "3f24a0244fc7156a742b22bd556d137d388ae246bb74858a42e1e12a41d81c53b0e9c825c9b0573b12ce0f030b4e9827", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395803, "uuid": "ab15dc72-1599-4c75-aa91-07a3ac30bc56", "value": "T1AC737DCED783E976E911043830A66B729E33F53A903AEA9BD74C69729C17901D31739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395803, "uuid": "94ea1cd2-6f9f-4a96-af76-1cca5fb466e3", "value": "1536:ipnBvWO/R31J+EK3vI5N1F52td4Yz0H0pavCMK4gCN7j8Z:iZBvB/Zi5I5NHcz4a0UpavCFIqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652395803, "uuid": "616f0cb2-d4e4-40df-8b95-4b5468c89d36", "value": 79212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652395803, "uuid": "c4d3ebab-38b2-4f32-864e-e0be90ac8713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395803, "uuid": "ccb4bdd6-ce78-4b04-96bb-e4de3a0f3ecc", "value": "percx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eada161-d1d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652348750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348750, "uuid": "ba008b9c-2f45-4034-b124-014eaad581f7", "comment": "Malware payload (Gafgyt)", "value": "0dac46c7d23803fe692b9c9692694d74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348750, "uuid": "8cbe83b2-3668-413a-89ae-f74da500b9dd", "comment": "Malware payload (Gafgyt)", "value": "9ac00522c552823b470ef6e195113cd06688fee3aa6ced725dee876b8c7557e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348750, "uuid": "0f354130-9e3e-4df2-af95-49a773470e6a", "comment": "Malware payload (Gafgyt)", "value": "59ffa3ef316d90481752b55a57caa83690fddffd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348750, "uuid": "9f23474c-0560-41a7-be3a-93c1c4d73e3a", "comment": "Malware payload (Gafgyt)", "value": "e919f5388df9a98011e982cf2945b36eb77dea0e97a282129e47b7f10f9d8b288092c0d63fad4a2c0547baa07792415a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348750, "uuid": "692e0dd6-b4b3-4638-b7b4-906fac64ce90", "value": "T149D30845FD40472BC2D227FAF78E029C3B365E68979B33156A347DB42BE17A81D39260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348750, "uuid": "33f2b6ff-4cb4-45ac-9ba8-874a879a58a1", "value": "3072:Rjb05cXvd23/4cXc77eJ44laPLSfQXuOUDdbNG:REevd2AcM77oZaPLSfQXuOUDdbNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348750, "uuid": "ea54f1ba-6ecb-444c-894b-ccd69c6efc59", "value": 133316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348750, "uuid": "6c61db7e-016b-43a8-ae32-10eaee11477b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348750, "uuid": "b7de006e-6edd-4d56-bfc9-f04cf60be692", "value": "0dac46c7d23803fe692b9c9692694d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7385dab1-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1652337215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337215, "uuid": "de9e0a45-3ee0-4398-91f4-adfc21ea184a", "comment": "Malware payload (Socelars)", "value": "415f7d77cc47f35d28a0485d798f20fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337215, "uuid": "a40fd9f7-d5bb-4541-be0e-757e6f383d19", "comment": "Malware payload (Socelars)", "value": "9b2aa8bda6b38105d9e53077c94b61a7d4c4f618417e21f10f2f1d3f67e5b4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337215, "uuid": "6f747fdb-ba4d-4bcb-b4ae-b22a1e17504b", "comment": "Malware payload (Socelars)", "value": "614b0c84c8d2158eaa90970c5016bc08201668a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337215, "uuid": "088da83a-2d8d-4ab2-8d0a-3e77a91b5b28", "comment": "Malware payload (Socelars)", "value": "1bdc1e3c101c9b8b63cede29e1e9f94d5a59d796e786a2c5f75eff905b5e6bea6c3cf2dc3ea9e7cedc834644e57853fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337215, "uuid": "0f3137b3-628a-48eb-970d-f5ff73033517", "value": "T171854A11A6419037DAA7887BCDEAC6BA8F286D21038450E792F03D5F7A705F2363F5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337215, "uuid": "e48b87e4-17a3-45d0-a02e-7a656ca1853b", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337215, "uuid": "060d450c-e1bc-4c40-bc68-2f63c062cabb", "value": "24576:cOHxp+kGXpwGm41Lit2zg2eQfIt6qRBRRtbSvOWT+PK/D8eq1YmGep:nxpwWVbGca/6K/D8f157p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337215, "uuid": "8aca9c05-bfd8-415f-a47f-4aaebdcf0731", "value": 1798144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337215, "uuid": "5a525b31-44cd-4999-96bb-abfb175a332d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337215, "uuid": "65a37ed8-afc9-4a06-ba01-5e440877008c", "value": "415f7d77cc47f35d28a0485d798f20fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7be9d5-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340671, "uuid": "1389bb81-d394-421e-a75d-166de07afc18", "comment": "Malware payload (Loki)", "value": "fefc2d8ef05916189407d8917c61ba13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340671, "uuid": "ce5c2c77-3394-4ff7-89e1-81e7b0e32d4b", "comment": "Malware payload (Loki)", "value": "9b7c9b230e6ebdb3a92ef55e153d76a3186555560cb26be387604f02b214050e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340671, "uuid": "de6b81cc-4e75-4587-b854-af7af2f263a5", "comment": "Malware payload (Loki)", "value": "92aa5269b897b91a220dbb70ac54c27807486fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340671, "uuid": "46a0b0de-9940-427e-88c6-cd027cfc2513", "comment": "Malware payload (Loki)", "value": "df5eec5d74a1f8cb788d52da6d5f748a1a4c1a58f1dd362cc91543c03aae4d86acf2260c540caf3b97eb29e92e10d681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340671, "uuid": "2d596696-5b04-423e-ac6d-6d3c35ad33b1", "value": "T1F8040216B621E837E5A32E716912A7775FFFDD36A4649243472077887DB2102A80F3F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340671, "uuid": "2a1fccb7-7bf1-4047-8a16-b5cfb777d93e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340671, "uuid": "28e1cd55-4e69-4d3f-bf8e-9e71dcb9fc42", "value": "3072:LODZGPEounbjmExzN84maHnPPGD58xqeQD5Y2BoHHOdsD6Z6Y25PBk8:LOtIOCExzsaHmIQ22OHOg46Y25f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340671, "uuid": "e0856b10-5737-47c3-9371-10a9abd1b92a", "value": 182454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340671, "uuid": "4a568e77-37d7-455b-b929-6be13ab587ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340671, "uuid": "1701042d-10e2-4bbf-a4f4-cba7aee42609", "value": "fefc2d8ef05916189407d8917c61ba13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa10893-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652345665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345665, "uuid": "d67b80c7-336a-4a8b-ae19-67d2a65101b0", "comment": "Malware payload", "value": "7ce85af1bba3af18dfd81e522d4de21a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345665, "uuid": "77b2b0b7-6a6b-4222-9388-08c98c7ef7c3", "comment": "Malware payload", "value": "9bb2f959fc0a48b9de6553bb1c83d8b46d12d4e2abeda8507b58b69093a6ecd3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345665, "uuid": "e7bced2e-83b7-473e-a6d8-c23b0d8cbae2", "comment": "Malware payload", "value": "11a98d4ba62d50df380686cb0d6f9d93f1bba446", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345665, "uuid": "10575eab-aa82-488a-b14b-12400b78a3bd", "comment": "Malware payload", "value": "65dc4aa695e007ae416039ef500168994afc672d24d95e741a0c43d6660943eacb754e385f3c504ed9bdaf51ff2f00ad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345665, "uuid": "3179e2e3-fa0d-41b5-9f0a-1625f6142130", "value": "T14931C9A54E644B95EB84F3F36A56490232C8355F4621FE869702DC961A3BB2BFD4A018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345665, "uuid": "cb09cab6-3d5c-48dd-8a95-7baa0f87e7b0", "value": "24:M1JXJVJkThXPQefQGzrlIc1zKoHGRP6YaXmboWQkXFZMasy61SQV7miu70dKUNDs:MvXJohX4HKeoM6jX4DQmiy61SaqF73XF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345665, "uuid": "d3303bfd-f629-4e23-9e9c-f03c8759a025", "value": 1489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345665, "uuid": "67930fbd-8a2b-4734-af12-aaa24f080494", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345665, "uuid": "2a91923b-04c4-4d11-a33e-dea66586e32b", "value": "Usmimilano.191 - 2022IS00008768.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e17081-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338806, "uuid": "067186e3-e164-4cae-9139-449ee0f7b0bc", "comment": "Malware payload (Formbook)", "value": "050f9f216b83151efe2fd0ce75b108e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338806, "uuid": "e1ac9c7a-4d0b-4806-8a37-2b7a285c6e20", "comment": "Malware payload (Formbook)", "value": "9bd10075169de7be40c2cf0e9089ee4ac4f96c5985f22e963ffdb1f0388b1715", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338806, "uuid": "0ad6d49f-368f-4071-a9b2-5abe9b3126f5", "comment": "Malware payload (Formbook)", "value": "109661d67fd22593e009c984d638379094d06d0f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338806, "uuid": "f94a5c36-a354-4e65-9143-b0a4c36b88cd", "comment": "Malware payload (Formbook)", "value": "d3a93a8d4799037620d9fdbed45c841989d783c840125843af0bffa72a63f0a831d6546e58b18ad842aca68bee04cc84", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338806, "uuid": "bcada044-99af-4710-8524-cb6bdd211f04", "value": "T1102412396F7AC582C18216753CFFBD27643EFDD740954949E8A3FA5613B84F0A232922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338806, "uuid": "41b0f580-8575-486e-9729-cad947712455", "value": "3072:hBdPzSCnKMIbdCQrYWuscXsSOxD/2Qgq0Wn63qWLAVQTowrmgYz0mkkwHGOsXwyu:3dlnWpLYWOKMWn4AqrhY4Tw5XNAbhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338806, "uuid": "abaaa117-f400-4a22-8dcd-090135547efc", "value": 213368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338806, "uuid": "e7439b0d-ad52-47c6-8484-7693a3e3840e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338806, "uuid": "7825dba6-3cd8-4281-ba54-654a992259c5", "value": "5P22020005-MEDUK1317768_CBL02.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32e6f1f-d1d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652345536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345536, "uuid": "b0fcb7a6-338d-4ba3-bd6d-6bd8f60b35ed", "comment": "Malware payload (AgentTesla)", "value": "62ae2974d01fd8439ec141a63fc423f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345536, "uuid": "0fc47b46-3649-4cec-beed-b67ce8a70103", "comment": "Malware payload (AgentTesla)", "value": "9c18f7c761ef5854d1b3dd4b3176db9def2bd4b324f15aeffe4e995a1c6d5d79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345536, "uuid": "8f213920-2cde-42d4-a550-40f5e94d5826", "comment": "Malware payload (AgentTesla)", "value": "bf5f6b6dec25c9d9be3d4dc125f6ce539c5c38e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345536, "uuid": "a3dd6335-acf2-44a2-9b65-080162c4095b", "comment": "Malware payload (AgentTesla)", "value": "681b84674caaf2e343703948f95905d3c574b936c969e97fe9bccf32fba229b11dd08088d8b8c7fcdbbb2ae26fac90ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345536, "uuid": "1580e841-cd1c-4e77-9115-d495af649797", "value": "T13AC41229B7638912C66E0A3ADCD520DC0371AF036C13EB1F5DD8329D4B767D60D94AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345536, "uuid": "901ef246-2f23-4e7a-b940-f1170df20a44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345536, "uuid": "25439ded-5abb-404a-8d90-537914501472", "value": "12288:08ehJcPEOGb9ZJK7OEl6S6gAu2ijACY2W9uc99ACif4:0dhu8f9ZJBS6bHu9jACY2mx99tif4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345536, "uuid": "8efb3c1a-fa74-490f-9fd8-884f26931ca4", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345536, "uuid": "4c302eb2-978b-473f-a250-3f7da226eb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345536, "uuid": "de80eb81-7fed-47a6-a549-9541adb0cad6", "value": "TELEX BI 14226INS00075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caec832-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652346170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346170, "uuid": "dd5c2bf6-12e4-4d7d-82f6-1fb3ce202837", "comment": "Malware payload (AsyncRAT)", "value": "f5193f4894f4550983f247f07582f409", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346170, "uuid": "c85a07e6-73f4-4c13-b669-1aa9a981c556", "comment": "Malware payload (AsyncRAT)", "value": "9c5a1e0ccdb8b2faa32799fd6c12a4c95d9e970db3fa9aacd590c6404cf08507", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346170, "uuid": "336e2949-4a6b-4479-bffc-292bcd085f18", "comment": "Malware payload (AsyncRAT)", "value": "721c1341c5c9907fa9ae37e3c628f4966a1fabe2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346170, "uuid": "d2ab9e0b-aeb0-4603-b5fc-54359d80849c", "comment": "Malware payload (AsyncRAT)", "value": "bcb2696c389fd04456b2354fb605b02adcba5063734d0e20586d87390326748857758d835a9ac3c8988f888297a4b4fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346170, "uuid": "3fa2a6fb-d193-4946-965f-ee30cdd89808", "value": "T14C231A003BE8812BF2BE4F78ADF26145857AF5A73603D6491CC441DB5623FC68A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346170, "uuid": "03efcac1-5826-45ea-b820-67124cf9d5e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346170, "uuid": "98930c6b-30a9-41e8-870f-07d64f6d639a", "value": "768:wu/JRToSkobbWUnWCimo2qB0/bPuPIxzjbsgX3iGvXkbsRTaUYCDBDZ6x:wu/JRT3T82VrXx3bjXSG8bsRTaB0d6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346170, "uuid": "2e9fb463-c8a8-4f09-8d45-427ccb0b6c1b", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346170, "uuid": "37ec8f39-466d-45a9-9dac-3dccbc62cc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346170, "uuid": "1458abb2-9b14-446f-bbc5-da81538c8df8", "value": "721c1341c5c9907fa9ae37e3c628f4966a1fabe2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d5c7fe-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652363606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363606, "uuid": "204bed17-b20d-4c76-a294-0b2874273883", "comment": "Malware payload (Growtopia)", "value": "59ba736c93938bfc25796b3ac85c0205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363606, "uuid": "fac53d58-50f5-4d5d-b0b6-3d31a2b9736d", "comment": "Malware payload (Growtopia)", "value": "9c63d45c58a8f4d08d59c52915554659a9cce397accdd016b3f1158f257fa5b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363606, "uuid": "97d8b0b6-83cf-4d4e-903f-b431490da628", "comment": "Malware payload (Growtopia)", "value": "63695bf37b389e368807814306cc6779cec0dced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363606, "uuid": "38a78993-594f-42b0-9816-2321a26df08b", "comment": "Malware payload (Growtopia)", "value": "2a0fdea5519c9fe33a635ae98281c8a57e1ad4cdb8f1fe8f64a201056fa3d59927ee125bfe277139d17fd3342076cb11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363606, "uuid": "52654346-2b60-46ae-8477-369f76cd3619", "value": "T117735C15B680D23BF8E901BF9DFA0568827CA9304B8E65F77588069EC9272E353353C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363606, "uuid": "82925ee1-3801-40de-950d-5f7d90e31830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363606, "uuid": "34bc8bf1-31c4-4d6f-9b33-0a17343c50ef", "value": "1536:jO7EyUZPaOklHIAWvL+csPmuM/FhuQTTD59n:jO7EOWvL+cseuM/FhuQTTD59n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363606, "uuid": "8854ca98-8f5f-4964-b754-530bc8d8a9c6", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363606, "uuid": "2f26ff68-f13a-442e-9bea-2f9d70f397fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363606, "uuid": "59efc206-ee36-4938-9a15-3dd53d817fcd", "value": "9c63d45c58a8f4d08d59c52915554659a9cce397accdd016b3f1158f257fa5b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e29a282-d229-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652383485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383485, "uuid": "260934d8-c9bb-44fb-91ba-31ce6aa489ac", "comment": "Malware payload (Formbook)", "value": "9c62175af4cb7d4581c22df0555e0c0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383485, "uuid": "88f14916-04d1-4851-986c-0ebdab4d6a7e", "comment": "Malware payload (Formbook)", "value": "9c7e2362b268b00fc075126a7e40318156cfbe5ef35fa9d7f28ed4e2bca9b35a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383485, "uuid": "786a66f1-0dc1-4864-baaf-653067e1dbdb", "comment": "Malware payload (Formbook)", "value": "19da1a381874d11d07870859927fa35320e37c37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383485, "uuid": "8e742f57-1c5e-4496-ae2a-c52a2463954d", "comment": "Malware payload (Formbook)", "value": "bf947932a10a98d1d3e55f6d307965f0856bf7571a3983e16181ea4a79e147e878d6de574979ecbfa985b9ff1dd345b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383485, "uuid": "9997aa51-0209-459c-9669-e2bdba4b5382", "value": "T15354132551A4E97BFAD226721D73FB57CDEECD3718E4414B17A03FA6358AA80A04D3E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383485, "uuid": "262df895-6682-4373-902e-4da092f28bb7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383485, "uuid": "a13b0488-fefa-4169-8394-237edc049f3d", "value": "6144:LOtIOYFxfrXnr1khF7A9Z6aVtGP9qp0FGyYH0b2xcgk2uDV:LOLYZWTaVtGE2FGy1bbgk2oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383485, "uuid": "195c0af9-31f6-413b-9083-2a241f72df0a", "value": 305583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383485, "uuid": "95e34942-f1bc-4b37-9cec-f4043c500004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383485, "uuid": "ad3b6de5-1254-48ff-9f93-5197cc2379a2", "value": "9c62175af4cb7d4581c22df0555e0c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e784a1-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652376671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376671, "uuid": "2a20b8d0-07b3-4a77-b138-375fc259334b", "comment": "Malware payload (Loki)", "value": "7353875d91c4bbbb970d0db80adfdae0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376671, "uuid": "59b0a620-da26-40eb-9222-c05cdc3ad771", "comment": "Malware payload (Loki)", "value": "9cd38d3a1228a8f86998add0c8afb26e9b5754a1d787831525208dfb1d0b173e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376671, "uuid": "894a0ddf-451b-4fa2-b4ef-e05d452f9510", "comment": "Malware payload (Loki)", "value": "f87bcbb79c6b05d58a066cff44d6ce2cda1d0848", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376671, "uuid": "4679fa94-5034-43e6-9a44-a1f9fbb57266", "comment": "Malware payload (Loki)", "value": "9d0444326543f2b26f4331c19d8b770b4485b9608a4a9ea907ed3ba1530c1d352deb8f5458e3e0d57a01ac8e7db6ebb0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376671, "uuid": "4dfa7b41-88da-494d-a9b2-5d8ff5283479", "value": "T14304022EFFA5424EE691B7F3086D0105B157CCF0ED7854AC2722366E47BBFC9046598A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376671, "uuid": "62ece818-4686-43c1-a61b-433023ec547a", "value": "3072:NTZhRlKiUOqinGpHiRhHsZPe+JBV2YCKYx/R5kk1KQEnbHW1sqtQYp78MdB:pR4NppahHsZJJBVLC/x/foQ7bQRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376671, "uuid": "c2e8be4a-a216-442e-ace9-4acad1c50830", "value": 187880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376671, "uuid": "15359e0d-a6db-4106-a303-476722ef8f75", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376671, "uuid": "280eecac-e665-4121-9ce3-083dc7afcbf8", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77109412-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652316605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "536d78dc-44ea-4e08-ba90-3862083d39a3", "comment": "Malware payload", "value": "fa3e981f7e83a7957cfd5abb1bec8208", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "84ec97a5-8b00-4d33-8a20-45381385e8a5", "comment": "Malware payload", "value": "9cde2bb1ef94269a7b9d7eaf9002e848f7b4bc636cf89fa10df1559514340769", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "8fe72bc9-757b-40fe-bb9e-55a40a8ea111", "comment": "Malware payload", "value": "f8d2b271e8c2bda695215e3e6b5faee643eb0f5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "f9bbe7e7-1e07-441d-a597-17d61d4cd7b2", "comment": "Malware payload", "value": "56fffcf6500c92bb0390b1e10bf4f0e28f42d9d9f028ec71b1d036df861ade47fb2bf4afad5d443117a40ca5f1d065a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "2e227fb7-ef94-4b47-bd16-4ef9b1156961", "value": "T1B5C2F75AFA416F01D4E4217AFF5F124933135B2CF3EB72025A215B25678BE6A0F7A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "e6b653b4-ff91-449f-a3e2-8be46c92e2d3", "value": "384:O9nOFEgSzIdeYUccHd2dm2tWl6ZxjiG063CVwgXx4ecwszG5xQIeEN:O9nOyg4Dt19amaWl6ZtiGj3CMTvye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316605, "uuid": "3fbfa66d-d39b-469d-a4c0-a65addca7ca1", "value": 25896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316605, "uuid": "fd4ece79-8795-42d5-ae11-245930f34855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "2c9d2c29-f342-4c8e-8895-cdbc794c77ec", "value": "Ugliest.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9054f4e0-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340270, "uuid": "e35054a4-5210-4e77-a8e0-f1e149e5dc82", "comment": "Malware payload (Formbook)", "value": "6c2c341a271b931b40be3b5f56025dfb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340270, "uuid": "ccaf67fc-eed9-40ac-9b86-179a5c6d63c1", "comment": "Malware payload (Formbook)", "value": "9cfab08135de6aa4d1635ad9e3aebc7bdf8063546c32c9d0f09efb59558ce3c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340270, "uuid": "feaa6ad5-8a07-4e28-a1c0-7229ee88136d", "comment": "Malware payload (Formbook)", "value": "96216e3f47784b1a8ed87fa9111fb26c77035150", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340270, "uuid": "6b447beb-6e42-44a1-986a-a8800ca1f1f4", "comment": "Malware payload (Formbook)", "value": "72d1f3554f6c73745002d48ad14e3d7f3cf63f0069e3a5933d54533d37b452acd0601601ecb017604d2338b13c1833a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340270, "uuid": "93c85157-26f2-40ad-8f37-e2a7e8436ba1", "value": "T12055F157E3D7FA71E6ED52BA86B1D63C176EB4A29069B74D7B405CCC29213038928F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340270, "uuid": "b23f1e24-902f-4a5c-8162-140d87333f6e", "value": "7e569b564dba0b34119990efd3d9dfc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340270, "uuid": "b2167af8-c424-4921-9787-a8efa0ba3efc", "value": "24576:QnnncnKW2MGX1NXwsc1fN/0q0QnbhlEMFN/iNo8+y6Kaqm:nKW/9jAUb7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340270, "uuid": "b68485b0-6e85-45f7-8e84-8ea4f72d0723", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340270, "uuid": "38460d76-fe23-41ca-9f54-7f1136c8c929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340270, "uuid": "b72f8582-f927-4740-b870-fa2e4190a6bd", "value": "scan1021291.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9ae843-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652379398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379398, "uuid": "84995d9d-994a-4580-b2f5-dc7ba2e8302b", "comment": "Malware payload (AgentTesla)", "value": "abee2932147a319a92c7d1e9a577976e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379398, "uuid": "eca53fab-7d90-4f0a-9fe4-7671a826d904", "comment": "Malware payload (AgentTesla)", "value": "9d326c69c914b8422728cfba32a8995cb598d0a6c5c1f901c6847f21ad92b345", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379398, "uuid": "51af9bd3-8cec-4d9a-9fc1-3ab7c00c9351", "comment": "Malware payload (AgentTesla)", "value": "1565c0c2888d6ae2d98694016415e31c4b86a85d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379398, "uuid": "457686ae-2a0f-498c-9d01-862e8133820a", "comment": "Malware payload (AgentTesla)", "value": "a25306ca9793cd3c60ab74270a0526ab0a7b87cb3c239c0acbf3513547674903d077cc885d210950edd0e5e46e167ba7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379398, "uuid": "f3829cd6-1e52-4148-adb7-5f7907497b56", "value": "T1740412A9313C1E3DD4EB4B772B9696F05DD7FD1EC815A86BA840B2074D347308A84B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379398, "uuid": "0c62645a-3b5c-46ed-bae4-f6a83b906821", "value": "3072:wetmPi/bUQ8NXnfipWMiWCJaczo0+MoOCbP/J7FR3sJPnlAiLL6YIJ7x7AuL1WnU:+Pi/qXnfbEizRCrJ7rGPnlAWLQjUuROU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379398, "uuid": "f8c6efa2-8ddf-4229-af7a-0965b5668846", "value": 187896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379398, "uuid": "6ac12ebc-37a7-445f-8508-d8b4e9750261", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379398, "uuid": "b6469d60-fa45-480f-966b-bad45924cb19", "value": "Lawsuit-120522.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fabbad1-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652363865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363865, "uuid": "d7fad47d-742b-4f41-8f61-b136c420c849", "comment": "Malware payload (AgentTesla)", "value": "2263d7568f11aafd1e86650b78325f00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363865, "uuid": "d52e92cc-eeff-4edd-98c6-29c35e8c502f", "comment": "Malware payload (AgentTesla)", "value": "9d4fd669443f94fcb822ba1b591a514bf2490bca9ec5caca17691e2d6a54d482", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363865, "uuid": "a846c8cc-3c59-4bce-9d14-dd62d6a177a4", "comment": "Malware payload (AgentTesla)", "value": "63144fed9b92c6c34a1ba190958fa7018b678280", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363865, "uuid": "e1ad916a-3685-4d92-9e6d-8d44c482933e", "comment": "Malware payload (AgentTesla)", "value": "0e6905818f050ec489e469be65e5158567b8afb4862c7dbd55cef2a04a2959fb4dfb1f87ada5610153789ccf9b7c69ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363865, "uuid": "c82fccce-f047-4829-a3da-6a48b5e06e93", "value": "T168C41225333B5822D2AA4FB6CCE050DC5371AE075E17C35B1EA9B28D6B73B930C9165B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363865, "uuid": "62f6aff2-fde2-45aa-9f98-f67c2b09a348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363865, "uuid": "d05837f5-a06e-49df-8960-304441cfb6a2", "value": "12288:kji3EOSpoXQ+wNCB7byW0RDj8KIIxirQdj1Kyowz:kG0fp/+wMyW0RDjeRCj1Kyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363865, "uuid": "50f681de-9a29-45d6-91be-400ddadace5d", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363865, "uuid": "39439025-c4de-4a37-b345-472e66db7f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363865, "uuid": "750dfb8e-b7dd-4c60-97f2-5842e2f81742", "value": "tt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e230f3-d207-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652369036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369036, "uuid": "8ea9503f-d3fc-45ea-8d2d-5c1cbb18d51f", "comment": "Malware payload (BumbleBee)", "value": "48159b3278ba137f95118311d2213046", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369036, "uuid": "5ff61327-163c-45ce-962b-0aaf2b396a42", "comment": "Malware payload (BumbleBee)", "value": "9d5e19732f393fcceb6f348b91eeb997f79b9b13270b90ad728acfc59a21e71b", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369036, "uuid": "1af2e090-07fc-47cc-90ac-aa422deb5a0c", "comment": "Malware payload (BumbleBee)", "value": "65730bcfd338a397393acb3d1a1f4406809d055a", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369036, "uuid": "54bec3ac-ab2a-4e07-9516-9994fa694662", "comment": "Malware payload (BumbleBee)", "value": "c21f59acd371f0d92df3d904bbc1daab261bed1298910509ba6280f496fd6308a7753abe5d6c205a275902a76569c046", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369036, "uuid": "ca09dfd5-32d6-4b94-acd2-0080659efd46", "value": "T19DE5DFDA034A19EADFD0FD7A8528F0F5B31FBCC3FA2943E760A9145491955BA00A3F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369036, "uuid": "ce1d02c2-d854-431c-9ba6-cb510e19d073", "value": "85ef6b5bc2d2a3df0e624157cc2965bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369036, "uuid": "77c329bf-0347-45ab-9392-82b28c4209ae", "value": "49152:HVCZDqmPDDUKeIRU75hbDvToQAScUTdpa68ArspzO+A2nSF0Az0Zr8PVyDi7+qOf:HVjTZxRdz8AgLGeZrI0U3O21yNHlc0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652369036, "uuid": "76145d42-9a8b-4f7d-a3d7-29b9ba1d2319", "value": 3277312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652369036, "uuid": "23f0169e-55c9-4bdf-a6d7-7d3a10ba1f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369036, "uuid": "f966728a-6daf-4f09-a636-11bab0e90f0e", "value": "swarow.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7413efa2-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652363845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363845, "uuid": "14f325d7-6cc8-4ffc-be59-39a620465f8d", "comment": "Malware payload (Formbook)", "value": "fce6dd8f513958cf623206343ca4be7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363845, "uuid": "5e78da2e-44fc-4c29-93d6-848db40cfcd4", "comment": "Malware payload (Formbook)", "value": "9de258bf9f425b639017ec192ec327e7d507844e10ec1759397169b86a21ea9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363845, "uuid": "0c4e3c4f-dc25-4f44-9e85-bff49878347d", "comment": "Malware payload (Formbook)", "value": "3494ff1268438577b848a4da46244ee17f1a72d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363845, "uuid": "dbaae162-9b49-4cf9-8c43-14d1793fde71", "comment": "Malware payload (Formbook)", "value": "7eb897581a83a8a1c53fa3fa3204c2f4ddc1368788295e3922229297b414423b2820ef35dcf3418f14900b047186b288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363845, "uuid": "12c0528e-5e6a-47c8-8585-8dcf811f177a", "value": "T192541270B2E1DB73EE6129369C272BE649B4F17810F2464B13586A59BC71B40B71FB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363845, "uuid": "ed27b691-e11c-4ddf-9ad7-ee84d0ae176c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363845, "uuid": "cee91a8a-d107-487d-9349-6ed46c9513d7", "value": "6144:LOtIO3NSmV2tIZGm8QSbvpmA0LFDsUyqzZdG/z9:LOL3pUQ6pxksU5S/z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363845, "uuid": "1da22e5b-78e0-402e-8b01-59aad7a3dd74", "value": 290506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363845, "uuid": "cf675ba4-a938-4b4d-86f8-4bc2bd43738d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363845, "uuid": "018063ed-8bc3-4b37-ae3e-9f6985fb7325", "value": "SecuriteInfo.com.Variant.Jaik.72878.8629.23772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc12be5-d1c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652339754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339754, "uuid": "50942fb0-a4ae-4596-84de-63c9bbee4035", "comment": "Malware payload (AgentTesla)", "value": "f658270471326ef9d51a7ce5e5fc11f8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339754, "uuid": "4f8509be-2756-4295-8cc6-4f38bd334b5d", "comment": "Malware payload (AgentTesla)", "value": "9de3b7be2c47fbbcc02cf4a1c7a1cb7eb871ea79db41855d005c088d40f41488", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339754, "uuid": "a8ce0eca-0181-44a2-8d32-60bc66bd7369", "comment": "Malware payload (AgentTesla)", "value": "318fa5ff23797f7f0567205a293fc9ca6681e975", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652339754, "uuid": "fdf50791-d74d-4d08-bf1a-9730abe5597e", "comment": "Malware payload (AgentTesla)", "value": "b33e136195c8298ce7ef317fe7e864afbded5d935872a3bfbfa4571ad2de781eea0b9cb67ec2b305aa9402a8ede34c43", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339754, "uuid": "8a6a162a-45c0-45ef-afba-96cee94b7cb1", "value": "T1CEB42303C9E53F48937A4256BEB79ECD4221C509A3BD1F697947DAD8D1F10A2C92B0EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339754, "uuid": "87992082-d520-4ea5-be45-c46da4e37647", "value": "12288:HpfmjnuWTG0e2mJLU19Idi/1QQaFrj+W7hyO5bb+FdsIq:HcjnrTh9DHt8rOWbbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652339754, "uuid": "5fbc7e84-8fac-4bfd-bcba-9eefd0c24ff4", "value": 539575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652339754, "uuid": "e4ce5743-78f3-4300-a595-3bc752d9b36c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652339754, "uuid": "e986a347-85a3-4bd8-9dcb-c16b7c84b460", "value": "TNT AWB.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4095194-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338693, "uuid": "e8f114a4-c1a2-44bb-ba3e-8fd94e917d66", "comment": "Malware payload (Loki)", "value": "1562f32e56903e2dc5422facd166df9d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338693, "uuid": "26382330-ce81-4cd5-a7e5-afea3626a33b", "comment": "Malware payload (Loki)", "value": "9f29bfc0d4689ff7a095359e16a48843143533bfe85e83acc084cb4d8f600e9c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338693, "uuid": "af00f6ac-d1df-42dc-a8a5-9b955d4a8cde", "comment": "Malware payload (Loki)", "value": "4f245257ecbc67baf85bbb73a0280165084339b3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338693, "uuid": "449fb38a-adb3-4c46-9572-e5368d793fe5", "comment": "Malware payload (Loki)", "value": "b8409c21abceee53c34d378da1936efcbc9fd36d55cd22e7ffe9f3590ccba54a33bab5f6b4784ca7a2bd21704a46edd8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338693, "uuid": "4b6d5715-2a34-4959-8a0e-a4074282f12f", "value": "T1E904020FFE7B9D52D14337FDD29382E165C79D2298B41EBAA5BA73F89230CE08526051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338693, "uuid": "c5db4bea-910a-45d0-9f89-4145d793d108", "value": "3072:BjnEPNtBq6E7nvH2rqdzZepL2ATqK9kWpPgZ17ly1x9DrtMfj1LznhNVXJwcyMiQ:piNbWvH2+dteDqM1C7l8bDrtKvhHJwmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338693, "uuid": "189635ac-2b4a-45a2-b67b-34f364f7303e", "value": 188520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338693, "uuid": "8018c8a5-e994-4b35-96df-07a4e1b96688", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338693, "uuid": "952766e9-89f8-4682-9825-16a2f9fe9f5d", "value": "DRAFT SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1d86bc-d1de-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652351319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351319, "uuid": "3056e8e2-f29c-41dd-adcd-3e3a29b3a1f4", "comment": "Malware payload (AgentTesla)", "value": "18b90d0466378a9bb0996bdafcfac912", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351319, "uuid": "76823b10-24ee-4d8b-a9fa-a9edcdefbc9b", "comment": "Malware payload (AgentTesla)", "value": "9f398d5f51de970e0f6916a985e9e9cf233e5c3afb25a4d5a20f6abd03ddca2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351319, "uuid": "30ba872a-deaa-4014-95d1-39b84df64b96", "comment": "Malware payload (AgentTesla)", "value": "7f1e8b589f6d9ded833c95cbdc7115335a1e9a1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351319, "uuid": "22c508cd-4dea-4e0b-94f1-725a3a54b328", "comment": "Malware payload (AgentTesla)", "value": "7c097284f01333f7415954a733dece6f8dc6c18760e75e6c5f18039bda465c27d8335881ec34df0b2307fee8f6b202b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351319, "uuid": "4d08052c-682b-4555-bc02-5654bd6ca13f", "value": "T1B2C4126AB173E926C26717BACCD001CC1370EF069C13D65B6AE632894B73BD61A8175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351319, "uuid": "1ddb44f1-ec1e-4324-9287-fa19fe8a5f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351319, "uuid": "a7035771-9181-429e-a416-f704787e069e", "value": "12288:PqBoXYOB0w5kkl2gxWP0cn2cHu5DX6Wq1e9L5QZ/Kl17e:PTIDkVxA0McX6t1uaSlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652351319, "uuid": "7f2cdfe5-ae4d-4e0f-8a6d-7bdf7d1c63cc", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652351319, "uuid": "085ad4e2-ef51-454f-aa81-a0b46ab2108e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351319, "uuid": "2ea3d18f-5a9f-4b0f-80a5-ca01cf6771df", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f595c2-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379575, "uuid": "5933670e-54fb-4b02-911a-db71ed5b5471", "comment": "Malware payload", "value": "293915a95af3ece0186123cdc75e40aa", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379575, "uuid": "1abbd900-fdd5-4bd3-9e28-35cf729778b9", "comment": "Malware payload", "value": "9fb054922bae5c278be843000d51a14ff51d736394a2500491f9d146de5f9f6a", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379575, "uuid": "44caee92-59c4-4fef-8f7c-b4a19e9151a6", "comment": "Malware payload", "value": "a28a75a6ac8267c4e2634af8c79a649298b45630", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379575, "uuid": "f8c1239e-552f-402a-bc7c-38dea21ab2f0", "comment": "Malware payload", "value": "1d3e4813b7d34217da554d9d5cbf5e039461e1a058ec7568ae58e4351fadbd39aab402862015c215d12d45cc7d4f9036", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379575, "uuid": "0e97a30e-425a-4e25-94ed-e8de77d17534", "value": "T1C455F157E7D7FA71E6ED52BA86B1DA3C176E74A29069B74D7B404CCC29213038928F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379575, "uuid": "3081c4fc-650d-415f-b476-bd050f4a6578", "value": "7e569b564dba0b34119990efd3d9dfc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379575, "uuid": "5ccfd655-ac7e-4aa9-a34e-d429f6cf423d", "value": "24576:GnnncnKW2MGX1WXDezefN/0q0QnbhlEMFN/iNo8+S6Kaqm:VKWpKGAUb7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379575, "uuid": "0acd55b9-8d10-4edd-8adf-45cc446f1c4e", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379575, "uuid": "3dc9fcb1-47bb-4eda-8f77-84aad803d2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379575, "uuid": "d51f5ea9-c595-4e2f-8dd5-4262758c6a87", "value": "PO_1895122.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b5f710-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652316607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316607, "uuid": "b95d0f10-0da8-46e0-a486-47ea98c88120", "comment": "Malware payload", "value": "b3e5905a1a8a881a7e318b2aa989ddfa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316607, "uuid": "47247a0b-1ca2-421e-8294-a66e3e772905", "comment": "Malware payload", "value": "a08057ffaa81b709a0d614a9f4cf403d58b3284341a3a38eec22d0dc3e9b6d6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316607, "uuid": "60808a0f-a1a5-4395-9514-0ec362f27070", "comment": "Malware payload", "value": "80a47a5e9af2fd7b19e7135a663322572fa55849", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316607, "uuid": "d7168ce2-52e3-408b-9c81-feec63b4e585", "comment": "Malware payload", "value": "099b8d4f50e42365abcc0e5dd1587751d99a56ea99cd44da37f7411681b2b4082410f72f2f2b106a5526af54d8b5d50a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316607, "uuid": "7ae9ca7f-3cd5-43fb-9217-c000f8f635cf", "value": "T164522F852E229FEDF629C63887B34A306358239562E19B84EB6DD8040FB030D559F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316607, "uuid": "694b7f5c-b35d-4b44-81b5-bc152500a423", "value": "192:pM0BpkglxE0apjQXBDNGV7DOij8saD/QSOR49rIzI0u85RgAxdDsqN1tAS:VpkglG5pkXRN6OEnffmAxdDsqN1uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316607, "uuid": "a525cd86-97b2-4850-b1a5-e35aa7cfd006", "value": 14408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316607, "uuid": "279afde0-4050-4bce-8f7a-518cf8e5b247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316607, "uuid": "a957543d-b18c-4084-bb10-0c6ffb819d3f", "value": "Ugliest.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f141ec2-d216-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652375433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652375433, "uuid": "bf21c3e4-881a-4e81-8058-e75e8124fd38", "comment": "Malware payload (Mirai)", "value": "098c842ff0e82921cc8b546691e02cc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652375433, "uuid": "644910c9-d0d8-4fb6-addb-95dc231e25cd", "comment": "Malware payload (Mirai)", "value": "a0d92594f104fc0f8bd96aebebfd8908e62659362d4866fc3469fd79d872f7bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652375433, "uuid": "e0bbf2b6-0cdf-4c43-8712-f9fc9054783a", "comment": "Malware payload (Mirai)", "value": "7b8b69bef1af6d8e7499c47dd6475b014692aa53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652375433, "uuid": "a44a0830-809c-43b8-a392-db20ba771bd6", "comment": "Malware payload (Mirai)", "value": "12c6172f1e0fbf13d99f1ce5870a0a89226f044b244f94fcff48f651ccb3fa16fa71871814ccfd0d8c20eee182f7ea11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652375433, "uuid": "91df6a83-0ed9-4f52-9a31-45c85502236e", "value": "T153531925BD751A26C0D4A17A21FB8B05F6F6138E22B4851E3DB20E9EFF507406513BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652375433, "uuid": "dc439f81-0ef0-443d-9830-587b05158116", "value": "768:1Rotfc3BbKf35UIm9N6xN+406Wsh5ir1dnQdENSvIwBO+2x741ll:1RmfcRbKf35UtyxNq6vhYRSxyqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652375433, "uuid": "3e9107f8-a6c0-48ed-b285-99f0c54f58b2", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652375433, "uuid": "31b81f5a-dec9-4c16-b7ec-9f13c9e82dbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652375433, "uuid": "a6a0723c-0180-4fb4-908b-4e886da09968", "value": "098c842ff0e82921cc8b546691e02cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d9ddff-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346103, "uuid": "56ca4da6-aede-46d7-9ac7-1e603fd4afd4", "comment": "Malware payload (Heodo)", "value": "fbf17de17b36d4256ee546ecbc415123", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346103, "uuid": "87d9d696-3a29-47cd-b033-6ae59e230c01", "comment": "Malware payload (Heodo)", "value": "a0ee4277ddebcb6d26722d95e2120a98520ebebb867c022493ce96a7ca71b0e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346103, "uuid": "8490915d-d3ba-4ec7-abe5-a3371770d105", "comment": "Malware payload (Heodo)", "value": "3c72f8b9957386f55f46bd20c51493e1a11fb83a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346103, "uuid": "a3bf8967-dc08-49bb-a9a6-6c202a8594e6", "comment": "Malware payload (Heodo)", "value": "d5da9e5f689f9575dafc5b789626730bb7716228f7ef2dfc9dae083be9478bc2e78562def96142bf4059434148d49405", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346103, "uuid": "cbd5208a-9c63-413d-ae63-8925fdad3e4b", "value": "T1D6F47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346103, "uuid": "066d020c-b683-4e64-9396-f455b082062b", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346103, "uuid": "3a73442c-6f9f-4899-9e63-b2fafae65f46", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSEjNwgraKRT61cKGNx:S4DzZKnH4dRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346103, "uuid": "f741f09f-af55-4e6c-b9cc-ee642e37065a", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346103, "uuid": "9c54c0d3-c80d-4038-96fe-b66f46b13fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346103, "uuid": "88cb0f36-560d-423a-83a5-d0263d06b15d", "value": "fbf17de17b36d4256ee546ecbc415123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4383e5a4-d229-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652383520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383520, "uuid": "b1b9ae13-9ae0-4403-ae63-aa134282b296", "comment": "Malware payload (Loki)", "value": "7d230009eab36798f73226c3adc7ac8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383520, "uuid": "7c4cbe94-842c-48fa-8de2-44ffe77807cb", "comment": "Malware payload (Loki)", "value": "a1b424af1a1f0c7b572adb406b39914beca20139fb88b6e3b8161ed591cb78c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383520, "uuid": "b38a52f7-4238-47e1-9c9c-f6e432be8ddb", "comment": "Malware payload (Loki)", "value": "fb28cf281513100854474137becbece52f8964cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383520, "uuid": "7b7d8d4f-c666-43b5-a46c-b3aec84f5419", "comment": "Malware payload (Loki)", "value": "e9af10aa8d303c89cf7cdc9b8ab23081d896bd00413e5f909c0268cec509b3180bd6fb9a951f753547028f0a562b7688", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383520, "uuid": "69ac0e12-fdf4-4544-b710-63ff929965cb", "value": "T1A524120027E4D963E9F365311E6AA32747EFEA1224755DA743406A0A7EE73D0931FF82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383520, "uuid": "34b2334c-d03f-4719-a0ae-a2c442a8726b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383520, "uuid": "27738503-c431-42d5-99fe-ea59ff1b62b1", "value": "6144:LOtIOc0TfiH3QVpZZMRUPauFkFRGbD/vw:LOLcMIyZZpauiG/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383520, "uuid": "eeec8673-147f-418f-a566-2f22211eea3b", "value": 213252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383520, "uuid": "9dc04f38-5681-4a64-8118-25d4c05fd057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383520, "uuid": "a2386f07-0288-40e9-bd3f-6113e5e53df7", "value": "7d230009eab36798f73226c3adc7ac8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611de935-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652355653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355653, "uuid": "e3aa42d5-08c9-414a-8461-8619402e49d6", "comment": "Malware payload", "value": "02a1ac6322c86ba8dc409bcb4518b158", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355653, "uuid": "09e30e71-517c-4878-8d24-266ec3f81081", "comment": "Malware payload", "value": "a30ae88d73d2b3132fca5104d2eb98ef9336df93807ba6311d26390edcbd4c2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355653, "uuid": "f90f43ad-9845-483b-96a0-dcb6553409cb", "comment": "Malware payload", "value": "c9162be873699e2ffe4c9463b48c239038a6cc7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355653, "uuid": "557759bb-ebb0-4107-abdf-f188f2c40cbe", "comment": "Malware payload", "value": "e647b7fddae96bb0fe68646cd583db62689425eef88a330fcfb1cd2e44c7c231eb847f72886457c14346256a0dd74ad3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355653, "uuid": "aff4d43e-efbf-4bb7-9b0a-eba3938f21be", "value": "T1AB13F2B48B43CE70F5B29A3DC57FCACDB3911970D82AAE3817074A5194F788B456E315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355653, "uuid": "81f7cac8-a976-48b6-8cf9-be1c4916abe0", "value": "768:jg3Di8bRUrIh9+Fj7RhVWV1+WktZI2PFW8qRjhVcms5vwS58dFYOjZq3U7wx:jg3jb+JFVWDIPE8qRjbcJoMsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355653, "uuid": "f2e5805f-b1bd-4fe0-a01f-32dcf186358d", "value": 42344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355653, "uuid": "30bd19d2-eb75-4f58-9a53-8ebaea34ea06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355653, "uuid": "b4c1ea45-6642-4eec-8d7f-fd68b135e6a1", "value": "02a1ac6322c86ba8dc409bcb4518b158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997c3035-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652349305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349305, "uuid": "5822df42-bc4f-4904-92c0-6f43be4ba9ba", "comment": "Malware payload (Mirai)", "value": "1121cf25dabb58f629fbf0b5aa34191d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349305, "uuid": "124000ee-9746-46be-98c4-5f322d0079ad", "comment": "Malware payload (Mirai)", "value": "a448320e4478a0de611cc76dace890decb5188db498af010d8d983b089031358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349305, "uuid": "a34bb81d-290b-445c-a10d-a3a757496bbc", "comment": "Malware payload (Mirai)", "value": "4b5462d3aa9e76748f8845dfa867c7ca33bf7a76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349305, "uuid": "99069211-7bde-4693-9539-9dac77a2ede4", "comment": "Malware payload (Mirai)", "value": "6c064274a3f93b9d938ac4d880527f31969718e2c4c028371f2e018d17f188a51741c06f1c7ee14289b620f469afa72e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349305, "uuid": "6903a1dc-6a0a-443c-a815-fa30e3bbcfe3", "value": "T132735B26AC3A2A27C0D4B57B12F78764B2F2578E35A4CA1E7D320F4EFF1464015276B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349305, "uuid": "a39d8fc8-5207-4526-bb0b-786996b75700", "value": "1536:G7ZAZASPjoJx8MmTvdDEPDsJOtzOF0+dC:PVbo4BdOwFLdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349305, "uuid": "bfd9cfd3-f24d-4393-9986-191540694045", "value": 74988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349305, "uuid": "6433a0c2-31fd-491e-9c92-105590cf01b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349305, "uuid": "6257c72b-7fab-421c-a19f-29a5943849d1", "value": "1121cf25dabb58f629fbf0b5aa34191d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b88dd2-d209-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652369879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369879, "uuid": "8dc34398-62b3-49d8-b690-8e92bb777d28", "comment": "Malware payload (Formbook)", "value": "8b2643f1a35840f715ec60803bb092b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369879, "uuid": "99a68882-b846-4a23-8ce5-7242aee27ef5", "comment": "Malware payload (Formbook)", "value": "a4664cb9cac5a5971589137c3e37e0eeebaf0ce920081c5150d3429d6affb55b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369879, "uuid": "705b5b5a-858e-409e-a1d7-4f0bcd544a9b", "comment": "Malware payload (Formbook)", "value": "eebd56e76fffdaee180e1c56458e48b1b9ae1694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652369879, "uuid": "372e0362-5d19-4e7c-91f8-359c7ae7cf24", "comment": "Malware payload (Formbook)", "value": "d6ac8533627ba10f65d601d7132e88c0e4f06ce45878c5238483580d3934b19d1b32ef57ed0b16f5092aeebbf958a0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369879, "uuid": "20adeaec-9a68-438d-952b-22442efdec14", "value": "T161C41211735B5922C0AC1737CD9260DD13B5AF11CD23EB6B8CA932AD66773D289D062B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369879, "uuid": "84353f38-1bd6-4705-97bc-6bb4502dabfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369879, "uuid": "57209682-c01a-4513-b947-7263b71b09c4", "value": "12288:2ZvNNUO47wBcDfRbcsqJVuzq5zMxNkdmWZNyL5d0XACOXh:2/m17wBosuzq14WZ4LiAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652369879, "uuid": "7d03f71e-bd56-4fae-aa27-3fffd9f41bfc", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652369879, "uuid": "06ba641b-0a12-4d68-a1e6-4ff6e1781165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652369879, "uuid": "85ecdadf-ff5f-4f14-baf8-8ab0d9aaac5c", "value": "Reference Note PJS-4010036-Ref 18976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1285c7-d1f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652362817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362817, "uuid": "4785b951-50d0-4f6d-a37c-3c0512909c20", "comment": "Malware payload (YellowCockatoo)", "value": "28653077f7ce5e49082a8e3d14e53fe3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362817, "uuid": "d350983f-bf7a-4036-bea6-fc90b4243436", "comment": "Malware payload (YellowCockatoo)", "value": "a4d3d4711e61595024f69fd434f4fa70250b0f4909600227add74f25b25b93ea", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362817, "uuid": "91e09ad3-d01f-4e4e-96ce-3bc3287bad82", "comment": "Malware payload (YellowCockatoo)", "value": "2559dd639f7d391dc6f6a5861ca8b86dfb8dce5c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362817, "uuid": "d7416023-e02e-48d6-b3e6-fdf5d9fc8a47", "comment": "Malware payload (YellowCockatoo)", "value": "cd5695d0c4bc5aac58e04bdfe369ac153acc02d1feaae4242bf815477c3d49b016e70b49a8fd6cbd9830b898a6f7c012", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362817, "uuid": "be7dfd55-5e07-4305-9930-ab09aafa6527", "value": "T1C9463320222B5FC4444AFC9C652FC71A7B553BF1FB30166ED3E8431728486BC629D6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362817, "uuid": "0841b2d8-3bad-440b-a662-ba1945e3981a", "value": "98304:dOrkp5zLzeUzQF/r/4QWxgX8BsZ8aLGTHEbuQD/EaRBiQkxDW0bsUDK4s45QJ4K8:dOILXz8lrwlxgXcSnLGT+jn+QwDj+/Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362817, "uuid": "fc0601f8-a868-4a22-8ba3-c398a8226996", "value": 5609770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362817, "uuid": "2f27a603-2bac-4a2b-9d88-747d7af4e999", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362817, "uuid": "0db21650-12ff-4876-ae39-d09762e795e1", "value": "A-Warrant-To-Satisfy-Judgment.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41490da4-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652399408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399408, "uuid": "8f554030-6aa3-4d2e-9d56-f306c39290dc", "comment": "Malware payload (Mirai)", "value": "fb6a5a86bdb8e3556c620a08a5c3261d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399408, "uuid": "37027de4-ad09-4f67-ad27-28dfc7a3cf1d", "comment": "Malware payload (Mirai)", "value": "a53b5c2836df89e0f017ab472167e1a68f50c925ceeeca87ed35d1acba31f2f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399408, "uuid": "7cc27ec5-3340-487f-8182-dd9b336a2615", "comment": "Malware payload (Mirai)", "value": "3f6574f76902cf8e003384ec3214d9809ddb2876", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399408, "uuid": "68e5fd6e-92a6-435a-8e29-0afbf1b7e96d", "comment": "Malware payload (Mirai)", "value": "5c9118d9f698ebb2ef68116d6601620eb4795048416efc0d4fec0ba0d36570b1a2d3cd455fbdd4b1a77670aa5a1e0e09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399408, "uuid": "07c7c562-b5ed-416e-9dcc-3990be96b388", "value": "T1E5734BC0E593E8F6EC124978202BAB729A37F53A5539EE97E7D8A9339C11701D60335C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399408, "uuid": "d2fe7306-08ab-4d44-a517-a5e355e17c6d", "value": "1536:zPi7Vqf2F5GVY0QGFIxvbt1yCTih+zSoLNZ/R4woIGBKcSj9POMMb:bi7V62FcC5GFIxTt1yCehkSQ/KwV+KjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399408, "uuid": "2a2b3576-5cdb-4579-87e1-9a2bdb63a63e", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399408, "uuid": "8f5b3e54-3ede-43d7-ab80-0949812c8912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399408, "uuid": "7ed60818-e231-4828-8578-5eb00253c013", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb5af84-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652338788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338788, "uuid": "08efc6b0-0e04-4bab-b9fe-d6c9aadef0f8", "comment": "Malware payload (GuLoader)", "value": "1db66b406376f18434e1c02cbcf5c5e5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338788, "uuid": "46973b82-ebcf-4cdf-8fc7-5d12e66d2a2e", "comment": "Malware payload (GuLoader)", "value": "a561efadb6bab1e3d4f5b0cdefaecc0c4afb382bfe3bde81e1dad0aefc76695c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338788, "uuid": "ba93743e-a77b-41e1-b54f-ff3899654653", "comment": "Malware payload (GuLoader)", "value": "35741ca39d0d76a00fac1eaa720101d7bfd82cc5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338788, "uuid": "dc99ba23-fc5a-42dc-a6f8-11952b67411c", "comment": "Malware payload (GuLoader)", "value": "d2f422bbcdc07b8c1277935debb43421edae46f443a10ec9eda90ea0a71a09d84671fe34e16f50480ccc15a062da63f8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338788, "uuid": "f8cd1f15-a682-4985-a823-3d6115816eb7", "value": "T1E5040206BF29E682F0B551305E329F279A24FC13486CD9D81FB9FF942CB1495AA2D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338788, "uuid": "a5373002-ff21-4da3-9183-e0cc49696d99", "value": "3072:TkPr1dg3M2he5DZQVVbexBYKeO7OwRa7lpe54UYE2QQh22tolXoubT7:pMH5GVVbUY77XQ4PE21VWn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338788, "uuid": "2195ea9a-0d3c-4b58-8770-22089fd0c25c", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338788, "uuid": "4358444f-8aa0-4c81-b1c9-223d1c9504ca", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338788, "uuid": "0525fa66-9082-4e18-bd43-1ca44ce006bf", "value": "TransportLabel_6170453602.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f185bc1-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652338362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338362, "uuid": "03c353ea-a96c-4993-bb79-8518d7a55d35", "comment": "Malware payload (RemcosRAT)", "value": "d69ed47dd254fc8a6f7bc2523f6261b4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338362, "uuid": "3abe16d2-7f03-4ddd-ac2c-99052cbf76a4", "comment": "Malware payload (RemcosRAT)", "value": "a5993dd89586c0e0607c539454007bad0ac789e6e6ce7e2ec580c0c42dfca38b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338362, "uuid": "af2925c7-097a-4b03-b67e-48e45fc42adf", "comment": "Malware payload (RemcosRAT)", "value": "cad4beb82571e79c25b603e26d0a4cc93e7b0e53", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338362, "uuid": "cbe4dce0-b1d3-44d7-a151-54e1c64ba91d", "comment": "Malware payload (RemcosRAT)", "value": "1a0416cc5e32e59db0f0642e9c43ca7e658b1332930ed5dfab128410eba7c1badcb5b607aba324689a52cae6fc2900b4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338362, "uuid": "6aa62937-28dd-4a7f-8619-9ad1fca457a1", "value": "T1870370A6B2C2D80AD955033A4CE7C7E6372AFC519F67834B3288F71E1F716808A03657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338362, "uuid": "6d2cd837-0449-4a8b-ab23-46b853ca9ece", "value": "768:Imk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJArRX1fV:dk3hOdsylKlgxopeiBNhZFGzE+cL2kd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338362, "uuid": "2ea25cd8-e171-4d3f-b49b-139a53862249", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338362, "uuid": "537737d5-a56d-4b82-9ecd-a53721f9640c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338362, "uuid": "d7569e3d-98e5-41e1-b155-48310bb3b2c5", "value": "Remittance Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a11230-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338702, "uuid": "9b59eebd-8129-4577-805a-5cf847544559", "comment": "Malware payload", "value": "f47404b6c3362f2ac1f984a5dd3e1de2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338702, "uuid": "5c7f4d9a-6c54-43c6-877f-d6898f3ae1eb", "comment": "Malware payload", "value": "a5dafe7252b4924c17aee18ef176a2f4b78ce57d52ba5031537794d5f1f34000", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338702, "uuid": "8bad6aab-e9e5-46f3-b9d3-a356618143ce", "comment": "Malware payload", "value": "e82f857e1d8794d5ca537208a552d66ab3b0b7ba", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338702, "uuid": "620614b6-0cbd-4ffa-8a00-64246d0f2383", "comment": "Malware payload", "value": "aae19af37b21b244a3b32f336c9f8e91e29298ef109214cf005d3cbc067209dac043103ea4bd3b7cd435d086c2b2cd7d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338702, "uuid": "cca9bcb8-db3d-41a3-9b2e-c735cc9d70d1", "value": "T10492F48032E7F2C7F0A77375E49C84F0D7626E21EF3A15C962EA3A0D26F091D2719659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338702, "uuid": "0d0dd6d8-446b-42c9-b42f-46f41c69c671", "value": "384:niNBsBgisI05O3iii8EiTAvuK3GZTIbkE7It5JtZcfIZb+T6z:ngF5O3iCvAvFhg1bJ3ZJ+T6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338702, "uuid": "0b2ce72f-abca-4bec-9411-149195a35631", "value": 21128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338702, "uuid": "48299f1e-a492-4515-bb95-225839d9fece", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338702, "uuid": "9c6401ca-1338-4068-8d07-3a4c95b72667", "value": "PRE-ALERT #GLSEALX0434.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0d5ece-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317907, "uuid": "39484e90-b3c3-4339-af0a-2fbe0c1726b7", "comment": "Malware payload (Mirai)", "value": "3476ada9e20f015c82db2c2bc319490b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317907, "uuid": "51bc4abd-dfb4-4d7b-9f9e-46fce93f2254", "comment": "Malware payload (Mirai)", "value": "a5e7914940f9ed0b3eb2368dfbca87a5749aa62174a69362a73cd2d18487c9b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317907, "uuid": "91fb6a06-1c1c-48fa-837d-1b61a2eedcd7", "comment": "Malware payload (Mirai)", "value": "8521816fa69ee25bc70a4dad296754dcd984da9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317907, "uuid": "a0cb6028-c04b-4647-8d4e-bcd460815ef9", "comment": "Malware payload (Mirai)", "value": "d79bb898a77aec0e0126babba8d250544c27c5e1fcb08d162f70f8df777437427ece25e29d99608d1667ed67c6974291", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317907, "uuid": "6691dba0-c41b-4b90-b1c1-a3bf5f2c8271", "value": "T1A59329B41995B3BCEDF25079F80710EA28620A1C3B9CD1E379C7507AFFB4B096169E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317907, "uuid": "a05c5bf5-56bc-486e-b70f-c6c1bcfeb000", "value": "1536:ZVDYy1P4GWswaWTgJukc4EfIRg1uSDkzJkS+1vR6ACO0R5nSr:7wGWTTFl40JuSDwJkS+Z6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317907, "uuid": "e0f11f69-7f48-482c-8805-63468124d0a0", "value": 91592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317907, "uuid": "2d2c1cec-7a7b-4570-94b4-53c019acb698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317907, "uuid": "383328c0-ef2d-4047-acac-5d4f826244a0", "value": "meihao.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324582d0-d1cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652343119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343119, "uuid": "1a9bd68d-3368-4f27-b4fb-d41fa9172b6e", "comment": "Malware payload (RedLineStealer)", "value": "3f6e3541e23c2bb058097c6209c9e5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343119, "uuid": "6d81eb5d-468b-42d6-a030-4a1d17b1d183", "comment": "Malware payload (RedLineStealer)", "value": "a5eb164402f9da4286b958c7b5c2f185a3a5aab06a2f5412c3143f4148eabac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343119, "uuid": "21f46244-8a4a-409b-bcb6-37593fcd0837", "comment": "Malware payload (RedLineStealer)", "value": "1e4e8d0cf3f4020cc095a9ec64e2474ab57dc468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343119, "uuid": "53026712-e833-4dbb-a761-da4eabf06be1", "comment": "Malware payload (RedLineStealer)", "value": "7797450d6be7a7e5e5011e71c1ff9135f519cc29b7bdf3e016cfc4638ad1f1d2df301fc2b1a8904b45b81735faf68ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343119, "uuid": "346f1523-6209-4702-959a-89b8fd28f1f2", "value": "T1B684CF14B7A0C035F1B712F44979C6B8B92EBEE15B2490CB62C42BEE56356E5EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343119, "uuid": "6489b60c-ca79-4493-9885-c52686c8dac1", "value": "9d2be27d94f95f3f34e9faecb5708347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343119, "uuid": "82b90ed7-d8da-4b5c-a580-dad9d6aa0dad", "value": "6144:L3heCkFXGGANsqkPxVbuk3bjlwJxkja7ZhNZFFVEilVCltbPmM6wXh98MwYo:TXkFb4sqkPvuEl4kja7jN5VL8hV8Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343119, "uuid": "fc775584-0d55-425d-8ed2-89d9f3915189", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343119, "uuid": "00266ce1-acd4-48a6-b43d-5186b0e5b527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343119, "uuid": "86c9768f-746c-46be-8716-12155dc3c6aa", "value": "3f6e3541e23c2bb058097c6209c9e5ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a75c64a-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652346622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346622, "uuid": "8fca6496-537c-48cd-a517-a4f2efddf956", "comment": "Malware payload (Formbook)", "value": "d9a63266613ba6cc68ac317ef99f5fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346622, "uuid": "2d4b7714-c87e-4c3d-ba11-ce7c815ee04e", "comment": "Malware payload (Formbook)", "value": "a5ee0630cbe521aa9279b50a655a04ca59ed837919cdf94c8cafb30e4c39598c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346622, "uuid": "88c36e50-f7ba-42fc-85f6-807e1cdc716e", "comment": "Malware payload (Formbook)", "value": "5e5126241a64d1da5a77c156069a2442eacd9b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346622, "uuid": "2611fc29-c078-4161-a498-5b66b8d22f2a", "comment": "Malware payload (Formbook)", "value": "a459e27e41cd1e223e571a6e88f75c256d9e848c484f106bf6a6d7281d6979ce001059f80d1366dad843412e4e676b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346622, "uuid": "08d299be-d895-4bf4-a028-55fe2913735e", "value": "T1DB541221BBF5C13BC5D36F341C27973A8F8B40613C90D25B5BB136897EA9B82985E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346622, "uuid": "9db7cfc8-4b3b-4d71-8ea7-7381a45aec6f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346622, "uuid": "96c836c1-e98f-45ce-a3de-a34f201c09c9", "value": "6144:LOtIOmYNVpspfgYnZhrR+kH+Que2qXFe2Yc5z0HyO3Wk1sfM+:LOLmYbWDP7Ye9eVez2yFk1sfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346622, "uuid": "ec4fd4cc-e6c2-47dd-b523-1f68e2d65e04", "value": 290922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346622, "uuid": "10a07cf5-89d8-4c6b-8389-858b92f3d107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346622, "uuid": "ffa378a1-5b27-4b3e-af73-92e491397d29", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32ab8d5-d1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652342476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342476, "uuid": "d71543fe-c460-4b41-874e-b6fff3ca1a3c", "comment": "Malware payload (Heodo)", "value": "ff7c0b055713ef209218ff4b3f244332", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342476, "uuid": "ff920fa4-f0bb-4a47-800b-a9e2e1e48abc", "comment": "Malware payload (Heodo)", "value": "a72eb86e4f71e920c9fa8eba2308220f17e1ba9b228b2cff535accff816ce8b3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342476, "uuid": "6382d12e-397e-47cc-91db-d9cda43d4611", "comment": "Malware payload (Heodo)", "value": "a420c39ff15e16b63fede8b435b521d0dd9cf20a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342476, "uuid": "9c009e4b-fa32-4209-ab57-2f0cc9599689", "comment": "Malware payload (Heodo)", "value": "49b2fb10201459703e8d7f43f96459f1324dc0ae6e71a8a5d58b099a70fee2feabb9fb8f16836f89cb0889410b7f913b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342476, "uuid": "024faca4-1370-40cf-939a-fc2ffdac8b47", "value": "T147F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342476, "uuid": "5bab25c0-7a39-49f8-9992-5c85e806979f", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342476, "uuid": "76495089-f702-4901-ae2d-5342b44dd6a3", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSXjNwgraKRT61cKGNx:S4DzZKnH4+RGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342476, "uuid": "0c8482cc-656e-409d-a4d1-f0f5f0c9f62f", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342476, "uuid": "2bf03d6d-e5f1-40f9-a9fe-5267803b7173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342476, "uuid": "cd0b7b35-1a24-4552-9434-a76387602fee", "value": "ff7c0b055713ef209218ff4b3f244332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e725111-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337073, "uuid": "93927ef1-e505-433b-ad91-47bea05d2aeb", "comment": "Malware payload (SnakeKeylogger)", "value": "bdd52277c7748ff7d54b23feeaaa45e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337073, "uuid": "b1d57546-dd1b-4467-bd64-c26d23c96c81", "comment": "Malware payload (SnakeKeylogger)", "value": "a88f8838d49af0d68b48ca1e203c6b76ada283b397b0a37044db5281b8b2d0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337073, "uuid": "ab836846-0579-4dcf-a030-e57b81482cac", "comment": "Malware payload (SnakeKeylogger)", "value": "929d31a2e3171e54be2d6d6dd35c451cbb67b906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337073, "uuid": "f220150b-4289-4643-af89-8b9bd4c4bb92", "comment": "Malware payload (SnakeKeylogger)", "value": "7eb9f6114be184ecd84bd72384974201bd9907cddcbd7845e96f412bdf3e790b7cf38b71464081deda6027ed41ae4166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337073, "uuid": "231ed926-0ab6-49ec-ae41-93949ec293ee", "value": "T1B3A4121163398763D9AE0BFACE5A06CE03757E1DDC21D67F5C6870CE6AB23904462B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337073, "uuid": "3ab365ed-d4bf-401a-ab09-c7f6e1fc243d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337073, "uuid": "7325ef1d-138d-4c6f-a8cb-d401e1eebf4e", "value": "12288:g9xbaA8Grg0Bsd5RIUl0sKgxfyfw+f3rvxrxv7Le:g9JayLBul1afTjxrxv7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337073, "uuid": "23f48808-ff0d-45a0-b1aa-783cf12a4dcb", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337073, "uuid": "49b9b7ad-c235-4561-a428-b5edeeaf5985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337073, "uuid": "8dedb2c8-cc84-4f76-822f-f51d3cb9db6d", "value": "Bank Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca4d62f-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652391240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391240, "uuid": "bcb4e891-6499-4e52-8cc8-1043cda53cec", "comment": "Malware payload", "value": "6239a358904cb63718c1f76c99280ea4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391240, "uuid": "99ea4000-9860-4351-9632-5f182f1bfcc3", "comment": "Malware payload", "value": "a8c213e17f438cf39ce2c9000a4db74a7fa16f640c44ea7ebe8d533a687f2889", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391240, "uuid": "b1556650-6ed7-4e05-8413-89fe078b0886", "comment": "Malware payload", "value": "87c4eaa564e058ae40b8c640ac43722937543759", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391240, "uuid": "68272da9-33d6-45dc-9bc5-b1d4779466cc", "comment": "Malware payload", "value": "b69bccab5232cde1c4314594d40b6b998a75501663a1b543a7e64f30ae9369d53ee92fa75ce288977c68472a0d717551", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391240, "uuid": "b757c75d-f1dc-48f2-a018-3ff4825b6549", "value": "T12DD523229DDFE026E707D130C9BA9C8A54591069961CF12B677AD48C8EE4C84DBDEFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391240, "uuid": "1e6ad595-ed7f-4454-bd71-38bfc4a77773", "value": "49152:DPvgeuhYiTlUSWP9D9rQl7zJ4MRL+7zZBZugw+qFTpnM7zN5FTpnM7chBFTpnM7g:zvgNh7TlUSWP9JrQlzJ4w+hjtwP3nM7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391240, "uuid": "a8e5f546-314a-4f2d-b59a-63ceed4b5b6c", "value": 2780884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391240, "uuid": "c2b78918-008f-4b28-b446-be9d1f4c7340", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391240, "uuid": "8301e84a-b6e2-4240-9bf9-242fe446f095", "value": "Rat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297c41db-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337091, "uuid": "1b72dd00-3c98-48b7-8046-2dad0abe6999", "comment": "Malware payload (Gafgyt)", "value": "40aa0e4bfe250af29a50677732540ba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337091, "uuid": "5cad3647-90d4-4117-a36e-9ef16334bc46", "comment": "Malware payload (Gafgyt)", "value": "a9420a945a67a040533ddcaede8a0db6773a5668ffd17cd45cccadb245361f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337091, "uuid": "aede82f3-d18e-41a5-b3b7-aecb26d3845b", "comment": "Malware payload (Gafgyt)", "value": "94010bfe3a94b94c382b34339125b847e2d7efbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337091, "uuid": "8f31b564-5e3e-4816-8fa8-35974ed804e9", "comment": "Malware payload (Gafgyt)", "value": "e1a7ae999a472f46304d461c2a3b9b887749bae8c879075cdd845537bf77b952bdfea3e9119ba9b113604c8a9ac3c68f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337091, "uuid": "c4c99efd-b400-4e0d-9e96-4bd29763a4c6", "value": "T1A5E33B09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337091, "uuid": "5c2c042d-96ee-4196-88fc-be6f6616e651", "value": "3072:Bn7aKpF4LSV9OdAKox5cennFEM/9OD4bxCkEFvmpwfvRQfZn:l7aKpF4eVZKoLcenneM/9uvmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337091, "uuid": "b4033383-ca1b-40b4-bc95-976078c4df1c", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337091, "uuid": "9cd4f31b-cd7f-4618-be5d-51694c96ce90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337091, "uuid": "c0e78cb3-f616-495c-b28c-c309282e9e79", "value": "40aa0e4bfe250af29a50677732540ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770a8d45-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652316605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "16c30a87-2e66-4996-a0d4-84d79578854a", "comment": "Malware payload", "value": "f3929e0614c657b6ced79b56d96eeae2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "95a553ad-c093-4ea8-a6c5-e44e5712cfb6", "comment": "Malware payload", "value": "a995e6e62e92163ff90b041c3886fa2d5e03b55b583d8626df16d247333ba670", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "077efc4f-91d3-4151-a421-c9d8787b6bce", "comment": "Malware payload", "value": "b746125fc4f36df4fc8957342121aad349922355", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316605, "uuid": "b5b21d2f-b5e3-4e05-977d-77c25396ecec", "comment": "Malware payload", "value": "5547df1c4e14a541ac25706d30e9690dcbc323b0044d8587deb01aeac2cdbcd4d71585faf7b349c8c312b7ad5b953930", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "1d5a28dc-76fd-4cee-8670-298a823c71b2", "value": "T164521119EF958E3BDC6FDD7389FD0B4130DDA00B21B52B2B2275D528B21E54749E3898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "9a2520df-aef9-4abe-a058-f078a5663f84", "value": "384:eM3YAk9zH9vjpQiSXiBigCee8SeVdrKVx:n3Ol9KpXiB5Cee8SeV5qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316605, "uuid": "677d6df0-a3fc-4033-a062-242315866d02", "value": 14472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316605, "uuid": "5ed47a38-f1d9-431c-84f4-a09a80f88823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316605, "uuid": "334f7a96-46fc-4866-88af-473aa8f615d9", "value": "Ugliest.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865cbc09-d199-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652321785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321785, "uuid": "88f4ac46-b37e-45f9-b2a2-ec15a8e13d29", "comment": "Malware payload (NanoCore)", "value": "e62e3496deb3ee2c512ca61cf2642a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321785, "uuid": "f4c434e5-2974-4b73-b74c-758a26b1a347", "comment": "Malware payload (NanoCore)", "value": "a9ee1fbee3b6bd1c9c449774b8ed2f02fb89bde7cbf72b2e348c61240971238e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321785, "uuid": "acd6eab5-e756-48f9-ad14-7018677aba90", "comment": "Malware payload (NanoCore)", "value": "2b7942225b4d43ec944622e2b80d0d18c5376f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652321785, "uuid": "72f0b2c3-848f-42ed-a696-9deb7888274f", "comment": "Malware payload (NanoCore)", "value": "9794dff528258c8d93c2e90b722e5f194aa067a631085b1e0346eae67ebe008cb562eba0c13bee878631942de8b211e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321785, "uuid": "bb806be0-a349-48c1-9b3d-4aef75b0fe84", "value": "T1C1C4225407A52736E86C0BB5EE8229CD17B5AD835D25EB0FCCE4F1C949B874A42E132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321785, "uuid": "0d6de187-ceb6-487f-bbb0-05a211aa832d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321785, "uuid": "1e8732fd-d984-402d-adc3-85b4963c3ab5", "value": "12288:M4GvSfRMVmvlcY3bUP01EZ46IeXuLJxK1AXmq0sSNIiEq402Kbe:M78N3/EZ46I7JxK+qjU0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652321785, "uuid": "f0774296-4ca0-4647-94f5-ac5ca4a2fa99", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652321785, "uuid": "3350b37f-9554-4325-bcac-7a9da2334c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652321785, "uuid": "8ea67f63-67a3-4c00-bddf-afedbb1c6cad", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806dbb46-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340673, "uuid": "3dcb1f59-a77d-4dcc-98d8-2199b63781ac", "comment": "Malware payload (Loki)", "value": "2c24fa42140a8a16f3777173a2d3f0ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340673, "uuid": "e02af6bb-02e5-468a-ade4-07200eb919fc", "comment": "Malware payload (Loki)", "value": "a9ffbe69538bcd014f6c7b1606c3df5781d369cf4386240ab1a788e9a2f99935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340673, "uuid": "0c510d83-edc8-48d1-91a9-60a8ad9c2e2b", "comment": "Malware payload (Loki)", "value": "a11c097a2317d636ee095ccb94ee9d6c96934eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340673, "uuid": "a1eec186-71b1-4bd0-bb35-6f003d8c57cd", "comment": "Malware payload (Loki)", "value": "c2821a37fdd336e231efcf70acf43a9d0c00dfa9c37af60f5b3da1425fdbd89bc168be518bab4249cf518acf0e38dd80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340673, "uuid": "17fe7159-9287-4915-a999-01f99a71bb55", "value": "T195040220B3E1956BE9635F714F3B4B628FF9C91235B05B0F03A0A259B976241672F343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340673, "uuid": "f8f63956-b9ab-4c60-b87e-ccffb3102f4d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340673, "uuid": "71e2c1c2-30fa-413f-b877-3b16877df184", "value": "3072:LODZGPEounb3HKe2SBjfpYRcLdwTR+DTnvYTeemBz3pjb5rItWMbsTcgR59tgjBx:LOtIO3HKRWNYxRw6eBpb5cPwTnZtgjBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340673, "uuid": "4b4be19d-073d-4b77-81a8-ae8af77d17f9", "value": 182364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340673, "uuid": "fdf30838-fed3-433d-977c-914b43516ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340673, "uuid": "277108ff-64cb-4077-b514-84c186cb4ba5", "value": "2c24fa42140a8a16f3777173a2d3f0ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb6cb71-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652340749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340749, "uuid": "db64cb4e-c6d7-4d13-89b9-7ace6c877ca7", "comment": "Malware payload (ArkeiStealer)", "value": "3107999f9600f5f2bc88e17282da2773", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340749, "uuid": "ea9fd520-b4ac-4a42-86f8-147ea1f56e5a", "comment": "Malware payload (ArkeiStealer)", "value": "aacab9cbbf292403a63bcfd1f6f0a9e534ac39aab406f2c9d7aa98b719f3801f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340749, "uuid": "3e14f848-84ef-4761-a856-23cec4da8de5", "comment": "Malware payload (ArkeiStealer)", "value": "8862f9551fdb7dc30e135c556751b973f441e7b4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340749, "uuid": "622e1606-938f-4ada-beb3-1bf13b51ebf4", "comment": "Malware payload (ArkeiStealer)", "value": "3f3691db9b1555e04c68b2d8ac7539ad0d8eb6a153a1b8d858017150a8d9cb6fd3f280da43a4a456c1fb591e1a2bd345", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340749, "uuid": "16f40b8c-818d-4d70-b114-6f019f019658", "value": "T1BD84CF00BB90D039F1B752F049798368BA3E7EA15B2441CF62D83AEE96356D4EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340749, "uuid": "d735f5b0-457a-419e-b36e-7946af5e785e", "value": "8851c9f0c77f8ea0651ab311c7678050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340749, "uuid": "c3d5ed39-f307-4438-8542-0e5cf657598a", "value": "6144:E8jyD2n95U1C2gLuEF1sCVHdyt3B0KT9e574f7l1T7YGTeeuewu8o:HW2roC2gLuxCV+3HT9e5aYGTexeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340749, "uuid": "265001ae-d811-4341-94cf-fc454ea9e0b5", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340749, "uuid": "566e9518-7810-4e70-962f-075b5e5cc7e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340749, "uuid": "d19787a7-9fdc-4aec-bbcb-463d8eaecc17", "value": "3107999f9600f5f2bc88e17282da2773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a7440e-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338325, "uuid": "9abd01c9-1ad4-414a-9c6e-b1f19831027a", "comment": "Malware payload", "value": "17eab27a4dccef0ce3f3895dc65d87d6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338325, "uuid": "bda6d3ba-d06c-479a-8ce5-2194820a9847", "comment": "Malware payload", "value": "ab025abd662f487d3ca9b9f67b1430494fdec2d792d39ce21e8d524037d3c6a6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338325, "uuid": "fe940e9f-fd39-4405-8751-22c66eb71adb", "comment": "Malware payload", "value": "8537b9b54cbeb73e1f2d3b3abc3ad4acc4ee124d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338325, "uuid": "055ff1bc-62db-44fa-b64b-c15143f5a810", "comment": "Malware payload", "value": "91aa615e73bbcb61cf3f4a04fac9afa5d864189ac6883bacc90467e2b4ef459c0bef672c277176c5f081b8f315d9e22f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338325, "uuid": "fcd1a83a-b71c-4169-8fb4-f2e49657c2e3", "value": "T1F875EB31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFBF82CE6CA69342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338325, "uuid": "62c56cac-e8ab-45e5-bffe-3de0cd0fb41f", "value": "1536:D000QRch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+y:By0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338325, "uuid": "2ada56e5-b758-4bce-a6cd-d548bfc0379b", "value": 1677975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338325, "uuid": "4eb78370-896e-462b-9724-a886fc4b546b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338325, "uuid": "c7ee8634-65f9-4560-a40d-695e66d8895f", "value": "FZCO - PO 201930.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff4310b-d1e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652353262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353262, "uuid": "2f8b7503-019b-4366-bc29-66e49f3d8b6a", "comment": "Malware payload (YellowCockatoo)", "value": "e21ad0251176b06f8275af07d1c24194", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353262, "uuid": "6bc13118-e563-45d8-bc8d-c98acc155db3", "comment": "Malware payload (YellowCockatoo)", "value": "abe8cd8317397a61659c91ddbac6583766999afd73e5ca1236cce01a29f00df9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353262, "uuid": "ffae72d4-885e-480c-b5f5-d8c61edf97b5", "comment": "Malware payload (YellowCockatoo)", "value": "c1203cfd0f8a0d021b7fb2358b28af7ff5c35ac5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353262, "uuid": "8bc3d17d-0400-44df-9815-32d5e9c11501", "comment": "Malware payload (YellowCockatoo)", "value": "cc9bfd3f261c86ed66bc3b6f632f676c70dca992c2a5620afbc3aeb6d51d761fe99c8a8541e5fde89ec28fe419225fc2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353262, "uuid": "63a6508c-f511-4fc8-ba6e-0f4ab0f7d04d", "value": "T1BC3633DF7D162F18C32ED5BBA89E89603C5252FFAD926B17B16938138BC0EC6701454E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353262, "uuid": "c561df04-1521-47d2-87ba-41e4701c81c9", "value": "98304:M6RUk6p2KPcPpQfp89PyDwpIWbEDPVpVg0FP0R9RK9Qmb4foxz:MeUk6pPUpQfpeyL79pVgmPOK9QmsQxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353262, "uuid": "39517b38-21e9-4df8-8cfb-e25116333bc7", "value": 5107368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353262, "uuid": "41982c6b-bccf-463d-90db-3e9a5968d8c1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353262, "uuid": "d99f0e4a-b772-4624-a6b0-c09b7466a271", "value": "4a7359480a6a8d14ca4450bc42674ee7ad7e49693e6ef4f8fb5498f0ee283b1f.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353aeca8-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652344412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344412, "uuid": "dd60e0f2-ee72-4ec8-b4ca-e49e194d5a5d", "comment": "Malware payload (Heodo)", "value": "afb2f158814abd2d9f25badb1afadcb1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344412, "uuid": "44ecadc0-acb8-41b7-b4da-f8faa3f4c6fa", "comment": "Malware payload (Heodo)", "value": "abf0c51b9b4a4cd91549e9d1f30e5a8175e5483d897fb563c3d7e8339b34345d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344412, "uuid": "eefe871c-1d94-434d-a80a-d2be1a5c33e5", "comment": "Malware payload (Heodo)", "value": "32827cb8df75b95d42cc12fd5e3e2d5556252d0c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344412, "uuid": "9c29d2da-251e-428c-81b8-9f4a9b38d629", "comment": "Malware payload (Heodo)", "value": "29793bd67fb3265f6306d72f3a6fdf0bd90ec4d41195c77b73b48a582b60e0026d0c615bd2724eed4044f9eb54208eaf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344412, "uuid": "0c643455-e4ed-4c65-932c-a7bb6dcac363", "value": "T105F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344412, "uuid": "fe2294d7-b838-4758-86f3-6f263a99242d", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344412, "uuid": "dffc72c7-072d-483e-9d9b-4701be407b13", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSmjNwgraKRT61cKGNx:S4DzZKnH4LRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344412, "uuid": "e4e1c94a-a040-4bd7-9f7d-bb185d3041e9", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344412, "uuid": "80cd52f1-09a8-4a75-b66f-5b2895ac06bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344412, "uuid": "fbedeb3e-749b-4d3d-b3fd-a8b4191a5366", "value": "afb2f158814abd2d9f25badb1afadcb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47e82eb-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652366584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366584, "uuid": "eea16bf5-7824-4ed6-a0a4-dc361dc9b843", "comment": "Malware payload (SilentBuilder)", "value": "42c8177f0caa7442950c032de5129404", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366584, "uuid": "bbc83b24-af5f-431d-8382-1814a56f4f81", "comment": "Malware payload (SilentBuilder)", "value": "ac91a972cb6a265674e8c01d9daf42fe4f02b62ee060a9ff914357d643a84bbe", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366584, "uuid": "7fcdb381-a868-443b-9e80-f5ec6a6835c4", "comment": "Malware payload (SilentBuilder)", "value": "af2e1110c990238fd5160d80d64fe422b65583d2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366584, "uuid": "ed5b107a-1e81-418b-bc65-1494b2da5b06", "comment": "Malware payload (SilentBuilder)", "value": "4be4c96cff6bb14da09cf8fbd7891e8fed07ffc661a3122263b00be1bfcbffd2203c6eeceec0073edb3dafe828f76efc", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366584, "uuid": "d958a388-0a81-45a5-8a99-7370dab26a58", "value": "T14203834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366584, "uuid": "98e843e9-165e-4246-80f0-d72cd353de88", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366584, "uuid": "0543d38a-3640-4ade-b1eb-dc2c3132339c", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366584, "uuid": "d2691a2c-1435-461a-8bb1-17dce33404b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366584, "uuid": "b7868e50-f02f-40b0-ab52-dbb760afe365", "value": "Scan 2022.12.05_1415.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693728a3-d1cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652344070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344070, "uuid": "0c723173-d68b-48c9-a09e-159b3acd21b0", "comment": "Malware payload (AgentTesla)", "value": "3ea095f33927aa30feee1bafabedacfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344070, "uuid": "fedefc0f-d18d-48de-b78f-d8cd3eef2ceb", "comment": "Malware payload (AgentTesla)", "value": "acd98c0108766bce0174434e267ff3bf12ae962a0596d09a1f422e190518a47d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344070, "uuid": "ce0d2ce1-e695-4ae2-ba0b-b7d2d8a80e8a", "comment": "Malware payload (AgentTesla)", "value": "38976eaf740a334c45087f8133a629fa8652ff08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344070, "uuid": "2525788b-f294-4473-87e9-e924fb804558", "comment": "Malware payload (AgentTesla)", "value": "2022fc471f5e5c72759a10cea5efd16de0b07ce1be5d1aaa5048e6f3df06ea8c9fa65ebf6725856809c5084649814fb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344070, "uuid": "f2a55ff5-2e82-46f9-b8ab-effdf183bb33", "value": "T12973360152E78E66C95ACB3C09A3E3312378EC550632D7272AC46D673F7EAE17A651F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344070, "uuid": "91adc5ea-5253-4e28-bad8-847b7448b1ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344070, "uuid": "e22a6598-7fd3-4620-9de3-527ca2bfed49", "value": "384:gmWhbZLRiRq3bfzaA/1EFdRr5zGSmsJWtGKns:gmWzLRiE3bQAts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344070, "uuid": "dbf94590-f52a-4480-bb28-6f6c2442161b", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344070, "uuid": "76c9ca7d-b7cf-4245-bcac-cd9457243d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344070, "uuid": "cbf711c5-2c36-46bd-b9de-71c740143664", "value": "RFQ# DMMS000692021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0b4e28-d245-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652395806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395806, "uuid": "8b6c14da-ac2f-411e-8e7c-4a40f33f56a0", "comment": "Malware payload", "value": "5a331a8ecdcfa14f947f6b54f7cf98fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395806, "uuid": "2a74b34e-3b73-441c-9c3e-7892401de125", "comment": "Malware payload", "value": "acda8e264df8b59023d71162b711686c858bbc17243efa327b4b2d00da7817b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395806, "uuid": "a7ce1bd7-7b42-413c-a1dc-7bc372b41952", "comment": "Malware payload", "value": "ae636033316175bbaac46c1409fba80e382b61ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395806, "uuid": "bb34aefa-0aee-4839-ae9b-ee59ab1ca962", "comment": "Malware payload", "value": "b60dea7b77dcbc5a201909929ad41b94350c54daf334c7676106b911c0823af9ebf2d7d716c584e5682da3c717aa011b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395806, "uuid": "4f15e728-90a8-467c-9c5a-609c35716c3c", "value": "T17A9329C5B845AA21C7C255B3FB2F428D372603B8E3EB72039E295B60778755F0E3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395806, "uuid": "5647c633-7c86-4b0a-a401-316d94e7dfd4", "value": "1536:b+wJxcgawVu+Qm9zIgbCbYUDRg/rXoF7G/nqRIjGO3Hjqv/3fG:b+wJxcgayGi9bCbYUDqci4IN8/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652395806, "uuid": "24e962b5-8ae8-4f37-9459-ee7abc79575b", "value": 95792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652395806, "uuid": "596532ca-5348-449e-a7ad-13e5d3a9c9e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395806, "uuid": "bcb56709-5ad5-47dd-b166-4cff7392c9b8", "value": "percarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed52068f-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338279, "uuid": "f1cd60f7-2d64-436c-bcb8-03d635c75e65", "comment": "Malware payload", "value": "8a74f341f0b0d9ac34a6394e81c2214d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338279, "uuid": "43bf1991-361d-4853-bd9d-7b082db51a9a", "comment": "Malware payload", "value": "acef8226f8f9369f0f8d68f145b75276792085e3e9c742a0cea9273df1f46b94", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338279, "uuid": "e7598d4b-082d-4b5d-9e9d-aa42ff44c854", "comment": "Malware payload", "value": "3e2a8adaceacda366115799d843ae40338f6cb15", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338279, "uuid": "e7f18a5d-5bb9-4ef2-98b1-e8822bc040a2", "comment": "Malware payload", "value": "507bdd802f89d07fdd265281b14cc2f0db7e231079c202fe5c5da500ddae8dfbd40344fb5ce7a4865245c35152bea449", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338279, "uuid": "93315877-ed08-4f89-9f0b-f3fc42a51443", "value": "T128E56C23F384A63EC56F1A3A5537A3549D3FBA6165229C1B1BF44C8C8F364812B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338279, "uuid": "1e676f12-d96e-4443-94e0-66afb90ffe95", "value": "49152:ME4OYzw7/M9/nP2pYSUNbWY2HlfAptqEja5KlYTTXEA:QOYUGne0t8UlRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338279, "uuid": "e5a7fb81-d8b7-4eec-866d-7008218b2b46", "value": 3252224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338279, "uuid": "51fbcbd5-b806-424e-8d31-49ec47d5d330", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338279, "uuid": "c9c3f70f-dcdb-49bb-afb8-4a36fd644552", "value": "Ac.EndesFactFecha0905.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b67d60-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340679, "uuid": "95c205bf-0890-4828-bf8e-c01e39afa5e4", "comment": "Malware payload (Loki)", "value": "c85a753c46e005748eb59d6d062d596c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340679, "uuid": "8dbf2f78-22b3-4d17-a51f-8ddb61639858", "comment": "Malware payload (Loki)", "value": "ad803880dbb40f2776e5e149ebce583a1eee4a8628d34849bb72923d42529076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340679, "uuid": "67ce63a4-f456-4ade-a305-daf45d506d8a", "comment": "Malware payload (Loki)", "value": "396d1f6cbcf4e06965f270b7d5aa67ce784cec6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340679, "uuid": "b36becf7-ea81-420f-868c-965996aed70e", "comment": "Malware payload (Loki)", "value": "24d8449ada2c5d48b6dea169fa3e727a3de5fad263af385c559bd7380e01f4623b55373090abdb063509b568f554ffe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340679, "uuid": "586adffc-b505-4234-9ede-d6ca3bc704ea", "value": "T124041205B3A0FC77D9A362334D7A47378FFA4D212011971B43687699BD732929A2D783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340679, "uuid": "23bcbc4d-ba16-41f3-bb20-471dc32f1f8f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340679, "uuid": "7f7fd09c-df1a-4fa4-8ee4-691944c0c263", "value": "3072:LODZGPEounbd9Ji/+jBLQzbe1Y1Yq5cl/2qSIv/4lM5jGkGZ+Ss7S2t7g1:LOtIO0EBLQzqIHE2yv/4ZASpQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340679, "uuid": "a92cd3b3-f567-4275-9e52-8742b637ff9f", "value": 183101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340679, "uuid": "0ecaeff8-5b80-4c5a-8b08-460fe869a0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340679, "uuid": "aff89171-0b0e-4401-99c8-997d1df86b31", "value": "c85a753c46e005748eb59d6d062d596c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245a462b-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652379173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379173, "uuid": "f40a467d-f553-4acd-b171-a9d4d4e757ae", "comment": "Malware payload (AsyncRAT)", "value": "fb67ea71ae9754c797283b2291b51767", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379173, "uuid": "0f3c29d3-ba13-430c-9233-d37b7eb702cf", "comment": "Malware payload (AsyncRAT)", "value": "ad8928c8a6c9558609dfe1e7c00b9605a757ae7523c8ebb62ae9d7bdc210efad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379173, "uuid": "cc2d404b-30f5-4f07-9c6f-ac1133a50850", "comment": "Malware payload (AsyncRAT)", "value": "7f7b75f75192a755eca257bd26f0b55541a5fca3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379173, "uuid": "9a928ad8-a5a8-4e76-89cc-8acbeeaeaf03", "comment": "Malware payload (AsyncRAT)", "value": "8163c606b7dedee6014971bf7872b365c143beee8aa7de4bc963b8eb35e352a06a3970eac7c29cb9122f09a51cab3a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379173, "uuid": "b1dc4588-763d-4ea1-82c1-05bbbf4964c2", "value": "T13F232B0037E8812BF2BE4F78A9F26245467AB2672603D54E1CC451DB5713FC69A42BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379173, "uuid": "ffcbef3f-757e-4171-ad2b-23d790e17214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379173, "uuid": "ec8cfeba-271a-4ef5-a932-9e328d3e505b", "value": "768:QuwHvTpY8oiWUUGyKmo2q8DoPNKgPIzzjbGgX3iw+Q1rWrlOeBDZax:QuwHvTpTf2IEz3bZXS85ydax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379173, "uuid": "b6910352-06ff-4d81-baf9-3fee99aea89d", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379173, "uuid": "7c0a6ad9-8f98-4c8c-aee5-580708f05677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379173, "uuid": "d1edc9d3-b96b-496e-bf33-6b6fc78da909", "value": "fb67ea71ae9754c797283b2291b51767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f6aa31-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652337483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337483, "uuid": "532f18e1-f4fe-4807-a9a9-13b38024ac65", "comment": "Malware payload (RedLineStealer)", "value": "af52a168768391f99b3af6134d89e626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337483, "uuid": "d9c14b46-6a46-4c59-a79c-0c3af7f18198", "comment": "Malware payload (RedLineStealer)", "value": "adb49ddb05ddec25931ce38d68dd444c6eff85a3a9221a1f75e0de4d770ff282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337483, "uuid": "b2ade4a6-198d-4306-93a7-745c0f55946c", "comment": "Malware payload (RedLineStealer)", "value": "721e29c624633191f5e54eec3c78dff9f701e5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337483, "uuid": "99b52751-5309-40d4-8be6-771ff44fe1ee", "comment": "Malware payload (RedLineStealer)", "value": "9a9bc8c04a990a9b4a62a652c5aad4ab1a3560b7741b6ebd632396e8bf9b7db8d3ee538c62ebfc6ea773efd6013041fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337483, "uuid": "5a3f277e-6977-4999-a4c0-06e1b21eef8b", "value": "T1B5453307A269F690EEB4B27B2968C4A74E7574C0CE39EF917F79138090837A950FC5B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337483, "uuid": "6f66971d-d05e-45b3-9da7-b15a4b8367ff", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337483, "uuid": "2f0e0e58-dc99-4a68-b0db-0ba6e473d137", "value": "24576:ZHgM/M788ArqbdDTxeLiPJ9I3QKl/C/D+QwvyPL0c2Le8jSu:5d/nwTxeLcmQrfwqPLj8jSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337483, "uuid": "cff5b12b-6abe-46bb-b582-d1e19f9514b1", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337483, "uuid": "784b4ae0-79e7-4529-ade6-a827df5640e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337483, "uuid": "b1ac0ace-c301-4363-b0cf-fe0851cbc6c8", "value": "af52a168768391f99b3af6134d89e626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1b4ba7-d1fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365063, "uuid": "82d3848b-e18a-43d0-9f37-ac778a5671b3", "comment": "Malware payload (Mirai)", "value": "6813ca6b9ef5d27ade05bf7d9772d891", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365063, "uuid": "9155c61e-b07c-43e2-b392-49b0a0833424", "comment": "Malware payload (Mirai)", "value": "adb94f5d53ebc1233d95c3ad716d6f646a0aa1b6fb0c98aef64295f6a9b29652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365063, "uuid": "993566c7-f6ce-4973-9427-9667e4aeb811", "comment": "Malware payload (Mirai)", "value": "87e6abcca51b2677084011a054154bc37b1b8cbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365063, "uuid": "20b69b36-c103-4f3d-8fc2-6cba5728b100", "comment": "Malware payload (Mirai)", "value": "8385a079a5794f720097ef4a145b8322f6515088b14ae96b19ecad9e9ba233b5e873087ed6e612fa02d7f90facf88128", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365063, "uuid": "680689a2-40ad-4d62-84a4-b6df72eadef1", "value": "T14C532B8D54022E2CEAD798FD90754F09CD541321A0A31B1FA6EBFDC33DB3269EE16649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365063, "uuid": "edac8ef4-f907-462e-a445-5c1bde836d3f", "value": "1536:I/cZcfgWxKGKRvLe64ClwaWt7VoLg1p5FyB:gcZn4CuBoep5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365063, "uuid": "641e21f5-d63f-46a6-ad05-79a6406a158b", "value": 63108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365063, "uuid": "d14f1635-38d5-42d5-b66f-6f219eaf1eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365063, "uuid": "e468d56f-0f48-48dd-9402-2fed428cb4bb", "value": "6813ca6b9ef5d27ade05bf7d9772d891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1c3d13-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1652338062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338062, "uuid": "2ced49a4-0d4a-48da-b7ca-c504c1efea04", "comment": "Malware payload (Socelars)", "value": "b1aec8c68835e43c101aa651f5c51deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338062, "uuid": "42cf89e7-6d8a-4945-a402-8f7b8369bfc9", "comment": "Malware payload (Socelars)", "value": "adbe7684954286b4bcfcc6a5dd3bb815e5d64228de39161f9c38765d27812d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338062, "uuid": "c6dfd984-0e15-4d01-bd82-5ea72ea3f1b0", "comment": "Malware payload (Socelars)", "value": "e68d13d19927562e7608ee18fa655d29894af64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338062, "uuid": "6251e9fa-727a-47d1-825a-06b0c6f72e9b", "comment": "Malware payload (Socelars)", "value": "1c346d35f1e814eace74a964d261d10157bf35a0da8a55accf912279ec42b325339f71659086ffa804d4c4032615dc41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338062, "uuid": "5d1d2e79-e246-4c15-a522-1e33b5aa1149", "value": "T15E854A11A6419037DAA7887BCDEAC6BA8F286D21038450E792F03D5F7A705F2363F5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338062, "uuid": "a30bf5cf-6749-4c63-b5aa-cfced445a000", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338062, "uuid": "9273b6fe-a278-484d-afe3-e7babef8caf9", "value": "24576:cOHxp+kGXpwGm41Lit2zg2eQfIt6qRBRRtbSvOWT+PK/D8eN1YmGep:nxpwWVbGca/6K/D8c157p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338062, "uuid": "c5623e9f-dae8-4295-a887-db780aec6b9a", "value": 1798144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338062, "uuid": "3821ecd6-8bf6-4243-9b1a-9f1312d389e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338062, "uuid": "5da79338-331f-4657-bdeb-becc7ab613c7", "value": "b1aec8c68835e43c101aa651f5c51deb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bc24b6-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652366537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366537, "uuid": "3966899d-fb1b-4bd1-868d-2bb81d604b10", "comment": "Malware payload (SilentBuilder)", "value": "3d42d94043317ab6ec1dd0e43b27d0ed", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366537, "uuid": "f2c595b3-9537-4464-b34c-dcc0fdb8c710", "comment": "Malware payload (SilentBuilder)", "value": "ae3844bda7776bb82e15b049409d860f1d632d6b72533603c9ff75ae7a721f9c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366537, "uuid": "0090c9b5-4fc3-4c39-b526-861e63c4e855", "comment": "Malware payload (SilentBuilder)", "value": "13533d03b82d51279b871f4b3f8d2ad7ff73e67d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366537, "uuid": "b8ff6180-77f6-4c36-ae7e-564ff55d71ee", "comment": "Malware payload (SilentBuilder)", "value": "f3a93bee67f2dc17d56e0773b73675c3c4ebc5a0ef5965cb95f374adbaa6904c8cc146a552e275661b8c6e51a849590f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366537, "uuid": "4e135969-9a90-4d5b-9b3a-bfc20720bee0", "value": "T1A203834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366537, "uuid": "183d142b-b963-4ec0-adde-b7bb3d688f6e", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAg:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366537, "uuid": "1cc0c611-b5ab-4050-8067-f4ee98946688", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366537, "uuid": "bae651a4-54c9-4482-b647-a2430e1ad8e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366537, "uuid": "6c79217a-edb3-4f60-956c-522e6d3e2b75", "value": "Zahlungsschreiben 2022.12.05_1412.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3c528d-d1f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652363003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363003, "uuid": "2cccca1d-500f-40c8-8db7-14b99f3878d1", "comment": "Malware payload (Mirai)", "value": "c98b616fc700da4f85ff32c847c6e8a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363003, "uuid": "c4284214-3a85-4038-aebe-0727cb9deb56", "comment": "Malware payload (Mirai)", "value": "ae6567f0f2090f8739a333319731da5ff3ca8511aea1bfc8863c076afd960ecf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363003, "uuid": "d9b95198-441c-465b-9882-42bf02b55ba2", "comment": "Malware payload (Mirai)", "value": "a8a1b55d1ce5693e713f9447be59ed68e9f6d99a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363003, "uuid": "81267782-0d76-4715-8030-c3afcc57d8a3", "comment": "Malware payload (Mirai)", "value": "e663e8e031879ea4e43ad009a9a35e050f19c393beacdb981d6518f66a43fdf65a774c163564a80c2e90dee2d7a4b229", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363003, "uuid": "98645492-e652-4ccd-be33-2f3bfffe66e6", "value": "T189834C20A97D2E26C1D0B57F22FB8315B2E2270E26B4965D7C760F4FFF2464068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363003, "uuid": "00bde179-df29-4a0d-9ebf-f6f67c36f65d", "value": "1536:49eb2RVvTRssZva1/2ncGZcq7x3axNcFFhzki6vFf3fAfiqFtIFFp:ch+NcKvFHAffFtYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363003, "uuid": "a2c3f2a3-3ee2-43e2-8ca2-902f6d5d2392", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363003, "uuid": "de82dd6b-323e-4267-9e04-85566f78c909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363003, "uuid": "54bac08d-f5ce-4a55-868e-9188a55b8f9b", "value": "c98b616fc700da4f85ff32c847c6e8a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f1202b-d1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652345086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345086, "uuid": "d4d540d9-8471-4af3-a7b1-9bab3c17180f", "comment": "Malware payload (Formbook)", "value": "00c72b6c888d7dfbb30cc6094c4f5704", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345086, "uuid": "240d3298-ae1f-4e70-bd5c-2053efd50647", "comment": "Malware payload (Formbook)", "value": "b02d4d23621c721c923d3772118c91d76cbe9c268895aef2d1933ba3fed08a62", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345086, "uuid": "2414c367-e8d5-4323-82f6-04e633821d86", "comment": "Malware payload (Formbook)", "value": "833e1fbadb413b44cfd0152b34339243ca364451", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345086, "uuid": "bb988a2d-fbef-49a6-a358-eb424b14ede8", "comment": "Malware payload (Formbook)", "value": "fa161596e9e8dca4c41f022ef4f52c4c02585d5e446cde617bd2b2c3587dc3ef778e83d2e852d6fc8819c1ee86c3d8a3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345086, "uuid": "5084dddc-9bf4-460a-8c09-ee6a6d6441c2", "value": "T1CDB4120AF3679623C16D1ABBEDC440EC23B2AF0A9C23D22B59D531DD56327C54DA0B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345086, "uuid": "981d9ca3-1da5-4521-9280-2625ef142127", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345086, "uuid": "a0ac9308-bf9e-4282-a63c-d2c2cef8d99d", "value": "12288:L65XUO3a6Xr7a4UoNFEuHBm+07LTkugOpNBuNbUA:tgr+4Uo7vm+MHkBUnuNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345086, "uuid": "bfb54ea8-69ca-492d-a3e4-732d91373945", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345086, "uuid": "ef4f1c71-1858-4e8a-af2b-4f497457462e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345086, "uuid": "c5d91c5f-c9fc-4488-9ddb-19b5e612ae2d", "value": "DHL Shipment doc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996952ee-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1652337279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337279, "uuid": "135ddfe1-e647-4c5f-b4f1-dba2fbb39994", "comment": "Malware payload (Socelars)", "value": "abe02583af8d82824a2f166e13e536a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337279, "uuid": "731080eb-b628-408e-ae55-0d5ac7f059d1", "comment": "Malware payload (Socelars)", "value": "b02de5b0b42c3fa90a31ea889fc392188306f32314b8dd14b3d61f74a5c98aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337279, "uuid": "195def0b-0341-44bb-b50a-81ea34374d80", "comment": "Malware payload (Socelars)", "value": "b1129f6ad61a8eccae426c07f719db38c836e92f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337279, "uuid": "04b56e01-a225-43ec-9377-5a4ce93cef21", "comment": "Malware payload (Socelars)", "value": "6ea67f88594b29097c2d20c56b74e0d64da20961042d1350a9ebac77a6337e33c3395c8546441144a5cd9dc27c9ce495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337279, "uuid": "b68fb367-8a28-4c2b-bef9-99f6b1fc0cd3", "value": "T125659E11F642A036E8E3007285FF5AFE8D28BE21031854D7E3C479A95E715E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337279, "uuid": "e3c9480c-a67c-4fcd-bfc4-17950da893da", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337279, "uuid": "b947a4c9-e8aa-4b5f-9f08-86aecfff8a32", "value": "24576:MJUpVuAV1cjdFq9qRwHd2d1pv6/5ltE3Ib6PG0LK0SvuWtI:zpZV8dZRyeM6PG0LK0KuWtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337279, "uuid": "ed2c5735-100c-42dd-af8c-3e11f3e42711", "value": 1524736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337279, "uuid": "88567178-c370-4200-b83c-07e6fc6a4975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337279, "uuid": "a4432c41-09c0-4990-962c-ee14280de335", "value": "abe02583af8d82824a2f166e13e536a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11337829-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363679, "uuid": "a33fe125-51f8-44f3-afc8-1ceebf0796ab", "comment": "Malware payload", "value": "ef06aefbf6f1d26dca4b92badb4f92fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363679, "uuid": "b5f1daf6-abe7-40ba-b5a5-168dfc45e831", "comment": "Malware payload", "value": "b0a3ba75417bdb32094a6f6045dd41a0098dfaa78af1c5f18767e1fb7d8e95b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363679, "uuid": "9fdb0891-c25c-4da2-b351-1f908ef081df", "comment": "Malware payload", "value": "4327466e8293283456124972ff2bc840f4f72ff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363679, "uuid": "8b059123-2361-4671-a410-5b93ce4c32e1", "comment": "Malware payload", "value": "0ec5d649c322631126f3f83bea9e0ecaa12dbbafe09168e77380c2621a5e5f1244806c4eb4eeac02913431b5ba9d2e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363679, "uuid": "e6577bb4-3a65-4376-9923-b3d296c98e12", "value": "T19AA612347D428F15C8600DB5C5AE86D92773EC105A82CB1B4A9DB72DF975A48BE833F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363679, "uuid": "0bcc3bd1-7978-4439-b183-7bb18a1cc8dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363679, "uuid": "5ab0e350-02e2-4eea-84ea-4e4820eb343e", "value": "196608:31s834A2pkmZ0jD3e05+z7Org53HRVu7vHDpS1IqBRU7kCs2q:31sR9kFv3e0X053xVu7vHhqBa4Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363679, "uuid": "f5a9d7bf-a973-49ba-a110-f7fd71c4bc68", "value": 10400768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363679, "uuid": "ecd8eefb-f216-4ebd-be22-d90b85d8cb41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363679, "uuid": "4188305f-41ac-4268-a32e-2830b50b8d9d", "value": "b0a3ba75417bdb32094a6f6045dd41a0098dfaa78af1c5f18767e1fb7d8e95b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea51cbcf-d22a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652384230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384230, "uuid": "132bc385-f934-4a64-aeba-0fa1cd17992c", "comment": "Malware payload (Formbook)", "value": "73d92a5e3f3cc68f581431cda26ff26a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384230, "uuid": "9e561da8-1348-4330-bd2e-e242ec2714f9", "comment": "Malware payload (Formbook)", "value": "b0c5c3efda2bcfa189ce5f5b94e1bf298eb712b0ad4e9573293a7883d54f4af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384230, "uuid": "5d1e7418-bcba-4103-8162-e6d0ea8a8a54", "comment": "Malware payload (Formbook)", "value": "a02d864f281eefb7cb67da411d43744000907c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384230, "uuid": "891376e3-0a9e-43bf-a632-4759841796cc", "comment": "Malware payload (Formbook)", "value": "78cda584832bb0375eebef25193ae4a84d48e008d0d7153c9d8755b41d1834c984843faf21bb255f19c9ba3a56dbf596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384230, "uuid": "4cf572a6-774b-4e21-b0a4-f082d1ab8b69", "value": "T149D45E5C6E010A62ED5E907869034FC5FB630B236BC7E9C7578B1ECA87CF2D86D15886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384230, "uuid": "0e06314d-91cb-40f3-9690-dd970fb0a9f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384230, "uuid": "051c91f6-9355-48bf-8329-d706abdb4664", "value": "12288:0eD4hjmDOBByG1MSrUwbEhaX3WKb8c6OVf0Yj:PsjKSrUSEhanWbc6OVf0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652384230, "uuid": "6e1c8106-14a9-404d-a399-466284b8099d", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652384230, "uuid": "81b75ebe-0c59-4a48-82b9-39150847ec5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384230, "uuid": "1b4dcbf4-7026-44f1-88e1-a4ee18bd57e0", "value": "Nuevo pedido _WJO-002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcade7a-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652342145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342145, "uuid": "d67929cb-a2ef-4dd1-acc3-8205f030dd9e", "comment": "Malware payload (AveMariaRAT)", "value": "340869d4a6a3ed2e7ca26ba6621a011b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342145, "uuid": "dc3250a0-e3a2-48a1-8fce-45a151ce95d7", "comment": "Malware payload (AveMariaRAT)", "value": "b11a2a39235849816172c60a0c41ebda51b034387c088f56bb6cb2484ad62049", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342145, "uuid": "36bdfc65-e857-4932-a241-9fdfadf88f0b", "comment": "Malware payload (AveMariaRAT)", "value": "941035f08a6855d6442521598ffe48d077a96e29", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342145, "uuid": "22a2ea2c-c922-4873-bdc1-d1957f227dca", "comment": "Malware payload (AveMariaRAT)", "value": "24217d031f3ca20c1f1b83bee9b9d6cae92e3197464e1bb2a840961503d3ef9a34396e88f3d5d8b3a8ee52c51c81a46e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342145, "uuid": "4f0ee276-387c-48e7-bff6-906deab2e426", "value": "T1A1A41201A2687332DD9643F9CEA466DF23717E165C11C75B8CAAF5CC9E32F714A02287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342145, "uuid": "252132b5-2e1f-4969-b05b-ffa44bd44657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342145, "uuid": "0833f4b3-534e-456e-a965-023f807ab6f0", "value": "12288:qv5Tds3BRnNCrODDWWuPYrPzffH7mTBRFse:qhCbCrODDW5PYbzfPKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342145, "uuid": "974a9c62-b745-4c15-bc04-da97d8df817d", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342145, "uuid": "29d740cc-eef0-4d10-a56a-114356650187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342145, "uuid": "15775f66-42d0-477e-9be7-ab14a4a8fe59", "value": "SecuriteInfo.com.W32.AIDetectNet.01.26190.3684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708f41cc-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652341076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341076, "uuid": "5ac5e2fe-77b0-4c71-9070-db4f41bb1e50", "comment": "Malware payload (Loki)", "value": "5264d75ed1b113608eab5ee6af7a12c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341076, "uuid": "0daa04eb-400c-46c1-8327-bef7dc531543", "comment": "Malware payload (Loki)", "value": "b14be84cf6e13f74894dc7b884c30a37d2063553f7996a3084468bd1d378d98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341076, "uuid": "7f090f43-0cb8-4f19-840c-b548c4052c03", "comment": "Malware payload (Loki)", "value": "b8c319a111040216ed7b350a3ebde1270b4a21ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341076, "uuid": "fb0be22b-3b7c-4e41-8ed3-137951be89aa", "comment": "Malware payload (Loki)", "value": "9bad7b08363ac7285340dc5ddac411308c54d53b341b3c778a94c47383c0877dac5235fa563ffaa757460e03dcecdfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341076, "uuid": "4883aa8e-ab74-4d8c-aba1-50748c75ab68", "value": "T142040281B145E557F9A227B6D937FB21AAFEC43520B52EAB0700698B3D77180F91F243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341076, "uuid": "acc6edd9-2b4e-4aca-a21b-a104a2a75848", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341076, "uuid": "91b85764-77a9-44bc-b895-1c828502f1e5", "value": "3072:LODZGPEounbbti/ovzcu3dYhQ6cAu1lTZP8I0wgqtLilEQXdP4b+EF:LOtIOVvz13GhQ6cAKZ90iJil7XdAb+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341076, "uuid": "9dde6ab7-beac-42f8-9ea0-820cfc066b07", "value": 183251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341076, "uuid": "76882c54-465b-464f-9dfb-ca0a789723af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341076, "uuid": "ea46ce54-4228-4cd2-af30-ecf49c8d1198", "value": "5264d75ed1b113608eab5ee6af7a12c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce0a1d0-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337070, "uuid": "054f0998-d13c-4466-9119-62f0f56b2e0a", "comment": "Malware payload (SnakeKeylogger)", "value": "c911882330ebb24874e48293899d5366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337070, "uuid": "9f2e9e29-71c4-42c7-94bb-7036adb4293b", "comment": "Malware payload (SnakeKeylogger)", "value": "b1a9099ecf0c8c8b44f276b60707a4ef40e065b4cfa761ca1d1904f803bf5642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337070, "uuid": "fdace42a-1343-4e81-bfee-03840e63b85d", "comment": "Malware payload (SnakeKeylogger)", "value": "28ca563df815c476b2342a30c432bb3fa2d80838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337070, "uuid": "f40f4357-71a6-4991-80ca-2e2ca2536166", "comment": "Malware payload (SnakeKeylogger)", "value": "1e20517ef17fc0a0e09315ebd173f2a3e4031ca8a67c9edf387de44ffedb7375fd565bd926e3ab6798229c2c379492e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337070, "uuid": "f8bf46d1-74fd-43e4-b4c1-6fee8d093fbd", "value": "T135C4020822ECDB65D2FE2F74B07930155B35BD4BB422D72E4E8459CD2A937924E24BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337070, "uuid": "19b0a25f-b774-4e35-a369-30644885ea45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337070, "uuid": "7d254aa3-de77-4b52-9122-c0efb782636d", "value": "12288:sphpP+eXYVIwY5fSDu2ImeaPx26Fg4XJH03jxp:sHR+sllSq208Eqtox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337070, "uuid": "02ab6e0c-6e12-4bee-a267-6d3d11d068f0", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337070, "uuid": "cb3c7bf8-7bbb-4436-ab44-ae88d6459479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337070, "uuid": "28a51581-a185-4171-ad16-b69c109244f3", "value": "STT4Bjf80IOx5pJ6Wz5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f42ea8-d23a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652391044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391044, "uuid": "5c4b2cff-cfb1-48d8-9536-c3af28f3ff4a", "comment": "Malware payload", "value": "b551c12d2b84ee03c9587a673015d8cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391044, "uuid": "05c51a91-f47a-47fc-aa4e-1d6c52506728", "comment": "Malware payload", "value": "b203186dccac8348d05e73563b7e3d8a9f0d9363176aa216a37316783ec643d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391044, "uuid": "b372b491-1e3f-4657-88a4-436c0ae7081e", "comment": "Malware payload", "value": "bd8fb99771dc2f2ebc461ef29ae6f6f2f88524a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391044, "uuid": "755b27fd-930f-44fc-a3ab-3650eb564ac3", "comment": "Malware payload", "value": "7b89ba00c1647bde273de443d9316d323a3eadd08f51457eaa424a4f92a65f291aa0be3c1e165bb48cc93b5cae784f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391044, "uuid": "ca9a5e0d-afb7-4269-b55c-611ee187d8f3", "value": "T149E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391044, "uuid": "a82cc171-b539-4142-9364-d9fb52540eaa", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391044, "uuid": "05d07b80-ff92-44eb-a418-a7d61654bd23", "value": "6144:mkajLyaPIvW1TFpvzYNB1MIB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8R6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391044, "uuid": "8215cf3b-24aa-4058-88e6-2c01e4287fe3", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391044, "uuid": "1b249d2b-45f4-4115-83c2-ec56ad7cac2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391044, "uuid": "33a3b8c9-963e-4c4a-8784-b80a3aa5ffbd", "value": "b551c12d2b84ee03c9587a673015d8cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd304b7a-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338627, "uuid": "bd05a391-32e9-4e1a-af8f-7c2ce3ac741e", "comment": "Malware payload (Formbook)", "value": "3b0057e1b07361b39768f31453dc3445", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338627, "uuid": "e52e19d5-f50e-446f-b619-a533ec71c19f", "comment": "Malware payload (Formbook)", "value": "b254ac5eee834f4b86503759f199a63c68a40d70a846b3fe6b6b41c36d4f353d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338627, "uuid": "417b973d-8859-4573-9a04-1eadff31d858", "comment": "Malware payload (Formbook)", "value": "77728816fff781ff08c05fe909762aed2d6c0032", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338627, "uuid": "f316678b-f398-4be4-985c-0f5e80e7152f", "comment": "Malware payload (Formbook)", "value": "b551634bacba0bef07f592e55fc61a26c7da00e7f06618b0b8c4e9fc80b3f62ef6e45ff66ee1195a8badcec9b9ef8304", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338627, "uuid": "126b4b0b-6b6d-4dab-bcdb-d2810db13d3c", "value": "T1A00412D5F730D3CEE5E7A0751A248F9601D6EE0B9D62430A13223789A5FBF6B584312A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338627, "uuid": "06b90f78-0f1b-4c83-9abb-4b4a47d481fa", "value": "3072:842sXo9OdJa1XDO0ifgsuOrKQ/DC10WhK21SsiN02qEO:924s96R1rKQ/DbW/Ssu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338627, "uuid": "7a036126-bce6-4813-bc73-48d4228ab547", "value": 187976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338627, "uuid": "87effc2d-8428-44f3-9aee-357681b5344a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338627, "uuid": "5dc82f3d-3749-41fc-bf15-1d2d5781185a", "value": "New Purchase Order 4522028497676.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b73623-d1f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652361590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361590, "uuid": "cd844367-457c-49f6-b5c9-a39d650e812d", "comment": "Malware payload (SilentBuilder)", "value": "43ade0072d23b808fdb0280ee4b9bc64", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361590, "uuid": "2eb18531-1762-4e2e-af95-85e68675e026", "comment": "Malware payload (SilentBuilder)", "value": "b29f5ea55908af68adffdb043e663376fb816ab388885b4ccf08acad69812b87", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361590, "uuid": "602de1e1-f19d-40bf-8191-9802ffb3b7ba", "comment": "Malware payload (SilentBuilder)", "value": "3637f79a11968081a25cda956c0ab91938048cb4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361590, "uuid": "ea763507-f9ed-4442-859c-80995597a781", "comment": "Malware payload (SilentBuilder)", "value": "5adbc6f37bd85a0eedd5383cde60116059cac74444ed383467e87eb4df68462f19d39495f7edceaacef28c77ef121b2e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361590, "uuid": "5812df68-f29f-486d-9d62-7f665a058595", "value": "T15803834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361590, "uuid": "5cbf9d5c-21ae-4cc9-a1d3-71e18508b25f", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652361590, "uuid": "cc278070-1a38-4804-9511-8affcc13ea10", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652361590, "uuid": "35a62fe3-070c-4134-89d0-ffed6c79ff26", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361590, "uuid": "2f4a5a0f-a528-4155-9d9b-93813ffd8aa7", "value": "Invoice # 74265308 R#44702326 9606.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbb21ae-d1f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652360961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360961, "uuid": "71125de2-9ae6-4be1-a45c-d260d31064bd", "comment": "Malware payload (AgentTesla)", "value": "c265ad005f39f520fce37a9f1396ed72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360961, "uuid": "e7f1c4cc-63af-45af-ad34-4b650fc1a59e", "comment": "Malware payload (AgentTesla)", "value": "b2f00f54573d488a5b5d71776703c1025a373957831cba29a4ee9504040661aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360961, "uuid": "5e51a691-1fe2-488d-94ae-ad7438395768", "comment": "Malware payload (AgentTesla)", "value": "34ee6f81b7c2ad73e21707b07c0320c9e2e4d333", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360961, "uuid": "757de069-63e9-4945-8456-73a4a0ac9117", "comment": "Malware payload (AgentTesla)", "value": "1d6ccf58daf32551ada3434063a71b7a526ab685732d7deae8f5a6b370c82b5e0e5ac7fa003520e9f1bb84726d9de9f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360961, "uuid": "c818101e-9c04-458a-a2a3-bcc2f4381e11", "value": "T19443E7A60248ED49ED560A3790B5950F02E15D054F7F8E8F3C7F7782DB3E2A3A71A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360961, "uuid": "d06a915d-14f7-4e2b-a0ee-855bc4bf5cd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360961, "uuid": "c8ac73b9-3178-40e6-9ac7-4b08da103c01", "value": "1536:OOdqb4UJDeyOuLXYOmamM875aNi7mSpu:OOqb4X62k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652360961, "uuid": "f75e05bb-bca3-4d41-be54-2aa22727b0ff", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652360961, "uuid": "096bf55e-6cd2-460f-b2a7-9a344165fe80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360961, "uuid": "ca0d86b5-8f8a-4b33-8d2d-36bafa24b863", "value": "COMPRA_D.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2241afd2-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652341804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341804, "uuid": "a416e970-6456-4439-92c9-aa022ac4263f", "comment": "Malware payload (Mirai)", "value": "962a3e454dfbd73fb2bae7cee94dcede", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341804, "uuid": "1827fe56-66b7-4c1a-b401-17369e4f220f", "comment": "Malware payload (Mirai)", "value": "b2f773062b4fbce9a9029576a81a36779ef772208ffd45d63cd9a9fc7fbfbe22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341804, "uuid": "8461b88e-c183-4f42-a416-c2ae0ef6c7f2", "comment": "Malware payload (Mirai)", "value": "d6fea5441d1d8f9e79aa2d39273d2522c2aabbcc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341804, "uuid": "7c8bf16a-7cba-454e-905a-d3afee3ff22f", "comment": "Malware payload (Mirai)", "value": "11bb61877c544a68c40569c76323c3632fd2d710388fb013eb28fdb8e5a9a5749763cba686f422af356250795ad2e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341804, "uuid": "cfb8e27f-fefc-45ea-84d2-ed14bcb330e8", "value": "T1CF435BC9EB83E5B5CC4205753877FF329E77E0F61125EE86E3989672A84A103A407B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341804, "uuid": "3160e0f3-4529-4e6f-8bba-b3eb43165cb2", "value": "1536:7iWCMcj2KWGWmWLOMXV1HczMHbTXmD6KL8FdJwZV:afj2K6pV1NHfWDxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341804, "uuid": "b9db9833-532c-4377-bc24-14920fd570d1", "value": 59636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341804, "uuid": "59c48b8f-176d-433d-8baa-38311a77fc40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341804, "uuid": "ff08f680-2264-4fb1-85cb-829fc774bcc5", "value": "jKira.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c003b15a-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379434, "uuid": "3aa93d53-644f-4bfd-869e-c0d96d2fba49", "comment": "Malware payload", "value": "9e64636318232b2de6eb08c813e6b840", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379434, "uuid": "3d7064fb-f657-4ab7-ba81-3ada7fa901b0", "comment": "Malware payload", "value": "b35069cc23508463e726b2ff41e6c9ce1ae0ba3f43b3b407b34e296e2d802dec", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379434, "uuid": "5afc6eca-1d5f-464a-aac0-318f4a4ddac1", "comment": "Malware payload", "value": "7676a87a3c0fb9d55ca3ec1e3f33b154bdd63e4d", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379434, "uuid": "0e494b54-4490-4b94-afa5-9447a38cc0ae", "comment": "Malware payload", "value": "353fc7e6b72c5117bae508b060e9e3a063f213ba7ed6bb4f587f55d98914ab491258f5ad5e9149b45b2b2bf2b9b01112", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379434, "uuid": "92ccceed-17b2-471d-8fe7-78e718ab621a", "value": "T10D0402157B4F32C4E712823193282CBF8A368E608A6C716EF09D753DCC7C52E95853EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379434, "uuid": "78a51a43-1fa0-4b4e-83f3-5c4dce917a0c", "value": "3072:qawz2lV3oc4ZQcGuXcjJ5sW4R/W56jbebkOIJJIo4rygLHuHLJay0RVHSDzg:ez2fopZ5BMdf4R/W+6blIfIo4mgLHu8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379434, "uuid": "34e56ff0-7e02-4703-86e9-df455a92eeb7", "value": 188312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379434, "uuid": "e46ecb5e-33d2-42fc-b935-d88d005d5239", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379434, "uuid": "0428984e-8fe5-48a2-8c56-d0f0d2db0a10", "value": "FATURA \u0130\u00c7\u0130N SATIN ALMA S\u0130PAR\u0130\u015e\u0130.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910be89d-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317938, "uuid": "7c049ab3-b6da-432f-9336-54d9d2c1b84b", "comment": "Malware payload (Mirai)", "value": "7e49795d5d632d159cfd938053b73627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317938, "uuid": "2d9b4a3b-051f-495a-a4f2-00df030b0c8f", "comment": "Malware payload (Mirai)", "value": "b3545c9babcee47f6be14a1902b006df9dd9af8691efaa10553ab394b8be9eff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317938, "uuid": "51fbd8ff-66e3-4410-9d60-1fcd6a4a4b5c", "comment": "Malware payload (Mirai)", "value": "33a68732f97630fc73882847225a3858eb81e7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317938, "uuid": "2c4b0cd4-8dfe-4fde-ae0e-d81a55715612", "comment": "Malware payload (Mirai)", "value": "7843c0bd973beae7d89c9a4469999c93a6cb8e2c2c430cc7a029f80feffdff52ce34e8a6f9868f5687786bf95f1bf304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317938, "uuid": "d18b0ff1-ef7e-46b5-bad2-24111c8fa8ac", "value": "T10343F1F2D54591927BA20E3CB01C80D315CA6A3C92DF5938FA5B866E3DE8DC35B2E448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317938, "uuid": "78de520f-2f9d-4a3e-bf7c-39267e14aedd", "value": "1536:r58jsZQY6vKZKoGuQqiTcLCCXE4zrSfhD:18wUKpQUCC04zrSfhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317938, "uuid": "6b715336-b36d-42e3-b682-c321e1a47bd3", "value": 55260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317938, "uuid": "ab2da241-c2ee-4e9f-aaaf-f05bb1642a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317938, "uuid": "98f5df0d-3044-4972-a8eb-b89607b5f613", "value": "meihao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b252fd5-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337067, "uuid": "b23644c9-ff52-4f85-832e-598b5437b351", "comment": "Malware payload (SnakeKeylogger)", "value": "11626cbe49269c4305362acbfa486fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337067, "uuid": "5b73fa1e-ceb9-4db4-b0ec-15d3a4bce914", "comment": "Malware payload (SnakeKeylogger)", "value": "b359385f64c96031360a8c8523d4fa2ff487a3cc066fe2e4276661bf783b7469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337067, "uuid": "64c5f4e8-0970-4b12-8bd7-25e332b8f7ca", "comment": "Malware payload (SnakeKeylogger)", "value": "9ac4cd5bab21c32668554e73c3f47bfa7a4d5fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337067, "uuid": "6af11c49-2575-4549-b6a4-357900fed5b9", "comment": "Malware payload (SnakeKeylogger)", "value": "44d7c5cfa5546c8acb6aff05ff7b88ac1b2bb2abc161045b253bcb1776a811cb3a86ef0b6f3d43b303e8792db3bba805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337067, "uuid": "7ea50dbf-55b4-4a5b-9e9d-4627cfbdf722", "value": "T10FE4E0A0F3C190C7C8795AB694979770266BDD75D8E40A83219C3A9E4D733878C398EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337067, "uuid": "5edd931d-1496-4b1a-b782-ed43f8076c17", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337067, "uuid": "d18d1d25-a211-47cb-8c48-fd300e3c6388", "value": "12288:ONp4Wi//peiRnYqNa7rOG0pLmOsgVMzVuLx:ON7i/R/nY+qv4mOCzY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337067, "uuid": "bc172e39-5961-40e7-8c4d-bcb319d02dee", "value": 658516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337067, "uuid": "c2705981-87ee-4889-a9da-8dff2b69e838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337067, "uuid": "ea5aa362-8013-475e-9c1c-d7be38630b04", "value": "11626cbe49269c4305362acbfa486fab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9d6aea-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652344400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344400, "uuid": "f198b921-cabf-4747-92ed-d17e8d99d9de", "comment": "Malware payload (Formbook)", "value": "5594b013baa0246296cf27c10804e75a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344400, "uuid": "3b612351-88f1-40fc-9bea-b806890b972f", "comment": "Malware payload (Formbook)", "value": "b409cabbc8dbdfa8a3d1a60cb225f27386dfcc61b3f7379812218b6660ef654f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344400, "uuid": "f4081295-a1b2-4c65-bf48-3cd150fe6566", "comment": "Malware payload (Formbook)", "value": "de3b6f5bc6eb3767dd7ab7bb405288284b4242dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344400, "uuid": "6b393fdb-cb6e-4091-bf23-45ad2e7428da", "comment": "Malware payload (Formbook)", "value": "d3444dba7eff8c47a7ae4f70e94a2ce1f339c579e6e405568ae098ba4ba1ccd820d47cde385301c5ba2227dad2550306", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344400, "uuid": "29fd9f21-e2df-413b-8634-056983158cd9", "value": "T120E40118BBBBCB12D5FE6F3A90F6501147B66F09E523E31E2088234D9E527970B91793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344400, "uuid": "b41fa337-b280-4297-b52f-6777284ff1ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344400, "uuid": "35b76940-d87c-42c7-a0f9-a1788763562c", "value": "12288:jOp9p8zJmqS4HQQyFyVNmnvjIBNnyrV8elSVD9/NnF7WBrovPkd5p:iHi3KWNmvs6V8eOlWBUPkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344400, "uuid": "f18a3246-bd5f-43e0-828e-33b65510e2a0", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344400, "uuid": "d974d91f-2ac4-47c2-a4ff-5e0a1c3b7070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344400, "uuid": "aa89f76f-c874-42de-8a28-a86022514bd4", "value": "5594b013baa0246296cf27c10804e75a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25fe79f-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340730, "uuid": "f94c95a5-66cf-467a-a2f0-17eea1c5f829", "comment": "Malware payload (Formbook)", "value": "62f6611574881698664ecd291fdb4185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340730, "uuid": "b5504e6f-6974-4ceb-b314-379dfd7e7760", "comment": "Malware payload (Formbook)", "value": "b4a31239040deb4bf5f7fdf7219a2b8e9c1141131da634489e6e894a19a9255f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340730, "uuid": "2d7f52c4-7bc8-41eb-9552-42a29c5078d3", "comment": "Malware payload (Formbook)", "value": "51aa4a6ff934b5e913562707748cfd530844b9b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340730, "uuid": "87ad3c15-09c9-4371-bcdc-2e5cfc9039d5", "comment": "Malware payload (Formbook)", "value": "4f3069622534c46c1b6690d511c989624b10f8ec79bb57488ef294cb8abec96fcf25412d312d19e373016a098ec8d45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340730, "uuid": "69b265ae-3ce1-4a01-8115-826c5c1484e2", "value": "T16E847364E7687C17CBE398F2BD81745CD41F8F88B7C04D0E9365BB1A34E299620D19AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340730, "uuid": "0640904f-b96d-4f5a-8876-1630cf59c430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340730, "uuid": "e68bad59-cf46-458a-b191-99ca0a933f77", "value": "1536:dNls63bJCWKdWuP/stH76Oj7zocFdV/dzMen+r93:L3bUWKdWuP/sB76OjftdQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340730, "uuid": "f431b8b6-9783-4675-a290-35e8ae71254d", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340730, "uuid": "30f85a56-8840-4724-8886-1b6b87f6bc14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340730, "uuid": "c648b2e4-e8fb-43b6-b056-b0ffec16f6e1", "value": "62f6611574881698664ecd291fdb4185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a6f2b6-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346203, "uuid": "7e52b9bb-f5fe-410f-baaa-0a775f928478", "comment": "Malware payload (Heodo)", "value": "cae2868ddc712f23b1d97aa8ffa27d85", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346203, "uuid": "b1e5d681-e7a7-4311-9211-0232e61fc820", "comment": "Malware payload (Heodo)", "value": "b4ce762d1ef0a4720f85c50ab3b041deef4586392052b1be6cb6e85cfcaa49fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346203, "uuid": "6d0610d6-edf0-4118-8dbb-08e23bbc6c72", "comment": "Malware payload (Heodo)", "value": "610665085b63f8e66e08d1c9b177d17256e0a7b9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346203, "uuid": "3a8bc7a2-bbfc-4a4d-ba39-19a251728bbe", "comment": "Malware payload (Heodo)", "value": "be63fef4902597b1a542b1aa0fc15a0e18fbbcc2d80f5c3407e084426a8705842cef13ffcdddc1887478855edbc5e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346203, "uuid": "790c7d4e-278f-4f0f-92c4-7d75b3795986", "value": "T110F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346203, "uuid": "aa1d3d30-035c-43a9-9f2e-98df0f6ff6f1", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346203, "uuid": "be2d3163-8b2d-4af8-9345-0864b6b6c9f6", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSHjNwgraKRT61cKGNx:S4DzZKnH4+RGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346203, "uuid": "6041638b-65d6-4e17-b244-c66f3fb5a0ac", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346203, "uuid": "2be0635e-5786-43c6-b7f2-02b0da3dc8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346203, "uuid": "62b4924b-e184-4559-9f87-2bc10f1c2928", "value": "Z8Zvr1rG967FnT4a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e8925d-d231-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652386960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386960, "uuid": "f0eb1949-731a-4535-83d6-589d52a8c0e8", "comment": "Malware payload (DCRat)", "value": "00e18e10588dafc9069685a746a51219", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386960, "uuid": "a2a45200-5d0a-432e-a0cb-548274e9d32a", "comment": "Malware payload (DCRat)", "value": "b4e783881dd40c1bd50cb73964793da1f9ec298eabdf6c4a3cc47ee9ecb92b25", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386960, "uuid": "d2f1a9d7-de4a-4b2c-a8c2-ef8c5ce6e46b", "comment": "Malware payload (DCRat)", "value": "f0e42083f7cfec6f6d9df7f1232f08a729924d07", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652386960, "uuid": "3b187c5e-7cb5-4e22-9591-49c13559c006", "comment": "Malware payload (DCRat)", "value": "ed17e521de29b1444bbf2624c680fbbca3ec756d48762221726d31a03e2eda501c9fe69b9dda19050ab903bca282db08", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386960, "uuid": "c2dc0201-2854-4e8a-a58d-09f77fde47d4", "value": "T15C759D017E84CE12F0191633C2EF850447F4AC91AAA6E72B7EB9376D55123A37D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386960, "uuid": "e657c247-16df-4e28-b4d6-bb103fecc439", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386960, "uuid": "912b83ac-3d82-4ea4-92e2-e2a6c85c1340", "value": "24576:U2G/nvxW3Ww0tOpvZSguq1b98IuNiqeZNA3UD01GBvuDDFs7iQ0Ha:UbA30O2g91BAAsGBvuPO7tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652386960, "uuid": "697cab55-f9f6-43fb-bc5c-b16bc1504422", "value": 1597090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652386960, "uuid": "91ba0458-2c88-4d5c-affb-3e35e9e3b0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652386960, "uuid": "fc5688b3-edf2-483e-abd1-73ae8afe1012", "value": "00e18e10588dafc9069685a746a51219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b412a0-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652343611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343611, "uuid": "ab3f82b1-b0d9-430c-a2f9-2bec93b014f6", "comment": "Malware payload (AgentTesla)", "value": "83fedc7b2e8e58137285b5df70f66215", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343611, "uuid": "07b2026e-b314-4929-b71b-d840f9244abd", "comment": "Malware payload (AgentTesla)", "value": "b5392efbc51d739297f56abfee8699e58ea304de1e9d1ef55a73b39daa35254f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343611, "uuid": "e86024a8-a10b-4322-a8ff-b4b379aca98c", "comment": "Malware payload (AgentTesla)", "value": "0ce7b48211735cf8cbdcd9ad2e9c6dc5c52c83a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343611, "uuid": "ea0647b3-a8d2-4e64-9fae-f0addafb915e", "comment": "Malware payload (AgentTesla)", "value": "e7790b478065c3b33cb8c6971135e1675ac5db7831136f730d630b9499d7e2581f2d29925068c05fd966d9f6f93a192d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343611, "uuid": "74d240a3-9e22-4d0c-add9-66bc27aa63b1", "value": "T1FAC4120A7293D522D5AC0736CDC0A0DD07746F928C23EB8B6AAA315D9F333D486D2797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343611, "uuid": "473a5b46-fbd2-4402-91f4-e646281e19fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343611, "uuid": "eb45dcc4-17cb-43f5-9632-132e56d31c75", "value": "12288:/oqEOj5sB9KllLeWxFgPn9L1uzx8sGVJ7Qqrenhb:w1YsvTWxFEFrsqenl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343611, "uuid": "7001de2b-fd76-4c6d-bfce-918b57c5e675", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343611, "uuid": "669379ac-8abb-4497-827d-0dee4b5f254b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343611, "uuid": "8fc7532e-f43a-4653-968e-42253b2c1fa1", "value": "ORDER REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25002b45-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338802, "uuid": "acad974d-d26c-406a-bb5a-94bb3a9f23dd", "comment": "Malware payload (Loki)", "value": "16f7a893d3a1e0568764a45f82520600", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338802, "uuid": "a14cb7da-7f1f-471b-8f70-43dfab104a36", "comment": "Malware payload (Loki)", "value": "b54328695a1a3a6f7a95a6451cce229e056342ff7d6d801caf5c5a4dbced87ce", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338802, "uuid": "7969f2fb-0095-4d8f-b737-f860d5692929", "comment": "Malware payload (Loki)", "value": "c8c9fc4cb104ff9d0e8d6c85ca798bac7dd4fd68", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338802, "uuid": "e0555bfb-d3a1-46a4-a7f2-aa00dd53bf6f", "comment": "Malware payload (Loki)", "value": "c62dfc868a5c8aef205317b73adbc2d1a9771c3189e955fed85c50dc9c0ca5c108a03bfff9beda08a922422514374844", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338802, "uuid": "92cac1b1-8520-44f5-a6b6-09bec103a1bf", "value": "T14124129039FDA1ADC17A4370009E98B72A3CDD539025FE605968FD56E03AB70671CB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338802, "uuid": "c7dedb9c-59b5-4071-9494-9e79a3800aad", "value": "6144:QOO3ZvRD/Sc6J67nQn+LIOEddcgQXrhhyPF2f+khUUiH6OC:QOOjSFKEPFddZK1hG2L3o6OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338802, "uuid": "815700c5-00fc-417f-9ce6-56fa10fd0bf3", "value": 213432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338802, "uuid": "0fa060aa-e848-4020-823d-bb44975bed3f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338802, "uuid": "0b935daa-8454-44d8-8e6e-4db19a3ec243", "value": "proforma invioce.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7481348e-d1a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652328627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328627, "uuid": "462b79e6-6867-4922-be05-6288ca7e6685", "comment": "Malware payload (Mirai)", "value": "15fab4cbd295fc49da2bef5c9cd01763", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328627, "uuid": "16c04b0f-f8ec-4b2d-9456-2330ae14d078", "comment": "Malware payload (Mirai)", "value": "b63e841ded736bca23097e91f1f04d44a3f3fdd98878e9ef2a015a09950775c8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328627, "uuid": "e6eb0e35-74be-4a92-96af-ba555492b9a9", "comment": "Malware payload (Mirai)", "value": "5e0a6934762dc1180cae02bcf420525a66d21579", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328627, "uuid": "45b8722f-6a8b-481a-86ab-b8f28fe7731d", "comment": "Malware payload (Mirai)", "value": "8144ba7630e30d9a9958a029ca9e6c11556d0078077433429ea61fd94d7e64a554ad722e8cea9a4ce857d6fb06b42f9d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328627, "uuid": "9df0f956-86cb-4383-a13e-fbe765ccf282", "value": "T1B6A31A2AE18188FCD4B0E170CECFD63297B1F8A5A230A71F7F455A512C4DA684F7E694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328627, "uuid": "2744eef8-777e-4f00-8e59-b9ff4ca864a5", "value": "1536:EYYwLqpOrq2BjUg5UBzG1s5ft2OF42e09u45jEpkmsq:hxrVtUg5UBzG1sFoOm89u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652328627, "uuid": "5be203ce-c6dd-4069-99e9-8694c0e4fa33", "value": 100136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652328627, "uuid": "3676f193-180c-4172-a8e6-729cbaa24cb0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328627, "uuid": "94649e8b-cfbd-45da-b4b3-0cf658f8d601", "value": "enemybotx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb2dd81-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391567, "uuid": "7680e116-e20b-45cd-800c-8bdb8a8c1f3c", "comment": "Malware payload (Heodo)", "value": "61a17b0f7a2bc3005f5bfd5a97614105", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391567, "uuid": "39e7f66b-e66d-4a6b-ab60-46fccc29d85c", "comment": "Malware payload (Heodo)", "value": "b6d1b050d031a164f06690951f7eccd368516ea2345c017891ab6528e238193b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391567, "uuid": "8b920379-c571-4cb2-a960-e8d2c403dd63", "comment": "Malware payload (Heodo)", "value": "4a2adbf14fabe14a8a02173a75b0c710ed2b3f39", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391567, "uuid": "738a42c4-bde3-4ef1-907d-22d583f0a697", "comment": "Malware payload (Heodo)", "value": "329179a2da57e804b573368c62f1e6050b42e8ed20b7ff40a572d3503033efe9535fdc6226544556d2dd13342f4c777b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391567, "uuid": "1cd9d13b-6938-435c-89d3-2625feae442d", "value": "T1D9E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391567, "uuid": "522baad9-b4b8-4658-aad1-eb6d503bbfa2", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391567, "uuid": "1a71ccfe-b203-4be7-bd9f-4141e1aa175c", "value": "6144:mkajLyaPIvW1TFpvzYNB1MIB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8F6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391567, "uuid": "f757f962-afe5-48e2-8c1c-2ed24fa3a938", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391567, "uuid": "d21f518a-1cbf-4e3e-af82-4e02103e302f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391567, "uuid": "3effb879-c50e-4b9d-8478-e635c254fb16", "value": "61a17b0f7a2bc3005f5bfd5a97614105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acea0f88-d1ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652356639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356639, "uuid": "8be5b7d1-4029-4777-afd7-f80c6f469fee", "comment": "Malware payload (Loki)", "value": "bfc3dc4f6cc804cbe44e898639b598a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356639, "uuid": "1e24f162-c3a1-4981-887d-b6d912660dfc", "comment": "Malware payload (Loki)", "value": "b6dd379ab3103cb7e18e3e284d100b7d248bc270a1eebb20189ebec5ec5884e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356639, "uuid": "2eccdc10-0b21-425a-a2a7-8c2117911a2d", "comment": "Malware payload (Loki)", "value": "b9ce3dca1af546364cc719d9263d39869622f064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356639, "uuid": "100de505-d45b-4087-8d99-d6c9622b69c9", "comment": "Malware payload (Loki)", "value": "47b6e12d7786beff1027e1d36116e07a2d7e45e892d9c332015e7a2a1a0a54eb1fae0613353a86c6a2c9c6c12c07995c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356639, "uuid": "649d1820-b416-4304-a89c-0ee2dfb5721a", "value": "T1D62412617370C437EDE25B72EC3EEB574AE9E12200A1E74B43402B9A7D2A581A75F380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356639, "uuid": "c46c96a3-cdbf-4397-8f3c-5ca03e7a0be6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356639, "uuid": "26a88309-9793-4dac-b479-f1807a6bf3a1", "value": "3072:LODZGPEounbRKWbZvDFzEMS5hb7CCJLHJRBF4r48HzJZ8A4hRu9t1JUX/IrPor3Z:LOtIOciRDF25RdJLvBM4izJZ8l+PO84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356639, "uuid": "7f52dbeb-e032-4fd2-b90b-4418e447b5ee", "value": 212645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356639, "uuid": "18046135-e615-4dca-819a-1a84eb329ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356639, "uuid": "61185d05-ef5b-40c9-8f0a-8b84108992ef", "value": "SWIFT 00654322 05.12.22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62447f68-d1a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652326449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326449, "uuid": "9725e7c4-00df-433f-84dc-c62eaa7f2ae7", "comment": "Malware payload (BumbleBee)", "value": "302a1af6b3c050783ffe33cdf321627b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326449, "uuid": "ccb156fc-69a9-42c3-8742-92a9a2dfc320", "comment": "Malware payload (BumbleBee)", "value": "b721c0639b89437de7bedaba753502d04acdebaa4f80f96f7b0c32289854d9c2", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326449, "uuid": "801f416f-2cb0-4a39-82bc-f8e25494eb19", "comment": "Malware payload (BumbleBee)", "value": "ee527e5bd777b200199039f06a38fde6e74ae1da", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326449, "uuid": "c3607729-ca4d-4dc0-b68b-16b59659cfea", "comment": "Malware payload (BumbleBee)", "value": "533826ab65bd63cc292d8962f39d10ac414248c81d511c4ffaa2c43cd3df9047b639086cfc12e14d1c54de3e8e621230", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326449, "uuid": "0d546513-3436-4e24-a2bb-cb875ec56f47", "value": "T18C35C077F7A56B44AC0198F6CB0EC3A3E886F29D0F015291E5ECCF75B2248678A5D252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326449, "uuid": "30dbc640-c4ba-477c-8ab3-b7a636371ea5", "value": "1c7b6c7274dd9098212ba0c39c34e95b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326449, "uuid": "c28a05fc-6e9b-44a7-8984-c4dd628ce1a5", "value": "12288:diA7AudUwpc4ia1+vM5Yv1vZ/1ySKbpZV9P3ELifhF9SCIiT2:diA7djy0AjYt1lTfhF8iT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652326449, "uuid": "506568b6-d3e8-46c1-974e-543674dbe1d3", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652326449, "uuid": "95384720-de27-4674-8665-781ad1519a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326449, "uuid": "4cb9ec67-d991-4459-8940-01d717b8479d", "value": "astra.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcce18ad-d245-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652395804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395804, "uuid": "7887439a-1776-43bd-b600-7873739b10fe", "comment": "Malware payload", "value": "f1e2b735ca13627bd28c46b9eb5075e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395804, "uuid": "d71da6f7-fa6b-4dbe-b7a7-1be941fbf9ce", "comment": "Malware payload", "value": "b76c321a35f2c5b59861d3abc2875fb69eb88b1d43dd8188d5a617434e749f48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395804, "uuid": "f2469c1b-3654-4f35-ba47-6b35f60a4a46", "comment": "Malware payload", "value": "98d09362911ae13e27f1cc3ee6a49a03a2f40c84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652395804, "uuid": "01ed6b3a-d8d0-4c98-8474-375789d4c4c0", "comment": "Malware payload", "value": "5f59b97cb8c988fdd0ea56d73026bd242d8c7788c85176d60aa7504c54d7d6613ef3b1ead5542f489bd4873b3ce49824", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395804, "uuid": "8b7c44ac-8246-40ef-9362-4fb5ee16d581", "value": "T177042A469A419B13C1D32B76FADF824133239774E3E733065928ABB43F8369E4E66605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395804, "uuid": "04d32c8b-c206-4c9d-b50c-11ce589d7eaa", "value": "3072:vSLsIQ0Ae+J5ktPcaSHg9JKx8f8B8VZ76ARtiMnSsbnM/9KhiJmDEw5vpcoNY:vS6rPItPcaSHg9Ju8f8Y76ARLnSsbM/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652395804, "uuid": "bccd5680-7fd5-4233-874a-ab0f76236be4", "value": 182429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652395804, "uuid": "3b9e852e-8dc1-4c0c-87b1-a81678fec6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652395804, "uuid": "42063f05-3258-4c95-9b37-9cf0d472651c", "value": "percarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6effe0-d21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652376984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376984, "uuid": "89161dff-a821-4bcc-835f-419b44ed2b7e", "comment": "Malware payload (Gafgyt)", "value": "e50bbb52f34cff50fba58967deb7f98e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376984, "uuid": "b8339500-9414-4595-b761-3ce2ddbdfc17", "comment": "Malware payload (Gafgyt)", "value": "b76efee0ece1e96267eeebd801ab8918ee62e5c8aa70a5ad034e59d6cc7772ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376984, "uuid": "00994796-564e-43da-a5f1-521993dc6af5", "comment": "Malware payload (Gafgyt)", "value": "ab44c5e60cb120722f7bd16b012df32b369be6f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376984, "uuid": "e148f8b2-9f81-4c7d-b366-36b79397d108", "comment": "Malware payload (Gafgyt)", "value": "688407af8253e8be0be6380db797446ddda95106b0846c979145250a6de6cf3f6dac75c443d7c2601f451f15ab9c7f84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376984, "uuid": "b948daaa-0686-4478-bc60-7aaa8ca1e3ac", "value": "T1E7F32A08EA408B57C1E2277AEB8F424D33339B9463DB33155938EBF43BC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376984, "uuid": "7c5737c2-1caf-418b-9710-16b91e646cf0", "value": "3072:xuiBDd7WFTPz0/QaxEavVVGaanqI0jM/9tvtZmJwfBxpQodn:xuiBZ7WFTr0/nxEaHnanq9M/9JmJwfBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376984, "uuid": "e2ed0211-edca-4f4b-a2ed-a0c2bcaaa474", "value": 166290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376984, "uuid": "15e3b7a5-bd45-4d66-b246-8c5fbb1ab50b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376984, "uuid": "0efedfae-fbe0-47ba-ace8-6277d71ca6d0", "value": "e50bbb52f34cff50fba58967deb7f98e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af09d244-d22d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652385419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385419, "uuid": "62c31097-2ee5-4543-8756-e51816aa9d25", "comment": "Malware payload", "value": "fc48281921537737b4e8f6a13e234c6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385419, "uuid": "45e3ea1b-bc9b-4ad8-a83a-b13b925bf02e", "comment": "Malware payload", "value": "b7dfe331c6260d43efacb7ca54ce480d64c832209d4c013371d76590bedc0ba4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385419, "uuid": "2b76fb0e-5140-42c1-b2f6-7a38d06379f1", "comment": "Malware payload", "value": "49572865abff97bafc25256452b2e2e3c692dc5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385419, "uuid": "d46db30a-265c-4d3b-8dba-699105f8f334", "comment": "Malware payload", "value": "64ba2542bd206669de3038d7a34876635181a3782d9174513ba2cd0b7d1ac931f8a0dcc0336ea71daf270cb00cba038f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385419, "uuid": "a1692e83-c434-4c8c-a7b9-fc5139e5d955", "value": "T161F30110336DD9E3E4F70B311F3A5A0FABB9662515B98B0727046F0E7E667809D0DB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385419, "uuid": "11a6cf21-3e20-4b33-8398-2e32ea3c4f66", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385419, "uuid": "edb10d22-40cc-4cd1-899e-e10c52145e86", "value": "3072:l1NjcVVnLpPunbEpXYrvIjopZGnfK98w0pGDa7y52RP4m/kbRpElefXtEx3G2oj:HNeZmQVU2ny97Doy5Xm8bRqGXtEFG2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652385419, "uuid": "b672001c-0b86-4206-8572-ba96ced8f650", "value": 162202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652385419, "uuid": "1c48b1fc-50d5-4159-b155-1d5468216604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385419, "uuid": "8636bcb8-7622-4dd9-b7b3-655b1bd413ef", "value": "fc48281921537737b4e8f6a13e234c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a172c730-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652338581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338581, "uuid": "229332d2-9f91-440e-badc-7e29ecc232e6", "comment": "Malware payload (AgentTesla)", "value": "0480f7696b7e34c8e35e91386c3f046d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338581, "uuid": "8e2338c8-9d91-40cb-9c9a-c3228de1c6d3", "comment": "Malware payload (AgentTesla)", "value": "b8219d6cca34bdd189f058ce67bdb50ffdc4f37b4c77570bb27b230d017c9494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338581, "uuid": "dfeb5087-9c75-4b5c-b864-88f5764812b7", "comment": "Malware payload (AgentTesla)", "value": "9f4772b41674dfd7f5d5d46bdcf3965ccac6a342", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338581, "uuid": "f3707c34-3dab-4ae7-9078-a95ba093c33e", "comment": "Malware payload (AgentTesla)", "value": "9cc2968ad09c8506ba3c45b4d9bdc73eb7894d56508da4f27e6fb39a226781697a34ce1ae0a64b8e25d47a01e46667b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338581, "uuid": "b7f4eb9e-5639-4486-ab08-54dea870cc8d", "value": "T17404025AF71CC59DD622DB386052D51F007FDF1DDA3E8226985837AE53727820CACAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338581, "uuid": "8030b4b5-2998-400e-8f1f-9cf8ede64e35", "value": "3072:vepC/YshxPdTnB049iJc7gBkaFf7AMVlSAZzgt/R17IFOY9xePmzjaKCOD8G4SuR:KLsL/nAeEBk8f7flfmt/RBIFtHgmvfIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338581, "uuid": "4052dce9-db4b-438d-950e-c2a9af6ae74d", "value": 188072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338581, "uuid": "ea9efe95-b74c-4b78-bb26-536371fe0810", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338581, "uuid": "a534c513-7de5-4b5a-8e36-382127a6ccb4", "value": "43127-20220512.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a096ec-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652346878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346878, "uuid": "fedeab36-a18d-4a71-bb0c-f8e8439d2a81", "comment": "Malware payload (Formbook)", "value": "dd39c893cd30479da89bddd36b0c198d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346878, "uuid": "6d3ac7dd-8709-46e0-b882-808293686c25", "comment": "Malware payload (Formbook)", "value": "b8d8a8ab682956d7abd31c4fa49690ece5f9349ea7753e83243ef5a933df4684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346878, "uuid": "4ddca201-0548-4f48-b4dd-7bbe1e64aedf", "comment": "Malware payload (Formbook)", "value": "9c5414dc87b86ad12e5700fd084fdec97fe07028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346878, "uuid": "a585bd38-66b1-44d6-8350-96439e1a03ec", "comment": "Malware payload (Formbook)", "value": "15b3774ceea53a70ad499c9360d9319072c4362eba85754bbff199cbaa6665d674bac2a39736cdaf732ca20473502fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346878, "uuid": "dceab21d-c03a-4697-a615-0dc0502d30e4", "value": "T17CB41229B32BB633C46C8B72CDCA90CC1B755F275D13DB2B1DA6315D6A33B92099160B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346878, "uuid": "2ba64ae2-f608-46ea-bcba-b15e2659aabf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346878, "uuid": "12488469-9b95-4619-baa5-64379d72cce9", "value": "12288:cOPJUOTdcZppuwcuX/eoPzoPNMxrAeTz5tfknI6H7WW74LCc:cEisdhIPz66xVenI6H7EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346878, "uuid": "801ef0b9-ef51-4d0b-aecd-56a157f13c82", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346878, "uuid": "0f732465-8bb7-4f40-9c1a-ca280b07e160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346878, "uuid": "e11ca116-b830-40c4-ae6e-7d524fff7572", "value": "Swift_USD25,511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9378714f-d1d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652349295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349295, "uuid": "27ead937-dd79-4bb4-8d4c-70a35b71494a", "comment": "Malware payload (Heodo)", "value": "03e61dcc9fcf16fd242c2807243d334b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349295, "uuid": "0d2fca7c-a895-4942-a67d-cef8f3d738a4", "comment": "Malware payload (Heodo)", "value": "b8d96391f31d5d00f94cfff1064841ad9b5209bb3ca7a845383dc31383b4b662", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349295, "uuid": "cb3ddde2-82d1-4f4d-835f-e02508e61ec5", "comment": "Malware payload (Heodo)", "value": "44bce58c52f54b9635bc6eb2d330270a12e03bfd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349295, "uuid": "5008ffe0-928c-4f68-a705-2a20efb60971", "comment": "Malware payload (Heodo)", "value": "f1c4f38b7352160b3b3c4e54f1853103e2d7b228946dc23708c183f1612f25aa22126a537059161cfb94f41b101af524", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349295, "uuid": "a7d76d3d-cbbc-405b-b11a-efb7bc27cba4", "value": "T19DF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349295, "uuid": "7c601e55-0d95-4b8a-bc0f-d2f0a2333938", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349295, "uuid": "6f5ddf1e-42e8-4bc2-a0b3-49094c2ba8b4", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSrjNwgraKRT61cKGNx:S4DzZKnH4WRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349295, "uuid": "35864ce4-16e2-405a-891b-f845ad76753e", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349295, "uuid": "76ae0e31-f377-4cbb-b1a4-64e704d4e789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349295, "uuid": "a3b66b8b-5c4d-4075-94da-62f5e404c918", "value": "03e61dcc9fcf16fd242c2807243d334b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5092a8-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652379589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379589, "uuid": "53399aa9-8db1-4913-9cb8-214dc7393d03", "comment": "Malware payload (RemcosRAT)", "value": "33e3a1e631a1ce0212ff0a0b33a82a0e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379589, "uuid": "45fe888e-7aca-4f24-9d18-223c9a8d059e", "comment": "Malware payload (RemcosRAT)", "value": "b936687e404fa454f7c61e9ee653d87ff07b973cbe4827fef25b8d4df3ca1a19", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379589, "uuid": "1dc28da0-0fa0-4b03-91b1-26878bd2c440", "comment": "Malware payload (RemcosRAT)", "value": "de46a7780d5f77113a88c7483ac2afdc85613c2a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379589, "uuid": "52666cd7-81aa-41e7-b185-eb8bdffe26fa", "comment": "Malware payload (RemcosRAT)", "value": "d55c58f100b3696bdc535bc7b260759061594acf070a39b90074f01cdf13c7fcac606b1d6927e3ebe0848c707bd7b1c3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379589, "uuid": "7e16f273-2132-467c-9bd1-8e48b0b9399f", "value": "T1FD51444F348FB565263719B3DC2B045EB6224792A5B90590BB0DD6DBCD3443CA389E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379589, "uuid": "ea9e487b-35a3-411f-b431-019a65ea2a9a", "value": "48:gP20qTUotB0eBKnxfPTv/wPdJhJ4JV1rSLM0DU2c7JAWVSk8RVlo0BdBpVlPMv/:RTUEZEfbvGDJ4H1rSgsO3okoVu0Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379589, "uuid": "b8ed7fdf-176d-4507-a14b-1e438b517d42", "value": 2930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379589, "uuid": "702663c3-8714-463f-8550-fdc3995771b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379589, "uuid": "4feaedcc-da98-40d9-8866-02e5f9c3f85e", "value": "doc_8646626921-81609948075.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1466389a-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363685, "uuid": "0798ed4e-88a1-44fd-97dd-85b17f3a62a9", "comment": "Malware payload", "value": "f988c74ed94c66ffca5e061d2ffa6baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363685, "uuid": "5480bf3c-cf24-4442-843f-4adeb12abb44", "comment": "Malware payload", "value": "b961aba09f121305df8b50e8883e7a6aa812d5d09527d0e4e0582c9b2767488b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363685, "uuid": "e2fdae05-55ff-459e-b926-1b9f60bc9db5", "comment": "Malware payload", "value": "a413434cf5be08be04d7de822287d371d34a3fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363685, "uuid": "43260776-e2fe-4b7e-8231-d22bee005df2", "comment": "Malware payload", "value": "0a60acb71f1f7ee0a4099b15ae8db596134cb1b3570008efa0ea96bd335ebf1bb7af69f3375cc6eb5ae6214cf5ec4dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363685, "uuid": "bd8b4172-51cf-4133-aee7-5086821f96ca", "value": "T16B32191A77C44A30E9BE4B790EB287248377FB950812EB5E1CDC095D4CB26C64A61FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363685, "uuid": "c425a349-528c-48d5-91cf-b95148568379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363685, "uuid": "4b654493-8d78-4755-8c7d-1855b4b23b27", "value": "192:u0m694qNHxdyWunGGAKmrD97iMhHTW44k6:xByWuGGVEDBLh6Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363685, "uuid": "acdff62f-b234-4df8-bcfb-6715c78e5cb0", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363685, "uuid": "d67c943a-85a3-4563-8df6-4e803713a01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363685, "uuid": "99890e0c-75fd-448e-93e0-2d0f7e908093", "value": "b961aba09f121305df8b50e8883e7a6aa812d5d09527d0e4e0582c9b2767488b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39524f26-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330246, "uuid": "8d6248da-6bdd-4991-b3d7-2cd79723589b", "comment": "Malware payload (Mirai)", "value": "a77db77e4ff398c42d2a157db9ca173e", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330246, "uuid": "f771eda6-d5c6-434f-a8f1-87e2008c0d2a", "comment": "Malware payload (Mirai)", "value": "b989961f622338657aa538f833e4928520e3bacb792965ebc7088d3bb1faeb78", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330246, "uuid": "1fc7d1b7-50c4-4db1-9e5b-a3fb11a505b2", "comment": "Malware payload (Mirai)", "value": "fda93933ba53fe33e0cd7273236cfddeb62b700f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330246, "uuid": "2924fa04-01d6-4ecd-a76a-7c63988f9b55", "comment": "Malware payload (Mirai)", "value": "2bcf782b7bf9bf043cf5061784e4aea569c5b892a32d816e33af532acf13c55b6641f6280fd711bfe2b8c08641337048", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330246, "uuid": "640cad00-30e1-49f6-bfb6-f0a37c3912c7", "value": "T11E938EC1C783E8B2E93311B122B7E735D936D57A2151E813EB6D0A71DC65A10EB1A3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330246, "uuid": "ccf55d47-8b54-4b01-a96c-2478b6ec03f7", "value": "1536:KyMi0v6RFwNdNMsWiq7fKUDLq1OAVI39i7apjKqsB2zG03UEpjbW:Si0vcc/W7fF+1OAhapjts0ScbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330246, "uuid": "f08afd46-a4f5-42cf-a6af-9855c69f8ec7", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330246, "uuid": "f07137c9-caf6-4eb0-9c7e-3042e9e53730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330246, "uuid": "8e19b26f-8c26-4529-983b-2dcdabe73c24", "value": "enemyboti586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ad0a6d-d1ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652330241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330241, "uuid": "c4fc1510-99fa-4ef2-b0e9-55ffe3aa6096", "comment": "Malware payload (Mirai)", "value": "95cb523dd81dfde6a1351f6ed478599e", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330241, "uuid": "efdf828b-3d96-4362-95cd-39c0787cdc39", "comment": "Malware payload (Mirai)", "value": "ba13a185a59bf30ba4f2819d261862a8ac386f8c4a92d648c5892120ecb69e6e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330241, "uuid": "9db9c547-be42-4227-8c20-9c14e2c38975", "comment": "Malware payload (Mirai)", "value": "586780f3467c52eb8da918f9c5d60bacddb66309", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330241, "uuid": "7756998e-b397-441a-b61b-bf5a032a839f", "comment": "Malware payload (Mirai)", "value": "511b8d3afaa61d4fd91bb01390748287cbcf80667b3f4d6f99b09b45ccc3cdc3cfdb4bb63291d54c0cc0cb5db8330832", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Enemybot", "colour": "#36C172", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330241, "uuid": "59eea57b-46f0-46e6-a11b-469a87d7cd0e", "value": "T1D1F3C60ABB609DF7D85EDE3345F98B0125CDB09221A83B3B3674C62CB55B54B49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330241, "uuid": "94ae72e8-aa26-4b0c-81f4-fe92f087047a", "value": "1536:HSOa77Fzt0/zuHtByJVrb4lEgJ8JPNLxB+NSLX9zf836D4FFZAKK7/um4tE9921h:1a7ImuLqENJzf8ZFlW6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330241, "uuid": "a364d44c-eab9-408c-ab12-71f1b655d7fc", "value": 159404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330241, "uuid": "43eac545-8453-4bdc-8a06-0d021357de4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330241, "uuid": "76a17007-5926-4557-8689-b7eb5fe286aa", "value": "enemybotmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0e74a1-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652345717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345717, "uuid": "a760a122-825b-4098-927a-3320060a257c", "comment": "Malware payload (AsyncRAT)", "value": "769139ef629d1b43120a9babef8e0c7c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345717, "uuid": "dc16c34a-ad79-4aaa-94a9-776aa3e6b129", "comment": "Malware payload (AsyncRAT)", "value": "ba4d8286d9dcee67e0aba930ef0ba854cefd7a557f2ec32e630a056b7afaf099", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345717, "uuid": "77a53cdf-02fb-4084-ac98-fa846b209e9d", "comment": "Malware payload (AsyncRAT)", "value": "751e910d12e34374a32b8c58d042f34ca044cbb4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345717, "uuid": "b62e6d82-0a26-4334-b7b5-ae16c4195e1a", "comment": "Malware payload (AsyncRAT)", "value": "4e089d69e80c90a5f7b503a0625f610ef4b315ef38f6e57ee8fec4e4fa5cd3480ee5f85af75edc2739a794e97ac06cda", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345717, "uuid": "ddd37f39-a308-487a-8f12-0915e6f252fa", "value": "T184310345A92282FA4F43CCC9838BA9E09921843BB5B7511D63ACC36A8D37D31712D5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345717, "uuid": "48d033c0-fb3f-446a-a527-96996653708b", "value": "48:k0E20pmY6XAj8C6XAtx/HdGvh+AB1NYFyNuFk:keRo8ZjBX5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345717, "uuid": "00d64a25-e2a3-43bf-84e5-d3014c11a2c7", "value": 1698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345717, "uuid": "ee7465ec-e30b-4bdf-b93c-1945e962ea51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345717, "uuid": "17abd62e-4caf-4679-a8ef-4e26c9e22d8f", "value": "751e910d12e34374a32b8c58d042f34ca044cbb4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a58b23-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338672, "uuid": "6caaffea-3641-48ce-b831-d53d3be525eb", "comment": "Malware payload (Formbook)", "value": "2ebb04981bfce0451b2094add6a057ae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338672, "uuid": "1f3db426-5627-4645-8f49-f23106410129", "comment": "Malware payload (Formbook)", "value": "ba6277e93931c248ca04c76ceda265224a377bdd4f9f8a97c5ac1a74610f34a7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338672, "uuid": "d9b838b5-7787-4146-b468-28bf5bf10781", "comment": "Malware payload (Formbook)", "value": "76e7d4ddf4bee7d24822ea2a05af2ba21a675ef4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338672, "uuid": "d28e335e-97b5-40e7-a986-66660cc29f4d", "comment": "Malware payload (Formbook)", "value": "5305cbff6421bf46bd3c414e43b6edcf0f5663c8493ad536edf1cdb4d97717eaf1540a907a5c74c315f014c141fd178c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338672, "uuid": "4d8ea9df-a92c-4719-a3a8-b81cc67a07f9", "value": "T13C0412371BAA8DD8E5B1D7B46CE99268A352DE75C600A7F267C677CC08B85050033EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338672, "uuid": "f5fd69c1-8ff3-458d-84ff-62e881117aa7", "value": "3072:q35NAeD/+I17NpdtZGWahY09lGRj5Ptjlsm3Z+0S6U2wtjjaJbIVr7GAMjrAh9lU:Qb+IJdvIloV51hsbewtjJVrykh9lA84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338672, "uuid": "9b20ad55-9fdf-4156-8fbd-48daa0dc4919", "value": 188104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338672, "uuid": "2b2bde2d-6edb-487d-8803-d0a7c9f0eacd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338672, "uuid": "e9f4f89e-1d8c-45f8-8f2b-e3a3395adc1c", "value": "RQ_C1510.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b2e8b8-d1d7-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652348312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348312, "uuid": "bf0dc8f6-c699-4eb4-92d2-b7529c124003", "comment": "Malware payload (NanoCore)", "value": "aaaf781ed476d1643899707e91895c77", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348312, "uuid": "83eaf2ea-02be-4dc0-acb6-cc49c5e6f1dc", "comment": "Malware payload (NanoCore)", "value": "ba94309be784e35da69f84051c674a914594645e9d0cf42508408cb033b14e55", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348312, "uuid": "7793b4e1-5ee6-49b7-85b1-51a6413b3ef4", "comment": "Malware payload (NanoCore)", "value": "791eb956d0e69cd90ff790957e3af4b6b4752b43", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348312, "uuid": "14999bf7-a1b7-4a9f-ab68-a5cbc52925af", "comment": "Malware payload (NanoCore)", "value": "7c93070db73cc6e0488fb3ef849975cfbdb62a921fe6b030d257548b0b07f09507aebe30ab0df9cb016e68d37c772f5b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348312, "uuid": "cf2c2250-9740-4513-a3ca-d52a37c83f89", "value": "T18AB4237C05EE566FB05BAC95B8F38D5A1E8093353AC55A09C0D63E128B9775CCCABB0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348312, "uuid": "dad47a73-7b10-4773-a187-090f0b455c77", "value": "12288:wZzTVeMEzm/miFUyv7BfxS/d3jeRgCkurxY:wZH0MUAtiyvtfEV3jeR6u1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348312, "uuid": "551bd399-3657-45a4-81ac-151c7f96f09c", "value": 519841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348312, "uuid": "5f17c178-32bb-4e15-99e2-7898cb348c09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348312, "uuid": "8f078e50-5ce8-4e3c-a8e1-fdacb71d5b7b", "value": "MARIAM HONAINE'S CV.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2ae9d0-d21e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379052, "uuid": "e57058de-9b2a-402a-bf38-931943980a5c", "comment": "Malware payload", "value": "30b97dbc07b7bf42db6e71a2d8204658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379052, "uuid": "f61ffbfb-e38e-42f1-939b-4002f1af678e", "comment": "Malware payload", "value": "bac61f7cb03230e4346564c97f3c682e858ec3b50307aae562677bcbab93614e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379052, "uuid": "1d8cc38e-ed30-4052-b4cf-86e916cf1656", "comment": "Malware payload", "value": "e3f689d48358bc081b94d5ec55c6b04f2dc8864b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379052, "uuid": "70fb652d-b118-410a-a1cf-b18e049e99d7", "comment": "Malware payload", "value": "af59f231bed706c8b950f11bc850717b19db825239c7c7688ce15238581911520cf11efa352978309f2f29893fb96259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379052, "uuid": "8b653273-7a62-42d6-a396-9c3ed02c2fa2", "value": "T1F494AE10BB50D035F5B625F4897AC2697A3EBEE15B1451CB62E43AED9B356E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379052, "uuid": "15d50b27-2b4c-416c-a3b5-8ec729cf3994", "value": "8e2ab8a1912a9d8e58f338a0e4e577f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379052, "uuid": "5f76214d-c9a0-4bed-b61f-d0cf65c11dcc", "value": "6144:mUHdKodVGFQd930CX/iM7PrDoBrEZuxnqCg9eOVWpyP70Vo:THdwFQHkCviMLrOr5nqCQedpyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379052, "uuid": "6c845b12-928a-451d-91b6-44d557d4acc7", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379052, "uuid": "34eb7b69-9f79-48d7-a3d7-abf91144b56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379052, "uuid": "ea57f820-385d-42fa-9436-a403152edd12", "value": "30b97dbc07b7bf42db6e71a2d8204658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdd9265-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652374173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374173, "uuid": "da9a6500-04a0-45ce-a592-6ee2312807f6", "comment": "Malware payload (SnakeKeylogger)", "value": "9d5209b83ad00df77a91cd644703dee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374173, "uuid": "f6ce4d1e-ccb5-4086-b816-c30555e04a0b", "comment": "Malware payload (SnakeKeylogger)", "value": "bb4f7d3a9298be01478faf46a5fce96e1cde0833f7f1071f1461b64c8c5bff76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374173, "uuid": "37500765-841f-4f0e-8fed-6c4be84295ba", "comment": "Malware payload (SnakeKeylogger)", "value": "7527a3e1d9cad7d0323ee4016f043b787ee23bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374173, "uuid": "ff2bc839-70cd-48a2-8901-ca8b5040084a", "comment": "Malware payload (SnakeKeylogger)", "value": "dda10e262218275c853fbe4dd94f05eb11ea6ef2a7fba8da0eb069642363fd377a80a09e94df10803f1c1c5bac104785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374173, "uuid": "2a430200-36f1-4cd0-8ccc-eb0ab73ba872", "value": "T10C64231855E4E637FE926333DD3BEF2A8B551C512AE3821F03047929BD9B540C69F3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374173, "uuid": "25d002cd-7967-4b49-b426-8247bfc6888f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374173, "uuid": "74c5ee76-e103-4bd8-b68d-a0654237abbf", "value": "6144:LOtIObOXvclhYUtoxnNw+4KRMeFScgHmjDos5r7HB:LOLscnj24MAcgGjDoQ7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374173, "uuid": "8f567ae1-75d3-429b-b61e-925216f49e1c", "value": 307791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374173, "uuid": "aca21d4e-47e2-4be2-b07c-f65aff2a0c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374173, "uuid": "b6388328-0cb8-4d93-8550-7fe6cc1db014", "value": "SecuriteInfo.com.Variant.Jaik.72878.30365.23515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284e2815-d1f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652362859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362859, "uuid": "f778bc0b-3683-4a9d-8a05-9e6a73cebdcd", "comment": "Malware payload (Heodo)", "value": "271cae23a42b9b6d092774dae5025c96", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362859, "uuid": "0fdcc870-c9da-432f-801c-b0949d727b5a", "comment": "Malware payload (Heodo)", "value": "bbcf8e124b48890c736e8424b576d15f95bae45561379f7bfae98290d61a2111", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362859, "uuid": "a66dac42-9a23-49e7-a36f-044315e46866", "comment": "Malware payload (Heodo)", "value": "c4f74428029bbe4fd1347b33fa736fa8f4db21f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362859, "uuid": "1c0cadfe-6e5b-4277-8de8-80d5cd32d08b", "comment": "Malware payload (Heodo)", "value": "99cbb53cdace095cc976f5065d77403d13d625d82b342e934331360740e7b0ce1b3afe59f452c00635cef1bbb4980f00", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362859, "uuid": "de64ba0c-87dc-4c8b-a0d3-aa614bb2bc8d", "value": "T120150156B7A900F9F1B3E13888A21A05E37278558B729BDF0360063F4FB66D09E79771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362859, "uuid": "3c5acd70-cd44-41e5-8844-7c56a4464e4f", "value": "7d19699275e08b389d5869dc7132efbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362859, "uuid": "fd5ce26a-d82b-4922-bb0e-01ea9f617e43", "value": "24576:VHhJXP1/7nswyFTkNdPSmfp7iDyaf2ptv:lhJX9YFTkN1zfpmOE2Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362859, "uuid": "d1587e24-2692-4407-84d5-0d1f431297b2", "value": 876283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362859, "uuid": "6871a049-d7b4-40bd-bfaf-fd9766d59682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362859, "uuid": "bda2c721-d50b-4b23-b2d7-2bfb480706d4", "value": "snake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edd7b7d-d20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652370333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370333, "uuid": "d86f5ca7-62a0-4c66-8a81-f5b97a42720e", "comment": "Malware payload (Formbook)", "value": "934f30b216d669f1fb9a6ddb99bff478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370333, "uuid": "0cfd0901-363d-406b-a21e-4e1c0cd7ba32", "comment": "Malware payload (Formbook)", "value": "bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370333, "uuid": "eb64b3c2-e6e8-4469-9668-320d2e3faaca", "comment": "Malware payload (Formbook)", "value": "da1fffadb5cfcc43dc66c6eefa3d1dc7e90e4187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370333, "uuid": "6846e50d-8f74-4c1f-9f18-94017014a524", "comment": "Malware payload (Formbook)", "value": "785604a7104d250b61b66f4e1be4c17bfedfa4086d0911c3f33d34389a58fec7f46709b4add09a1fe2eaba64db6580f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370333, "uuid": "53d41a02-43e0-48f8-ac7a-616cd8ebb811", "value": "T17ED4925C7B414A72EC5D81386C130A157B521F332B8AFAD6279B3DDA87EF1E91C05C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370333, "uuid": "e425ce05-355c-446d-8dd0-b5f35a3ad509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370333, "uuid": "3b769513-4520-439c-803f-64e70bb52cde", "value": "12288:TLQy3EL5Q9OPdNxwrnDFnOF8IbhpaU0/jclCV3Li09zDT:TstN1NxwrnoZbhpaUun3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652370333, "uuid": "31596099-63aa-4e0a-a86d-7a0346bb7f70", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652370333, "uuid": "938dc261-5555-4915-b87b-0a05310d2309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370333, "uuid": "42e2cb3b-f491-4ce5-8cd8-691d246c11cd", "value": "Nuovo ordine _WJO-002_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d8c249-d1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652347682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347682, "uuid": "03215754-9c5a-47c4-b76c-14cb099d0656", "comment": "Malware payload (Heodo)", "value": "bf1a84bcee85983c92040cc52a43dd17", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347682, "uuid": "1894d6d6-5ff1-4a63-a880-3e68e3116b6a", "comment": "Malware payload (Heodo)", "value": "bcb53af88c2eb7a3e04c8874854a6c4fc0a2b9890ed39cc4bc9c1f7ef6380563", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347682, "uuid": "4475865f-3d3c-43b6-b3b0-8069e613ba88", "comment": "Malware payload (Heodo)", "value": "eedb1bbdc50095d087ac9fd3eb0e4695217c6d0d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347682, "uuid": "a3538475-6400-418e-925d-fbf7dae67c06", "comment": "Malware payload (Heodo)", "value": "f80a70051ca79bd65585dff9c941f04dfa125cc3075f3974f72e4f225ad26c7237cde172f5e5fbb66517f8a504994c19", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347682, "uuid": "735d1c03-f2f9-41af-90ff-b7b476ef419c", "value": "T1E103834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347682, "uuid": "65f02d02-379c-4aed-81ee-cdfc00590ac8", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347682, "uuid": "280cff68-033e-479b-a3f7-07e53f5cb5f8", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347682, "uuid": "2fd4c109-bab5-482d-9b5b-7c0b7ecc5963", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347682, "uuid": "f16e2286-031f-4133-98cf-44210fa17c1c", "value": "Documento.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2929244d-d1cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652343963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343963, "uuid": "9519e2e1-b4d6-4335-a904-efa9f605e299", "comment": "Malware payload (Heodo)", "value": "81003dc1bc45238879525fc64de961f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343963, "uuid": "b9cdcc95-0d06-4d28-86ba-618d2e1f5334", "comment": "Malware payload (Heodo)", "value": "bd1dba9f3918ad0d7725a51196b0972eda0aed6fcdd5852467d29093c366404a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343963, "uuid": "d1ed968a-aec5-4201-9724-3eae43281bea", "comment": "Malware payload (Heodo)", "value": "ed0b9d61ee564efa49dc3358de94d2f079c08b11", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343963, "uuid": "8cb30ec2-5804-440f-8496-5e9fb0cb5717", "comment": "Malware payload (Heodo)", "value": "e0c02ed95542a2c6461700870b07ea82ce0e76423933d4bad371c992157dd9530f4b010573e8441e1dfeeea47f3259f3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343963, "uuid": "edac9cf0-e7a1-4bc4-a521-73f5d09eefe7", "value": "T129F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343963, "uuid": "fa6e8362-79a5-4b66-83ed-b021ba0a0792", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343963, "uuid": "daeb5fd5-6478-48c0-ac4c-3e8f65a6c38c", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSDjNwgraKRT61cKGNx:S4DzZKnH4SRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343963, "uuid": "c231bff6-c995-41b6-85d0-328ebeb974c6", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343963, "uuid": "086bec50-c456-4bf0-930f-a9be968630e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343963, "uuid": "b080def7-1402-4598-a426-9f2293e1177d", "value": "81003dc1bc45238879525fc64de961f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5972f649-d1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652344903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344903, "uuid": "ece1cda2-1c43-4dda-9ba6-50a8c8e40184", "comment": "Malware payload", "value": "bba9ae47e0132cb26c43a8ee80abd0ef", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344903, "uuid": "772d03a2-7727-4e84-87d1-8e0f92a2804f", "comment": "Malware payload", "value": "bd219efe7e54194ff3cd5a9da2a5c431b7021dea2309f9c4c4796d81d2438ecd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344903, "uuid": "c841a2f1-0e65-4bab-be9e-bf38400d83d8", "comment": "Malware payload", "value": "e3f8aa5e30ce625cd0d393b708533c49787a176a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344903, "uuid": "29d67462-ba99-464a-b559-0cb6a110ccee", "comment": "Malware payload", "value": "6496258990e12e659e865faf61e2374dbc17aeaa118005357ef82fea7d566a497dca30e8bd148030083efebbd2b632a6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344903, "uuid": "c5e8bc16-48a7-4996-af60-36a262d0c92f", "value": "T174C5E021759AC637D47E41B0252DCA7B51797EB00BB284EB63C82E3E19B18C15372FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344903, "uuid": "207722d0-82c0-49ab-8191-c1a05fae3e56", "value": "49152:dM5NitjVqoA9AoxDOjSETeVfb/6LYmM5D0VNq094tQr3Hyfp/tPsrii+qCJph1s:htMtA4OjSEPYfDu5+tK3Hyf8r/CJpvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344903, "uuid": "7b205414-25d7-4182-81a5-f562f6292a82", "value": 2518528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344903, "uuid": "7445e56b-bb31-4fff-be2a-7640942f7246", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344903, "uuid": "32afa6b2-2247-44ad-a55e-d189621b3762", "value": "obby6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283ea595-d202-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652366724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366724, "uuid": "58763236-feb5-4a40-95ac-883048e879d4", "comment": "Malware payload (SilentBuilder)", "value": "9d3695fa716271c81084e9622265f6bf", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366724, "uuid": "de33f9fb-5f0b-48e5-b4ff-390954565593", "comment": "Malware payload (SilentBuilder)", "value": "bd339a1078d6f5969b744a8112fb1de7786ae9033fbd8cfda9eb322cad6690c6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366724, "uuid": "ecab2a80-5115-4907-9239-cfb3f3af057b", "comment": "Malware payload (SilentBuilder)", "value": "31bd2e9c64047775086703c19dacdf71d1923b74", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366724, "uuid": "0968fbc1-2ecc-4ff3-b8c6-5beb6485aa33", "comment": "Malware payload (SilentBuilder)", "value": "81aaf3d9417a4a3b708d80f17c53b6b6956a1666c04ae94e511d5a69276800f7f78261699a489eb5137ef4e6d39da0c9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366724, "uuid": "ff515685-283a-47bb-ade0-420d180cd698", "value": "T12C03834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366724, "uuid": "21cbdb72-26bc-40dd-b6c7-cc99af3a7b85", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366724, "uuid": "90b998d5-dbe6-4676-85cb-93f785f3ea6b", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366724, "uuid": "bc6971e5-929e-4384-baf3-46248a21a4d2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366724, "uuid": "2168f4b2-9340-461b-95af-77cee9f7b590", "value": "Climaxoilfield.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48567d11-d1ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652358618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358618, "uuid": "4c156f67-d631-442d-9fdc-35f65aaaaa6a", "comment": "Malware payload (AgentTesla)", "value": "f2e1b5b35e68189e32be7efae0ce68f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358618, "uuid": "08d8d71c-6ae7-4cfb-9fb2-4d76ac48f6aa", "comment": "Malware payload (AgentTesla)", "value": "be1053a697f52a4a7860368a7a5849696e96375bdfbdaf88092d45f77a6c394c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358618, "uuid": "20917b95-562e-47cf-8182-0bd07dbf5c58", "comment": "Malware payload (AgentTesla)", "value": "c6575bda8da8350303b2de33de54aa04d3215428", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358618, "uuid": "b2d5054a-63d7-49cf-bf5d-f1a913398dfd", "comment": "Malware payload (AgentTesla)", "value": "8fa0c2a262db2b7c630265b14984bf0b681bcc30ed46c1a139b971b439f6776235e6e9ccb233f5037f8c28cf31912a20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358618, "uuid": "d2314553-6669-4b47-ad2c-38e78e76eeba", "value": "T182C4123877AFE122C1EA0776CDE514CC07706F426D27D60F5AF97149AA723DA18C1A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358618, "uuid": "75ee11d2-eaeb-4cd4-a45c-fdad297c830a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358618, "uuid": "4b6d27bc-4f2d-42a1-ba24-a7f95b902bf3", "value": "12288:3ergCEOm5AAeeXCk6WD1DAVgU9063gQ0HhLUHSXLyc/FnyT9rC7ZN3EZ2w0:399x6hAAVh90Y05FXzJAroEZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652358618, "uuid": "7d00bc27-1d69-4cc1-a4ae-c47d76dfeab5", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652358618, "uuid": "e47366dc-d5b3-4ca8-91fd-b8b9fdc0e556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358618, "uuid": "38b10014-9f75-4ee9-87d4-a0b93f6d95ef", "value": "SecuriteInfo.com.W32.AIDetectNet.01.5339.17024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8bfc43-d1cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652343165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343165, "uuid": "877c8486-7409-4bda-b95f-37b1fa121f1c", "comment": "Malware payload (Formbook)", "value": "6400120a82b2bf2ef92096f4091915f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343165, "uuid": "2f1cb6ae-8bee-4b3f-b704-785f06b2efe1", "comment": "Malware payload (Formbook)", "value": "bef0d9edea1dd55695f0490efa9a9dfaefeff5154dc56f407391781dc7e0ed4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343165, "uuid": "b6f3b19a-0c3e-43e6-8198-c147e8398a16", "comment": "Malware payload (Formbook)", "value": "db35ecfce5f9b87ef43b3f98c856d0c2e6779942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343165, "uuid": "39688840-9961-44ab-8743-78a23110bcba", "comment": "Malware payload (Formbook)", "value": "55efe7d9bbc5d069d63b235821044967668476371eaae989165147bc914fdce5848c7527e2101be2ebb383b19043b29b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343165, "uuid": "e351b7ba-38f2-4cd4-9183-adb61abfa732", "value": "T180B40146A6BFE967D1421732CDD421CE03B1BF02AD13E66F18D435886A337E249E6B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343165, "uuid": "b049723c-9d9e-4909-8d0d-d0387c7d4ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343165, "uuid": "8de64f02-1cf9-4ed4-9388-0de2e84e32e2", "value": "12288:uFUt3nEO0QAJgqaGmW9pkO/EIPxIDb4Ni5ULquskFR7jp:IUNEruLPWYO/EIP2b0IUakFR71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343165, "uuid": "9e712fea-77d0-4805-8a4f-83ba5ec3b1b9", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343165, "uuid": "077e74fc-4d0c-4e77-a008-5c34cbc8cca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343165, "uuid": "8c7cc7a4-6fb1-4744-ac19-2ac568919158", "value": "6400120a82b2bf2ef92096f4091915f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d03680a-d20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652370115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370115, "uuid": "4aea4e0b-eb29-4268-a4b0-5c4d9283e1a4", "comment": "Malware payload (njrat)", "value": "03400b0baec9c5e28a4c8b9a581cea7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370115, "uuid": "8c343245-9a2f-4c84-af78-8248e2825bef", "comment": "Malware payload (njrat)", "value": "bf8e99aff676c619236dd47399d9a43e8f3afb9df78aa2852f8270ae4870be48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370115, "uuid": "1cd42077-6466-4961-a942-03dad516d2ec", "comment": "Malware payload (njrat)", "value": "cac992a233a4e478bf645750fa927f2167bcd0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370115, "uuid": "9b637349-03cb-4ba4-9ed9-e135b4ba9627", "comment": "Malware payload (njrat)", "value": "916270ec14c0c92ad0f90c2930dcfb7f069d56709fedd1e4218ec0c997a66e862806d41ae556246e75e73c815b8880fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370115, "uuid": "32ef5eb3-daa9-4a36-bf88-4fa5793a3c11", "value": "T1BDB4C0DB23D4AD15C13E377A95E4701082B1CDEB8675D34F2090FAD6ABB37846E812A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370115, "uuid": "76b05988-1551-4f35-8a70-4ca5f6f083a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370115, "uuid": "ecdc0cf7-afc8-42cb-84c4-24cc6a9c6e5d", "value": "6144:sYIp9z9kExj3lPdZ5xq0Gy5XuT4HXx0uEF2D36zAU+//M+TAPBjrh+zKQh9nZNCo:sHhFdtq0Gme8HXdEFa68doPBsKIn2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652370115, "uuid": "2da3f5ba-17f4-473f-9492-22b0147c4ada", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652370115, "uuid": "e8b8aab3-a9de-420c-a083-74f1426e052d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370115, "uuid": "4e9e8b27-9e21-4500-8a82-c262f5abfaaa", "value": "03400b0baec9c5e28a4c8b9a581cea7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448c3266-d201-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652366342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366342, "uuid": "3451db58-ce5b-42d3-9ffa-998c052a951e", "comment": "Malware payload (Formbook)", "value": "ad32f1b14b86bdb419ab55bfe70dcdc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366342, "uuid": "a9fc37b5-606a-4ff6-9b43-371903a70efa", "comment": "Malware payload (Formbook)", "value": "c02a36721020e925efd07548ad63cb39da9caaf047a37675d5f8b52ed2b8fae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366342, "uuid": "c791a173-57f7-46a8-af63-024f179eb8a7", "comment": "Malware payload (Formbook)", "value": "3e89e85111c46116857fc16dfe78e9343a8936d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366342, "uuid": "4cec9fe6-3e2f-4c83-b2b1-dc41a2810add", "comment": "Malware payload (Formbook)", "value": "a4fa8635ae245ac92feffe93d03eb7d454052b07cd695f9f05574971e7c7c5f4f4513f83d3358d98ab0ca0f61de5292e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366342, "uuid": "950ebdd4-0378-4c6c-8286-0eb273e6c06a", "value": "T1A1541290A2A09423E9E55A329D719B77CBDFC84608E4A53733802569793A7C3F3FA714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366342, "uuid": "2cdde3b7-d8cb-490d-8671-d492de1a2f62", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366342, "uuid": "24b51804-ed7a-4974-bc95-48ec82a2b418", "value": "6144:LOtIOGWW5fodfqyqyEHGBLKLDW6wMS+BnCdM/AsQDgUCmrT6:LOLGWW5foEyxOdLDWvKsMIn8Hmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366342, "uuid": "a2cdf51b-0474-4894-a1eb-f07ac375095e", "value": 305172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366342, "uuid": "c37eaac9-95bb-45bc-b740-9505e7d29374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366342, "uuid": "45c398dd-012b-4b31-aa59-7ea27cd930ed", "value": "Payment Advice_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59d1020-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340735, "uuid": "5c40ea2a-9ea5-4707-9267-f684f3ae0d77", "comment": "Malware payload (Formbook)", "value": "3f4a3a3a87472b777905e5908b6762a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340735, "uuid": "71c91550-7df7-45d1-9371-16f9d0d47f9a", "comment": "Malware payload (Formbook)", "value": "c07e69fb84b50e32be6d2ea9af4f052fdbf2efa4ea6fa1e21921a0642fbf802d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340735, "uuid": "3e2c2510-e7af-4201-9915-8e081ace4774", "comment": "Malware payload (Formbook)", "value": "c902a1bc2763a041cc0ff3ce3ae9a457098ad3c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340735, "uuid": "ba7cd1e5-96dd-4593-992b-c3335c8add64", "comment": "Malware payload (Formbook)", "value": "537700ab33bb4f20c98c883dc24dc02e72d20d473194a0f662e9a7659b89d93e7eea9907f5c559069ba4e0bff82205fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340735, "uuid": "76e9a379-6e2a-40ca-91f8-4ee3a40ce5d2", "value": "T1303423147BE8D223DE8257304B77AB234FB9955660A0940B6751359BBF3AA40FE3EF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340735, "uuid": "80ad0a33-97a5-4d42-9bbf-de59b5b47890", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340735, "uuid": "95b7092c-8da3-4fc7-9a0b-98b9c62cc27c", "value": "6144:LOtIO0/7i9S5zr8qd8mNgiK2KysT3FbEbDHVwrNW6:LOLzNi8mKKsTuwM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340735, "uuid": "8933df5e-d25d-4c7a-ad7c-25da66b1f656", "value": 253252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340735, "uuid": "c4b673bb-d26b-4f4b-9b05-a0d371ca6f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340735, "uuid": "c62e7572-9fad-49b0-9555-600e796304e9", "value": "3f4a3a3a87472b777905e5908b6762a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ca7865-d1a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Blister)", "timestamp": 1652328415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328415, "uuid": "53fd89c4-8bfd-4b2a-9688-223c50c1b3cb", "comment": "Malware payload (Blister)", "value": "a6d49b646ed61b91bcfe9c2170b258cd", "object_relation": "md5", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328415, "uuid": "7f03964a-efab-470b-8834-ce715829c7c2", "comment": "Malware payload (Blister)", "value": "c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61", "object_relation": "sha256", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328415, "uuid": "369a669a-f7b1-4090-af59-3bff08af064c", "comment": "Malware payload (Blister)", "value": "75c7cdddfbf538f51da8b74cbad11c302206750e", "object_relation": "sha1", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652328415, "uuid": "3d769712-6f01-4e82-b6a3-6b851171592f", "comment": "Malware payload (Blister)", "value": "fdc954195e5adedc61d8ed801d4278acee660ed8635880c3f787d39bfffaacb51711d3139588df58cf7644b0fe23d87d", "object_relation": "sha3-384", "Tag": [ { "name": "blister", "colour": "#0A712B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328415, "uuid": "fc540755-90aa-418a-b584-c3f74beff7f6", "value": "T1DC45F12236E88232D8F371B0577EB6B64AADBA941BB4A1DF124007EF9D317D01E24757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328415, "uuid": "87a641d8-adbc-409f-890a-7945390651ea", "value": "d973f2953e33229657e4e494175329ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328415, "uuid": "bb4e172f-bca9-4f09-b133-f48118ba8cef", "value": "24576:mDrIuOfGiDT2XNXWrdyv/z7f0LFrodrs4LK:8OfGKSBWxMfsLFVmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652328415, "uuid": "53f9b014-be4d-448a-900f-6c88a6683552", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652328415, "uuid": "252dfbc5-ae52-4855-b3ea-490f50c394f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652328415, "uuid": "78dd14b1-8be9-4009-a52c-06f6a44d848c", "value": "c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1074698-d1c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652341211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341211, "uuid": "99f2b535-53b2-4452-a663-9c0d942eaf97", "comment": "Malware payload (Formbook)", "value": "a6d64ec4bde4dd02543e7b751fc32384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341211, "uuid": "9ac2f7ab-b9b9-45f3-b53c-55f4ecb65ae7", "comment": "Malware payload (Formbook)", "value": "c16dcddd7b9501bce324b49c9906488bb7a5467789381766801dfd7ce2d13a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341211, "uuid": "68e85b4f-b0dd-4577-93ea-57c4f56fedd8", "comment": "Malware payload (Formbook)", "value": "845b6e0ba3c7d0e08953cd1b92c5525ce2f6f46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341211, "uuid": "60988af1-5811-4872-82ec-e3eb50246a1c", "comment": "Malware payload (Formbook)", "value": "5929062639d05114828bc9f8111fdb5e72ffa59dc51aab5359b31b2d772595fb45440a7c0715a2963233df141f0c2848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341211, "uuid": "759b8bd4-d529-4c81-b667-6cbd609ea777", "value": "T16354121123A4D967D6A242711C726723CEFDC72104A1DA1B1768AF6FFD7B1C0962E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341211, "uuid": "a1b84a30-148f-4dd7-b255-e2f8a949203d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341211, "uuid": "8eb138e2-9636-4cf3-b37e-f07aace1e8f1", "value": "6144:LOtIOhyqCWRY3xCs5vaxu78YYsacYToLpFMy3SOhLFNAq:LOLhyqoB/a0WcYT+pSqRFNAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341211, "uuid": "f138c89a-eea1-47a7-b7c0-69f41649dcd4", "value": 284719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341211, "uuid": "a05176f8-0710-417b-b9ab-3c39b68a47ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341211, "uuid": "d0d397d5-c7b7-495e-b388-4a8499a82987", "value": "a6d64ec4bde4dd02543e7b751fc32384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620e73e9-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652340193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340193, "uuid": "517ec6b6-70b5-42b2-8a3d-9ca92341c644", "comment": "Malware payload (AveMariaRAT)", "value": "72397a0783392438c1b499311c79d2c4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340193, "uuid": "84db99d2-849a-4f05-94e4-0dad8a723d6d", "comment": "Malware payload (AveMariaRAT)", "value": "c1c2c8e4bc95429bf9c936655e953db1048d56561feaf1a765008c18b713652c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340193, "uuid": "b0d80ebd-c5e8-49d8-82ab-6f9948620161", "comment": "Malware payload (AveMariaRAT)", "value": "7763f669ae41693674434b7c03921f22100f5865", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340193, "uuid": "1a4e254d-8a1d-4a80-a2fb-464c3136748a", "comment": "Malware payload (AveMariaRAT)", "value": "482ecca5a6aba363729a93def8c52d7c0c05611ea67fdb0ee20f8319ff6d9e0e992020262dbe771ad5e9cea829495e9b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340193, "uuid": "f5d4ef2f-66bf-4864-946f-3865dca70c7b", "value": "T188A4120433BEF36AC86E97B5CE2915CC23746D069C16C22B0DE0B4EF9BB6725509179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340193, "uuid": "597b0ea2-130a-49b5-94cf-5a7ac92f8ebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340193, "uuid": "250d7d1f-264a-4427-bd35-2210e2042dfc", "value": "6144:fGKem3iOAKXeFJg+6GUwhkYN8CObdMqrM8TnRPUODJZViRb1xXw2h29u2e:ssTXoJgbOhnNmWqVnRbDJHi7xw20e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340193, "uuid": "847b5e29-de23-4c86-8dcd-ca99f09dd5ff", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340193, "uuid": "ed86ee00-d3e0-435c-9234-fbd5b927e05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340193, "uuid": "ac5c9d19-f945-41fa-888e-c39ea3db1d90", "value": "DHL89987567.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4379fe-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652355569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355569, "uuid": "60291a52-9535-49b9-bab6-1c8ada6f9831", "comment": "Malware payload (Formbook)", "value": "5abd630d41fcff97cc8cba6035f68593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355569, "uuid": "856e51e9-46ef-47d6-85ad-989e6b732e17", "comment": "Malware payload (Formbook)", "value": "c2495cba1870421289356621b1f033502660d85eac3a4225f40ca237fcb01c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355569, "uuid": "2712698c-f11b-46f4-9777-1386fb5136af", "comment": "Malware payload (Formbook)", "value": "a4090357be5702c2763b261cd1587c6ddf06a3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355569, "uuid": "5eb61705-8d25-47d3-8bc6-984df8d8b10b", "comment": "Malware payload (Formbook)", "value": "55f300f39e4286727ae9fc8f663566f130633ca5ff4d0ef53c4f8dbc3cb9979c9c8fe66de511bdbf626406f3e9aca72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355569, "uuid": "8557bf38-0853-4aec-9386-3907c46248de", "value": "T18B541215E630E857EF7A1F324D2373A28FBA8C1106B8594357913E0D7EF3A50AD4A256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355569, "uuid": "791d6aba-3657-4427-ad01-ae5a83a8e749", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355569, "uuid": "f27e4886-4106-43b6-bf48-747ac18a731e", "value": "6144:LOtIOaXJrGcnULav1idYD+bfRfnA7LYBZPZq4iIPnxdSi:LOLaXUJWYdYD+b5BZ8v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355569, "uuid": "7c960ad8-5321-4a5c-a601-9103d68006f8", "value": 305974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355569, "uuid": "9b4d2954-00e1-485a-9c24-18cc73043f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355569, "uuid": "422ee96d-c603-4c01-b7cd-083768c91270", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6aad02-d1dc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652350494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350494, "uuid": "1550ab12-d1e9-4694-bf98-a07191705cb8", "comment": "Malware payload", "value": "2a5855a92f546e1c959abe8a17b9a743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350494, "uuid": "a37290c7-343f-41da-9b1a-01e65fcad5e8", "comment": "Malware payload", "value": "c30697ce42f9622f948eb24bdb2024578713d6dbe838f12436f9fb4a2e80fbe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350494, "uuid": "a6fea44c-c345-43f6-ac90-3b0377d77bcc", "comment": "Malware payload", "value": "277ced69d51ac45ad84c4d9ebd6cba9b2a05850f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350494, "uuid": "b71d4ee6-0221-48f6-9b2b-73b3c60970a8", "comment": "Malware payload", "value": "fe6227256b1f95c4cd7162560dd4a953de51b8b070577b68d4d723a7fe0ca03bde3e4d15a3035784cd85f9ab39fee056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350494, "uuid": "4f76224c-efba-405b-a31d-06b1e237835f", "value": "T1CAA63347539B389AC6B34633338E2D8B0567EDA866014D9A93FEEA7647D04C3C375836", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350494, "uuid": "e9dbc7aa-f80b-499e-a644-b5f9ded3cf96", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350494, "uuid": "72ddac0f-0507-4071-840e-1097955bb9b0", "value": "196608:/5GpxuRA6v6ARXQMpVoO9aL/QHhzzcBdXQmvtyJxU2p8ePrFYpV:/8xoAzA9QMpVHG/MzcnQmFybNeeJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350494, "uuid": "c8639b13-3ed4-4fae-a889-1baa38c9c13e", "value": 10342968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350494, "uuid": "769b18b3-1474-4762-afbd-84b6bec8bbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350494, "uuid": "532a1228-38ab-4c70-8555-846892176696", "value": "Tradestation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9538799e-d241-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652393965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393965, "uuid": "0b16da4d-976b-4bc6-be56-1bd388efd924", "comment": "Malware payload", "value": "26851d498ee189207bbff1f7d1ca9bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393965, "uuid": "68144721-f5eb-4d26-bad7-05364d9b6a07", "comment": "Malware payload", "value": "c407a7fca0d36ae631300eef67eaaf4de46c6b7ee029ca44e16d7359d4dfd4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393965, "uuid": "20d848d3-9efb-40eb-8161-543b14472fe6", "comment": "Malware payload", "value": "b1a79e48c2bdcd2cc2f68f39c78adb75924879cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393965, "uuid": "d2fc1634-782a-4907-97cf-2c627e34b29a", "comment": "Malware payload", "value": "db29d5de61c5678b69f454dd53c6ded70a2dc117f6c40c411a7781a71b0d72c13341b128c250249871c6f8f68b091e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393965, "uuid": "3940384c-ee3b-41cc-8beb-6458e5d542ed", "value": "T192E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393965, "uuid": "fc6fba95-92ad-401e-914c-218901113c06", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393965, "uuid": "e819a61e-f480-4894-9526-e184506c9a8a", "value": "6144:mkajLyaPIvW1TFpvzYNB1MyB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8b6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393965, "uuid": "2f0a1b5a-7bd6-4a41-95c6-bc9f29dba067", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393965, "uuid": "9de9c1ae-fc1f-449f-93c5-02f11aaf99d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393965, "uuid": "1b5266dd-5a3a-4070-aac2-4534e1ad262a", "value": "26851d498ee189207bbff1f7d1ca9bb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0560430-d1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652356269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356269, "uuid": "43f22ce8-84be-434f-8923-ce3badb14e9a", "comment": "Malware payload (Mirai)", "value": "bd34c8a469bf871b0dffca3e2aba878f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356269, "uuid": "09ee982f-e464-4b11-a48d-e4675a161f0f", "comment": "Malware payload (Mirai)", "value": "c466a3a8fa2c3bbc256ad2a35ac61f5cc697f4ec7286d039a2d96a6f0fbf82f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356269, "uuid": "2c527fde-2049-4bc8-bfa6-f07d489dc3e9", "comment": "Malware payload (Mirai)", "value": "28e778070ff8a971e111110109ed9d6980c7a738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652356269, "uuid": "43a964cd-221d-4ffb-8b37-13fc283d5648", "comment": "Malware payload (Mirai)", "value": "e5c37efce79981e4892c66faa72e63b277b1429ee48658bcaa3687d3d51731c68d2fe6e12e5982c3d574be7c2e13097a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356269, "uuid": "2bb61ace-afde-4920-8b46-0da2f0db1e87", "value": "T1BAE3E73B672B0A23C0C5547106E31232B9A9EE4834F947D7A9D07DAC9F3D94C346A7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356269, "uuid": "f1827cae-6682-462a-943c-8069b72345da", "value": "3072:+NlUaGZXGgd/mq6kNPC7iPHJwDbm9/sduDwAGp+Ng:cHGZXGsfl7PJ0bm9/sduDwAGp+Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652356269, "uuid": "1c746cca-6167-424a-a509-c8e79d784436", "value": 155164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652356269, "uuid": "d1b7a4e0-4783-421a-8307-a8cf6f067679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652356269, "uuid": "545b8157-3c0d-42d5-ab37-59ef06dc7aaa", "value": "bd34c8a469bf871b0dffca3e2aba878f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1766e498-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652363690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363690, "uuid": "717d73c7-f4ee-468a-b0f6-79b28ca9d6a1", "comment": "Malware payload (Growtopia)", "value": "61c2da2aca8f04ee71c6ce1e16f1fd8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363690, "uuid": "53d5e735-e7f7-47ab-9478-2161b20b8592", "comment": "Malware payload (Growtopia)", "value": "c4eb15e4b09659d1260a344a7f8cbf14c21c5c08596b7762e17a87b00bb70ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363690, "uuid": "7e89fd26-5f00-4be1-910d-e6650d06c974", "comment": "Malware payload (Growtopia)", "value": "f7e62657cf32e359b20dd2289b5466c0d9d050e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363690, "uuid": "7d38e18e-66e4-4763-b675-a578da50ebbf", "comment": "Malware payload (Growtopia)", "value": "552b809fc7ac6615d07a940b3b22929eb7626f8b114161881c00278cbe74ff45021aae242e6e02bb237ea074b74e68a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363690, "uuid": "988c50ce-a369-4401-9bdf-59675f81b379", "value": "T1B752F81477E44236D8BECBBA08F28B348334E586292ADF5F28D8115D0D367434DA5FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363690, "uuid": "d669c315-a3c3-485d-bf5f-b0cfa38ee6ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363690, "uuid": "f3bf4f13-b061-494e-8405-040160bb5635", "value": "192:LHvcNcub+MzMl1NSIwWhrw309N3LwbasD9yKYHr3c/Drt3oK3i8V6:LPcNcub+Y6SyrWa3kbac93YL3c/lA8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363690, "uuid": "e7f47a84-41ec-4ee1-8e53-f9076ee9e352", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363690, "uuid": "7da03e3f-d48c-46d9-8d5a-05de80dddbd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363690, "uuid": "6668ba68-874f-461d-ab2d-f0483916ac8c", "value": "c4eb15e4b09659d1260a344a7f8cbf14c21c5c08596b7762e17a87b00bb70ec3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3511e5d6-d229-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652383496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383496, "uuid": "96373895-9999-4ed5-9e44-fbbc590a6905", "comment": "Malware payload (Formbook)", "value": "d3dfdb9534bf44d0248c90eb3308b9b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383496, "uuid": "0c1acab2-0631-4984-8c93-6c7e84945208", "comment": "Malware payload (Formbook)", "value": "c53843d2d5293c7850f00b9ee34ba759a2f1eb3fc896f42554eda125ed26b3ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383496, "uuid": "43e70fb0-bf9e-4aa5-8d7d-8c254b96f387", "comment": "Malware payload (Formbook)", "value": "93bb8d7150e63e2bb230adb4b42d700258d7bb51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652383496, "uuid": "fc2526a2-ca62-44a0-9944-193e2eb92453", "comment": "Malware payload (Formbook)", "value": "9f221b05cef89f4c158d97668e5d38f3b258a321ecf3579681f44e5dd9263a1fdba0903f1e44a7b170ca39f1ddfa9205", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383496, "uuid": "be9f5414-eaed-4a5f-ba0e-ecd868a29adf", "value": "T126D372261EAD3150C3992D79BEEAE2384F768D85EC6D20A314ED791AF9377DC13E9040", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383496, "uuid": "397db4a1-59cc-42df-b474-28f3b24e46af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383496, "uuid": "b3c9e116-b31f-421c-95d5-a9bda2699efc", "value": "1536:pspl763w9az9MuZmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg4:pspl76g9MMuQfoZll0bGVmjWhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652383496, "uuid": "5a43bed0-ed1a-4564-b6d3-d4755bd682aa", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652383496, "uuid": "b6e11f2e-f010-4f85-b468-6ee1c3f8046f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652383496, "uuid": "dd85506d-b3b4-4d0d-a714-162f71604dd7", "value": "d3dfdb9534bf44d0248c90eb3308b9b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6e7b0b-d1ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652358494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358494, "uuid": "773d49c0-c322-4ce1-aedf-0c69e44f7229", "comment": "Malware payload (Heodo)", "value": "18c8d3c95b3bb8d991fc868e03d44b45", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358494, "uuid": "8f6e1509-3c61-4925-8f99-cd40cc34f602", "comment": "Malware payload (Heodo)", "value": "c5820c723804fb384472f556f5f81334d784a6376d25015316abf8aba12b3e03", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358494, "uuid": "aceaf129-de1b-48b4-82e6-bbaa6446e0cd", "comment": "Malware payload (Heodo)", "value": "7b196435a0cace581098075094cad8254c5636b7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652358494, "uuid": "59f6001e-2ad1-4b23-a2e5-7d9794c44c40", "comment": "Malware payload (Heodo)", "value": "5d4a6b5d8379877c70c65c14b4a548f1f55d6cc6ba57307f258d020e0629f1760ded34535b3299258161fcd32bb43bab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358494, "uuid": "c282dd12-841a-4afb-a700-52098cc60614", "value": "T1B1F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358494, "uuid": "9cc11fa3-5e71-42cc-af70-97b251fc8034", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358494, "uuid": "f567634e-92e0-4d7d-ae0a-de56c2491bcd", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmS8jNwgraKRT61cKGNx:S4DzZKnH4NRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652358494, "uuid": "c45d0ee4-9eb3-4663-9884-f86eec0f9c47", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652358494, "uuid": "61eeefd4-48f8-4ca9-85e0-5d713525040a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652358494, "uuid": "be02bf21-ca5e-4143-be30-434ff1413771", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e631eaef-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652399685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399685, "uuid": "0bf0c866-b2eb-4dce-bde3-61396749aa64", "comment": "Malware payload", "value": "b4a39b4a2cac397f12255d55a697f674", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399685, "uuid": "518f0895-a801-44dc-bc61-496f206eb045", "comment": "Malware payload", "value": "c5869051e78f9fe8382abda7f11f98f1bc5e9720df7e6f9879a13b7a4d94ab57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399685, "uuid": "2d195098-6ee1-4e92-ad84-fe4198d11ec6", "comment": "Malware payload", "value": "0c3028de42d76da31744c2b9daea97aacfa31841", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399685, "uuid": "f96af51d-2799-4b14-af75-5185edc3a0f4", "comment": "Malware payload", "value": "52ee3e2b7d3567352a63977829bd3431aa713ad3a03a9b0bd0e2b71eb59b80bb6b2b4b5d868a7f478ae1d540b32b11e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399685, "uuid": "30156a3e-7915-4dd6-885a-4a9ce0c39910", "value": "T1EFC3E74D3E319F7DF769C2348BB74A20A36823D622E1D6C5E26CD5251F6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399685, "uuid": "901cfe4c-3fdc-4310-87d6-dc10d2ce81e4", "value": "1536:U6+Ry2TvD3Q6JktwsiInvzaB2OgXpV0+TZDWvOjaUOZ256m8GXFLKRe8QHw+Y3Pc:x2TLQg2zaB2OgXpV0mAOjaUJjKqH1ugN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399685, "uuid": "6acde87b-7870-49ed-9e17-2ca5bd327276", "value": 118196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399685, "uuid": "8aac7813-f18b-40c1-9d22-d3d776f503c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399685, "uuid": "6797d80e-9646-4ec5-ad84-be4ad4bab06d", "value": "b4a39b4a2cac397f12255d55a697f674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62a15c0-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652345917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345917, "uuid": "0105cda1-101f-418b-9bbc-a63ff3d7668a", "comment": "Malware payload (Heodo)", "value": "134736ecf8fc046697fad183d097c11d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345917, "uuid": "f67be9a4-147d-43c1-9f40-7818508f1aaa", "comment": "Malware payload (Heodo)", "value": "c5e31e3760634245dc9818489137fb7e2a0a71073e97f86726d4bce4e31f03ef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345917, "uuid": "502db5c3-b90e-4562-9575-9d74221f4e26", "comment": "Malware payload (Heodo)", "value": "1c65bac52e7e783df1db1c91156d262a56173914", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345917, "uuid": "35f8faee-220f-43f0-bf33-61e8c85f55eb", "comment": "Malware payload (Heodo)", "value": "a1aa7194417090b97a087fc0f7d56514e5320c00eb6a5ff5cb4ecae45fb9c90a53dfcd76729b11d3bcb50b4af55e29bc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345917, "uuid": "038a7321-1758-4fa7-834d-075e2c316026", "value": "T13111B3281119B78DEAC60592A0887C60E734DEDD31F12BEB47CAE9C04C8B40E01A8CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345917, "uuid": "3774aa3c-a3bf-4108-817c-93add20e5b91", "value": "24:iZbrLCHPKC2InnJ9vgU6a+nAKGnCXEzZs7d68/3K3yWn:wbIP3BH76a+nV0N3M34p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345917, "uuid": "3b4e9cf2-7ad4-4ae2-bd66-a036b3cf9da0", "value": 923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345917, "uuid": "17bbd89e-5b5f-4ad3-8f28-14a2c0e62124", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345917, "uuid": "733c758f-652f-41d1-a4cb-8fb368b88e0f", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864a0a3d-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340683, "uuid": "0aa1ba8f-33f9-4418-983b-8455a64dc25b", "comment": "Malware payload (Loki)", "value": "592c22b9cbed889d85aed60134630f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340683, "uuid": "d5b11219-81e4-44a8-bcf7-df8bd001fc3b", "comment": "Malware payload (Loki)", "value": "c621f6f6ac9d846039beaa639d87d36d78d7484ec73ac11fbd105a7132f4d6b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340683, "uuid": "4924298c-93ac-4e4b-bd0f-620611e6eb8a", "comment": "Malware payload (Loki)", "value": "14b1e8ad6dcc0698745abaa2548a21693851cc23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340683, "uuid": "3821c454-2a29-4e77-b021-33e11ea32eed", "comment": "Malware payload (Loki)", "value": "094ee14fb43a123aff068278026365380368bb0a131080568e2fd5e92a3327f65ef78c91603545adb2a77d201a68f0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340683, "uuid": "30c72744-a8da-4588-9005-c3e17b30f53d", "value": "T1310402406390E0F3DAA05B3259736B638EEEB816187587470B00265AFE71692FB1FF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340683, "uuid": "afc2c403-d407-456e-b494-90c58360094b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340683, "uuid": "5110b79b-0a36-441a-9bef-dd2c2bf99229", "value": "3072:LODZGPEounbgVuzBlJmo0Y8iNgjz/1IZuTswrH+pJdA+TzHdsfzUKT/HFy5Ug0Cl:LOtIOgAzlmZg4VZL+dbnWfIKzHFyuJCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340683, "uuid": "90e3182b-712c-4f9c-b2bf-e3ca1a9c2a5e", "value": 182962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340683, "uuid": "c83237b9-8156-48ce-aa01-59558a965fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340683, "uuid": "6252bef6-546d-433f-9c8c-ae5d049a6f9c", "value": "592c22b9cbed889d85aed60134630f7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116741ac-d1c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338769, "uuid": "0c0c11e3-647a-4bcf-aeb6-25137b5ef11f", "comment": "Malware payload (Loki)", "value": "d67f6d4b69828104311e1ff35105f9d1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338769, "uuid": "78e7c50c-7bf9-4847-bc83-52873c9fbccc", "comment": "Malware payload (Loki)", "value": "c6562935a91a904bee74a67a5236ef45a68ed5b21e24adc93daa21a5c840384e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338769, "uuid": "cb59b009-dfc4-4f38-bf27-9e0de8021f7d", "comment": "Malware payload (Loki)", "value": "7f71b38115197688f153b966107d25148d0bf2c5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338769, "uuid": "c9398068-959e-4042-9303-4f53e3400945", "comment": "Malware payload (Loki)", "value": "b65a79c83884e0a7cd07cb70db4414756554368b2e3d9be7c4e493e5acf7bdc8883eba1097ef41e9cf7e53ef4914b633", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338769, "uuid": "cf6ba8cf-1dea-4366-b9ab-e2b63d6c96ab", "value": "T19093E13C4AC8444EC88711FD5ABB859BC768BD5481E1AD490D0B7B1B0EB358CF627A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338769, "uuid": "8487b2be-b779-4ab1-a13d-457665a461c7", "value": "1536:1ztodZ32xlwcxIpGdkMSg3dDc78tOcV/FdJsHBgnJxEvaLDjjeV:1zaEwuIAjr3++OcV/FdJqaLDve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338769, "uuid": "72bc9acd-4f7b-45e6-b7f4-d10fdf4f5d96", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338769, "uuid": "d4474417-79ef-4ce9-8be1-96ef73eb1ecb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338769, "uuid": "a29d37fc-1146-4960-9ac8-26b48e598981", "value": "Paymentslip115.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bdb99e-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652379578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379578, "uuid": "4260ab0d-f248-49cd-9a91-a4d4de362150", "comment": "Malware payload (Vjw0rm)", "value": "5581e30677b21dcb500f969c03550110", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379578, "uuid": "ddf5f808-b9ce-49fb-ad9c-edb70b3a87b7", "comment": "Malware payload (Vjw0rm)", "value": "c68f7f1ef47718a8effdae1fd22b53227b44634d46d29d41a6ff8c1d3068e746", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379578, "uuid": "e6ad59a5-2c1f-49cc-8335-f1a1ea5fb2a3", "comment": "Malware payload (Vjw0rm)", "value": "47a0e0d873c5a10f92ca7756bcf6cd761f1f93ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379578, "uuid": "18136fc2-5be7-4428-a2d4-e3ee943bb323", "comment": "Malware payload (Vjw0rm)", "value": "b30e00e21f3e8b6619fbd8f914d4caa6132482ff449cb0e2facc348feaa4c51001d630cca7322656315d2f6e19f6f79c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379578, "uuid": "dbb1d17e-d0bb-4f95-8e1e-1382d8ab89c2", "value": "T15F23F69C6EA4A1AECA2861627D3E6CC807F4564BA441D38F351F73401FB9B46CBDE45C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379578, "uuid": "6d06f13b-e509-47f5-a971-7fbc2414b360", "value": "768:B0B5gq8lfFK/TpzfUsjek4UvGxfUJ6ozoGsu+IrK:B00q8lQ/9bUvUvGxsJ3zoGhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379578, "uuid": "27550b4f-35ec-4adf-bb8b-80fa5a4da0ab", "value": 47181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379578, "uuid": "d4ee73d1-edb4-40c8-8dd0-9cedb5ff23be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379578, "uuid": "e3fbdc44-7c84-4187-8eb7-2b9a9525200c", "value": "Incoming_wire_payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a093dc7e-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317964, "uuid": "a3a7cda2-7d65-41b9-843f-ca102564e26a", "comment": "Malware payload (Mirai)", "value": "9277f8eec840075eb67286576e0ad0b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317964, "uuid": "db90bcd3-d5b7-4bf5-b3d9-fe7cc658b672", "comment": "Malware payload (Mirai)", "value": "c6f16fddf7e3bd6af6e13fd337d7037bd65b7e4caee9148710b2513e477d6748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317964, "uuid": "f4f0498f-a1ac-41b1-b050-ac398e1432ac", "comment": "Malware payload (Mirai)", "value": "e44c3ba26585258cae0b36c782072aaa8d7276f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317964, "uuid": "246494dd-a8b8-4c0f-b84e-2d2f6385f449", "comment": "Malware payload (Mirai)", "value": "59168cd869e07a19f08ffbd7925c0dd3f01976ef08e9d5f55771f673100da5e6ffb745646fd6e12a403fd59a68fc5a2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317964, "uuid": "0fc61bbd-1043-4785-81b7-461005a68656", "value": "T1FAE2E18D45683DCACE9DDD3AF4BB5A104D85B1C12F594B9A3318088AEF47D07BC252F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317964, "uuid": "c1de218e-a4d7-4e3c-8f79-f8fa9ed7a484", "value": "768:ZBQT5to3U4QTR/fH7LjiGHybXmLHJ+H2WMye:Z6to3lQBbLemue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317964, "uuid": "49a5413f-6957-4028-9725-897a5e1977f6", "value": 33256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317964, "uuid": "c95342c0-a4a5-44fd-be35-6ad9492e3ef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317964, "uuid": "5d06e0a3-60d1-4388-8936-c99181153ede", "value": "meihao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22afc168-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337080, "uuid": "de694aa3-10b1-4da2-b1de-aeed39b63d3b", "comment": "Malware payload (SnakeKeylogger)", "value": "723303790beb697753fd6b1c102d1975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337080, "uuid": "0465ee2a-6cfb-4edd-b023-9a3b6054e63e", "comment": "Malware payload (SnakeKeylogger)", "value": "c722f25e85c0ca17f219d77f88b869148765c5d74320cb7a19f55c2a789a82b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337080, "uuid": "8580b9f8-786d-489a-a650-fb762d0d8542", "comment": "Malware payload (SnakeKeylogger)", "value": "2326b1deca974af02b100a3ac8b4a58e1bb8abff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337080, "uuid": "6b1919e1-41f8-46da-b267-afbabf806300", "comment": "Malware payload (SnakeKeylogger)", "value": "f370ee07a3ed7f89c52726c2c81349bf158c6538ee017e90f11ee566646ababdf61ae2efb753ce453da17429d618a1e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337080, "uuid": "1ce14ca1-4214-434e-a581-b5944cebb73e", "value": "T1E5D4021CB6FAD612E1BE2F3BC0F650144778BE096132E70F278C224D9E9678B4946397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337080, "uuid": "8c08e568-40ef-4a41-8361-064ec137c920", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337080, "uuid": "8d92fba3-cd8f-46d7-ae3d-32678a46f4ab", "value": "12288:qi31plptROTkYRmD9ZAU4qDCU5SciuYFAZHQsDF4SbDD+Ep:qi31/HROTkYRmhZJ1C999WZH1DF11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337080, "uuid": "c84a4d5c-ed77-410c-a2d3-8d6d6261e1dd", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337080, "uuid": "0e76f488-c1c9-44cb-bc59-b8e8a20dac3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337080, "uuid": "e31502b6-1b94-4cc0-a757-1d4f319b820d", "value": "RFQAAH24161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3881a8-d1f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652361903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361903, "uuid": "51fe933f-3c45-43a6-89e5-7539365e463d", "comment": "Malware payload (Mirai)", "value": "b2e1f199f346bfe479a007e8965d2447", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361903, "uuid": "9e2f53cd-15e1-453c-a1ab-bb3a68d3b7a9", "comment": "Malware payload (Mirai)", "value": "c72fee51ce6adb53d6653372bf405fa1fb636400953ee98bb6325004ab4d853e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361903, "uuid": "5a536c47-b669-4ac3-8d48-a960b860ed04", "comment": "Malware payload (Mirai)", "value": "c9bc2624e40047368e1722942bc821c1e18928c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361903, "uuid": "81ac27c3-2f4e-444c-a17d-2557467de94e", "comment": "Malware payload (Mirai)", "value": "e56685a1c7cb5176799b4d456c8e09c1104d70dd56cd83912497802a504b4243ff4a56db047291ff19855be08c1cf97f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361903, "uuid": "914bddaf-12bc-4d02-a356-b14c2a81453d", "value": "T16B734A0276284E4BEAD60AF1253F5BE483BFED8025E4B584680FD7464635E37458EF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361903, "uuid": "d54455d1-a2d5-4958-8df7-6023ca9d9b58", "value": "768:x0zlipKQt/M9Kr902YECVNoIdgxI+B5vTemF6m3PpT5v99/sllk5MCs7/nLDJQ0D:6iYQtO6VCbWFdT1ik5kvm04/V5yDOlub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652361903, "uuid": "8f998771-c55e-4b3d-8588-91b6598aec13", "value": 74660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652361903, "uuid": "d9009410-c92a-4d08-8a1f-bee726f58cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361903, "uuid": "8f02b5e5-e864-45c2-83bb-74db0cbfff99", "value": "b2e1f199f346bfe479a007e8965d2447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffc7b71-d1d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652348188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348188, "uuid": "439f7708-deaa-4861-a072-434378fb357d", "comment": "Malware payload (Heodo)", "value": "b119fc67f6fe6a45f4fc4c8bdd7a2214", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348188, "uuid": "1b2ff219-2679-424f-9bcb-47e3c7a076ea", "comment": "Malware payload (Heodo)", "value": "c80d9a7f7a900be9bce52f6afd48737562a328354665b971b43c1d7c04fe6149", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348188, "uuid": "c160ee1a-3159-4850-8ddc-e7ea31a13047", "comment": "Malware payload (Heodo)", "value": "018ef75dc7181374956dc46f16110bacaa2eea6e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348188, "uuid": "bdc1b32c-68f6-4b30-a5dd-745ac20dc74e", "comment": "Malware payload (Heodo)", "value": "1437305dc2824b0cec260b3a511db42741cec74f044e3cc6d5b532d0bca68ca44da81cd4741ec56f7127b58583b1b17a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348188, "uuid": "eeedbe33-92ce-4a17-b45b-7ea31ad315bd", "value": "T1C103844ABA5AC95CFA25C73548E743E9B362FC101F6B0B873645B3657FF49A04A0360B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348188, "uuid": "a8133472-9e2e-4aa6-a3b6-82fb11d2405f", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lg:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348188, "uuid": "7638ff7d-5cf7-4449-8737-600e09cd6805", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348188, "uuid": "820de509-d02e-4c4e-be7a-9c83c0b40d84", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348188, "uuid": "ce2305dd-dd00-4b4d-860b-19cdac183d36", "value": "COMET SIGNS PAYMENT NOTIFICATION 05.11.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd7c60e-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652343647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343647, "uuid": "3430cd1a-0c19-4c46-8f72-75e81ac79659", "comment": "Malware payload (Heodo)", "value": "9c5ef5aa8a044b67f7514ceca0275d0c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343647, "uuid": "37f7068e-ccf3-473f-9875-c687cbb9393e", "comment": "Malware payload (Heodo)", "value": "c8ad26dfe85cb8aa6efa05b6d5834b11f3e994e31f931964fe567f7c40d5e815", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343647, "uuid": "c2f9f56f-b0e2-4d12-9386-6ade64be9c92", "comment": "Malware payload (Heodo)", "value": "d97d87f8e9f38b5bb84868e1ffb4dd73c6a04c70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343647, "uuid": "9bd53ee2-4fe4-43b0-aa64-f2312ff3df79", "comment": "Malware payload (Heodo)", "value": "90866e9ae28914f9798064a598a39543aa81b868b4234ed3aa909f388d43c7b24a8a51e906965793337359bc3a908299", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343647, "uuid": "3b1a2629-77b6-4e72-9ae9-9ff82136d356", "value": "T196F47C5A72D3016DE06B81F58BD27965FA73BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343647, "uuid": "ee17ff22-8de0-4180-b07e-d2ef47f0640b", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343647, "uuid": "31b6fe79-01ee-4f8f-903e-8bc0534864bf", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSFjNwgraKRT61cKGNx:S4DzZKnH48RGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343647, "uuid": "c6b3b2ec-5353-493c-a3f0-588e274eefb7", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343647, "uuid": "e7e3560e-3f5a-45cd-9d5d-5c4610732de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343647, "uuid": "ead692d4-d105-457f-a0e4-eb0fa72cb670", "value": "9c5ef5aa8a044b67f7514ceca0275d0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b178e4d-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652338007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338007, "uuid": "1bdad8ad-25d3-4cc9-b44f-e56433860761", "comment": "Malware payload (RedLineStealer)", "value": "c5d66a123e83068d4f1b89b41f07375c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338007, "uuid": "662360c4-6547-4093-935a-7d42275760c6", "comment": "Malware payload (RedLineStealer)", "value": "c8bdff8c57e8f73a1c2947654a473483d7887efe0d2024a5dba10096fd746cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338007, "uuid": "bbaa93ef-9bdc-4a9f-bf32-bac0e6ee7509", "comment": "Malware payload (RedLineStealer)", "value": "bc7bc8184124939db5758dfb1dd8a06ee9bd6791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338007, "uuid": "273412de-4658-4399-affb-9dd15ff7fa36", "comment": "Malware payload (RedLineStealer)", "value": "4ef3878743ad404022b08b408648e4a3f2280dbdb6b30f58b06cacc226c7fb647db1e062778b3a9b3f380f715fb7b6de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338007, "uuid": "a5c89250-6725-4831-890b-00b3b2a51bda", "value": "T1B784C010BB60D034F1B712F4597A82A9BA3E7EE19B2445CF62D53ADE56385E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338007, "uuid": "c7f3387d-afbb-4d10-aa44-cb51b6d19378", "value": "11b2c6019eac676f0c4275925b136e74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338007, "uuid": "fad3355c-976e-4d7c-8c54-dd1e224e1658", "value": "6144:DpX61h631fLpaKctU8XAXvE/gn26orsfiWc+GfHwT5XdsJwg9Z5PHSjo:FAA3J1a/tU2AMnJHWrgBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338007, "uuid": "0dda620d-68ff-4a6a-8e34-11d8e685e1c3", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338007, "uuid": "ada4c62b-7ba9-4104-929f-df6349c470dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338007, "uuid": "00513cba-79f0-4016-8ecb-aca7430e570b", "value": "c5d66a123e83068d4f1b89b41f07375c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08681437-d228-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652382992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382992, "uuid": "034af3e9-ae99-436c-abec-4f0543ba286a", "comment": "Malware payload (Mirai)", "value": "8430addb17a50dd8b13e9c3dd8bcb403", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382992, "uuid": "1faa603a-b6a6-4f57-bffc-e145999e0474", "comment": "Malware payload (Mirai)", "value": "c90196c931a0c6b0f4ad44b41060f4b2e2911994be67cbd14515fa4e6f883101", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382992, "uuid": "717f389a-e26e-42d7-b3bd-e517ba1e9d77", "comment": "Malware payload (Mirai)", "value": "ea1ecbd11bc4acb206e449225f96df4dad89778a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382992, "uuid": "f6cf1af9-e23b-4615-8d4c-58aaadfae833", "comment": "Malware payload (Mirai)", "value": "594339dac3042aa63239def00eac801ae83c9227286e75699adb042ea9ac70f65f2752ebf8e43a3d9af75a7c8b0ffa00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382992, "uuid": "43c97868-3f6c-4d02-818c-5b27666656f7", "value": "T1D773AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382992, "uuid": "f5954ab2-8c1b-46b2-9821-340becb5e22a", "value": "1536:9aD/MEGvbwt+i7EhH6Nn8C/0rrnmFxlrKkNGIkFgCJl2c:9OkdzeEhaV0rjglOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382992, "uuid": "b68b829f-e006-42f0-a604-307a92296d3b", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382992, "uuid": "df0910f9-de2b-4000-aafd-aea423f9d63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382992, "uuid": "49c4a44d-b433-4699-a5ee-e3d7ff774070", "value": "8430addb17a50dd8b13e9c3dd8bcb403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4359026c-d1a4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652326397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326397, "uuid": "405b32a7-cee1-495d-8ee3-fd7b19dca022", "comment": "Malware payload", "value": "40f0b27ed4d3a5b75930e33557b26f15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326397, "uuid": "9e7b6b83-00e3-48aa-a80d-194a9695de2f", "comment": "Malware payload", "value": "c9368bffb3efaaf557838b65431b6b6b2d6e97d6f57e40931d415b8fb4ac4b51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326397, "uuid": "bb2b34bb-2ba1-49a4-a50a-e283b11bd378", "comment": "Malware payload", "value": "a4a5fc692e190220923f6501da57dbbdf4346efb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326397, "uuid": "59339e4e-cd7d-4789-a3f6-8a72c62e8598", "comment": "Malware payload", "value": "ca7c7fe354d273addf374279715769d65cae239f3f25c0fcf61095042ff7dfc7a61e8d0d4eac7aa68da299f5e52815e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326397, "uuid": "33cf4454-cce2-45ca-9d49-09625cde3553", "value": "T121A34C89702AC09ED3A84839ACB6DFF335B17D05A980E64736A1BB2E1D7E754D305CD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326397, "uuid": "bb6897ce-d143-45f0-aa2e-35a853bfd660", "value": "1536:WQkqV+nkfts49jmcqpbjS0dcL754ikRr51MYlD0P5n:KqqfGjmcqtjS0dmH5YlQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652326397, "uuid": "e71eb439-94a5-4a52-a2ae-3d73efd802c3", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652326397, "uuid": "818e4fa1-d28c-42a4-bc8e-4e26aee9ee78", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326397, "uuid": "fbc1849c-ca86-4b78-8c7d-feef9445edc4", "value": "SecuriteInfo.com.VB.Trojan.Valyria.6465.13557.15938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adee3f39-d1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652342467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342467, "uuid": "cb62d5e2-763e-49be-a434-202008f173af", "comment": "Malware payload (Heodo)", "value": "d3098b96c652ac1144721028c4533372", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342467, "uuid": "a2a325f3-7d93-4a43-bc4c-be014a147faf", "comment": "Malware payload (Heodo)", "value": "c9d36651bffbf7ff2e44c333179f1227a73e5c9667bd17fa2e3b37e76269eddb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342467, "uuid": "bbaba6f4-be39-49df-9cde-b073584c2bc8", "comment": "Malware payload (Heodo)", "value": "8f245779285ad7ebcbe2144f9cc0d0721baf64e3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342467, "uuid": "d3de8790-bb9f-4c1e-a83f-1d5ed5f64b7b", "comment": "Malware payload (Heodo)", "value": "6ec55ad9438a43a0530ef158a7cf605ff0ea14d9d003b6a49cb2e9b2fd45bd9d330f94296b0162b8bea8a65824ef1d0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342467, "uuid": "548dc0a1-9769-45a7-8b37-3ce7f4886798", "value": "T163F47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342467, "uuid": "a6acdb19-6a89-4eea-82b8-390c32455325", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342467, "uuid": "a245f03d-2129-429c-8036-d13a04cabfc5", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSOjNwgraKRT61cKGNx:S4DzZKnH4nRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342467, "uuid": "1a427cc0-e79e-4761-b1df-65b53ee2f49f", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342467, "uuid": "a285d0bc-ad3b-4427-a89b-11487470b028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342467, "uuid": "72ade5fb-1156-4c32-a7a6-1d0596a77b09", "value": "d3098b96c652ac1144721028c4533372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5959f5cd-d224-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652381410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381410, "uuid": "a6dbb993-5919-4ed0-a3b4-d58f5f209067", "comment": "Malware payload (Mirai)", "value": "82bb7ef33574ffb746e0e3652b46e986", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381410, "uuid": "a54f6f56-92ec-4207-9d15-a8e9d65ae929", "comment": "Malware payload (Mirai)", "value": "ca179b465c8f2240275ad797697ebbe04b59bc32e23022871b0193ce248cdd68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381410, "uuid": "1acbde99-0ae5-4cb6-b854-274b657ba147", "comment": "Malware payload (Mirai)", "value": "cdddb6950fa5fbcfcabf512ddce3aa25a4d75c96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381410, "uuid": "b6716d53-9daf-4ca4-acb4-bafd325bcd0f", "comment": "Malware payload (Mirai)", "value": "b7e6cf265176020236c53ddfbd6ab8f90215590bad846d8a6137f58d9524037858349f8dacb3d2bffc66d4f85b955d96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381410, "uuid": "fa3c3835-648c-4c00-bbaa-eb6b12046453", "value": "T1D1832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D67A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381410, "uuid": "effcb6f1-b751-46e7-9b34-d0ca31eba49e", "value": "1536:NySHwrZKkRozEsK3SU33eZtU5SWmuPeTriW/SnvL:NySQ9Kom83w9uPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652381410, "uuid": "245f17ba-a117-4a38-8912-2606747bfabc", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652381410, "uuid": "4fda4e0a-1e38-4b69-894f-50efd67a4ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381410, "uuid": "c00c682f-c6e3-4a67-af23-159c9b14f19e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9621daa3-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340709, "uuid": "2987592f-ebaf-46ee-ba36-0bcc1d2a4c2c", "comment": "Malware payload (Formbook)", "value": "148b63c2b85f806c7c3036f854b1c6f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340709, "uuid": "5f0615d8-4f0a-43a7-bbe3-7a0ddcaf1ca0", "comment": "Malware payload (Formbook)", "value": "ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340709, "uuid": "8b952651-6bfe-47f9-bb34-ea7661ab42ff", "comment": "Malware payload (Formbook)", "value": "43b8071712dc21a04140a2eae003380b7575f7e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340709, "uuid": "cf4e5932-9172-4472-a04a-e8a3fb6115ad", "comment": "Malware payload (Formbook)", "value": "f1ba241d228b427bb94b4fc6b1a303aa300f0e81bff1e2b08f13b2b5973c1a262a31bf22bc1bb8984461671e3ba0ce9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340709, "uuid": "6376f70c-e832-4a83-a180-93a7f5116aea", "value": "T18B44120076E1827BF9911631456E977B0FFD456A19FA930F0350BE6A3DB62019F2FB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340709, "uuid": "2a38581e-88e5-44f7-8ac1-8cf7dcbfba88", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340709, "uuid": "615476b2-f7bf-42a5-a044-3a806bf5083e", "value": "6144:LOtIOf2ENVkYQYLw8RylG5vgSBGjDsjNoTSU20q:LOLfNVtP/wDsjaOU2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340709, "uuid": "278e1a72-bd68-4312-b8cc-0a5417d88aa5", "value": 259187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340709, "uuid": "f7b8cc5f-63fa-44f1-922b-3b46122ad3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340709, "uuid": "2894baf2-767a-4a1f-bf7c-5af94be069bb", "value": "148b63c2b85f806c7c3036f854b1c6f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21966078-d1c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652341802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341802, "uuid": "27f90793-6165-4f7e-bacb-b21fb8562e74", "comment": "Malware payload (Mirai)", "value": "79d28171dc34b41dd395e7490b91870e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341802, "uuid": "3e043238-b661-4032-8181-c060c2f2e061", "comment": "Malware payload (Mirai)", "value": "cb6d4a01baac8ad3f306f0d299bd1ddc642e4c0f239e82e76c12029ab5414169", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341802, "uuid": "6223d6b3-3a27-414b-a9ae-d1fd1c9075c8", "comment": "Malware payload (Mirai)", "value": "19cfa1f1322759aa62a5436c86a5fc0f02a9e3ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652341802, "uuid": "3af33bd8-b590-4b60-8257-113de46505ce", "comment": "Malware payload (Mirai)", "value": "d22491a233bacb892393ce93ad94c89bc0d21ed2055e5d4e80777b94e5e23c9218120849b143f0a1d21bf5def318213c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341802, "uuid": "c63ca246-d750-4e85-a7cf-c6a7cfc782bc", "value": "T18AD35D46FA818F13C4D117BABAAF42453332979493DB730689285FB43F8679F4E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341802, "uuid": "89806e75-fd4b-4eb6-bbb7-5a8d5ea5c3e9", "value": "3072:Of2l6XccqVKHDGcaeDDP5G+jCNZrEbrEOEM/9fNN+m7wGgWT3:+2lof5+eDDP5GYC7orERM/91N+m7wGgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652341802, "uuid": "d621277d-f505-4ca9-a19f-b38411cb8ed9", "value": 142494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652341802, "uuid": "4ad886b5-117d-4b75-887a-bc3f453f8d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652341802, "uuid": "b254219c-6114-4a50-a6ad-f93db22ec39e", "value": "jKira.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ee4cbf-d1e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652355936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355936, "uuid": "864740db-137d-4757-86ba-894def2925d3", "comment": "Malware payload (YellowCockatoo)", "value": "a5ea4d475c8b0b1f1be8a782aba6b351", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355936, "uuid": "5012e2bf-7d20-46f6-a7ee-e8e8a232cc81", "comment": "Malware payload (YellowCockatoo)", "value": "cb9c52566c22a6cbfdbcd1939e44dcd2b9aa6130a9fffcb1c3b337f3c01333ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355936, "uuid": "e2f55f69-3c61-48cd-848d-2e594c064e7a", "comment": "Malware payload (YellowCockatoo)", "value": "936dfa8d758546d27daf2fb15fdce13c31d06539", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355936, "uuid": "40d424f4-74e8-42de-96fb-d886bb2d5d26", "comment": "Malware payload (YellowCockatoo)", "value": "80fe38dcfe0f071a0b237d40309e14ed2d760183b889b7fdc5e90a18f5511c4a5b2bc4383f3338b4e1bf6e8c0d1736ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355936, "uuid": "da4b2cdb-cf1f-4de8-906f-0509080bc1cf", "value": "T1E0F41324778DDBAFDBED0AE961DB2358C32465F7C3528F8E289400B4CE59A947D042F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355936, "uuid": "d049c20b-927a-4e03-a206-707ed3ab9735", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355936, "uuid": "796332c2-3611-4cd3-8a92-3291c0005253", "value": "12288:xz+7OhYnaXV4aerOqifnRTSpUG0rCruXcrjHboDKRISL:d+qhnFeGnRTlG0TXuH4KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355936, "uuid": "2d9d271f-3cb1-4c0d-a05a-1cad4c49f2d4", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355936, "uuid": "9819929e-2e5b-42f7-a6bd-73e2b4485918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355936, "uuid": "cee57e5a-1fa9-4073-ae4c-4e5b9719825f", "value": "solarmarker05112022.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14daeaa7-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337057, "uuid": "2a2de6dc-4f33-427c-a470-bf544d9e1864", "comment": "Malware payload (Gafgyt)", "value": "b85bb9b59790f9ff86b4be619dfb12bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337057, "uuid": "f5688792-128c-42e8-92e0-85200597dbb6", "comment": "Malware payload (Gafgyt)", "value": "cba860eb6a93e186b7e2c6f48498f8672278545072af110ea280a456af83a545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337057, "uuid": "edf41713-312b-4c9d-8380-6b3d85744030", "comment": "Malware payload (Gafgyt)", "value": "2a3dd729a7b14d6335c461d89dde4b6811654576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337057, "uuid": "2db2feba-4b2f-4269-855c-0448c8244a31", "comment": "Malware payload (Gafgyt)", "value": "af9d9809b8bf1cf4528f46321350e98d41bb9a96c3e22dd57300bb6e479aa59e386c5bfa671dc35428eb167b1bf091c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337057, "uuid": "ac7d20a6-f893-429c-8912-9609847b9ddf", "value": "T1C5B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337057, "uuid": "cbd5e9b2-16b6-4f0a-9f3d-16429079fd66", "value": "1536:ZLeTGkthhSMOCMQS+ZjN4pjuIxreg2O0t2eDo/LUmkiSFxfC7xbXe:Z5HC3S+dUrextTDCLUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337057, "uuid": "268d4345-44af-48ba-a395-4e2aa7ac1a82", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337057, "uuid": "8b65b7cf-13f0-4968-be97-dfb6d98152b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337057, "uuid": "b8f1a9f9-ff89-4e81-a2a2-9d611ced8087", "value": "b85bb9b59790f9ff86b4be619dfb12bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3d4978-d22c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652385064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385064, "uuid": "4017a24f-0031-4aae-8f9c-96ed1208cbf1", "comment": "Malware payload", "value": "cba73251dd6ca5e206ca8b85d683c32a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385064, "uuid": "a6bb2eb3-cc18-4ab4-b94f-64e87cda40d8", "comment": "Malware payload", "value": "cccab97164952af82928530922fcb1a6059567eec580d9e9a7264ba7fd45eaa2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385064, "uuid": "d3a9879f-8756-4359-84c4-80e3cf2f5d2e", "comment": "Malware payload", "value": "fa902bd27b7a491480013bb1ab1e663573bf7c4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385064, "uuid": "e09ab76b-deca-4836-876c-a711757ace7d", "comment": "Malware payload", "value": "0f7465a849fc07884335dc69ab04bfe68820fd6314590fdd0feeea7c37ed7d2b3d6ee61983b4083d6ba3701d66332231", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385064, "uuid": "5b66f9ac-a459-43d8-a4fd-87c24d812e65", "value": "T188F41324778DDBAFDBED0AE961DB2358C32465F7C3528F8E289400B4CE59A947D042F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385064, "uuid": "141cca96-8389-4f65-8622-5395f0832254", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385064, "uuid": "39a35dc1-a019-479f-8b9f-b0955b0887be", "value": "12288:xz+7OhYnaXV4aerOqifnRTSpUG0rCruXcrjHboDKRISL:d+qhnFeGnRTlG0TXuH4KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652385064, "uuid": "f23e192f-32ca-4ce7-82d0-d47241a7ad0c", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652385064, "uuid": "12f90c07-07b0-467a-b239-cabaaf658e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385064, "uuid": "976d4e92-ce4d-468b-a9ca-d2976caa5354", "value": "1b710000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8b072a-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652399719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399719, "uuid": "3ff79bc5-cef9-4774-a434-dd59d4402178", "comment": "Malware payload (Mirai)", "value": "3f5597f2e294e1619c1fe06e6059f8db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399719, "uuid": "871fa783-fe5c-418a-a7fd-ac2509025d82", "comment": "Malware payload (Mirai)", "value": "cd1ebbbf37026d9afbc6069c84ef0d72f290290a86d2c92a795f2967943d4927", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399719, "uuid": "47d06721-3225-4a64-ad4a-376cfba3fdff", "comment": "Malware payload (Mirai)", "value": "195bd02b16e5861d3f2739c6012e2c66aa3be266", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399719, "uuid": "d84c6779-b2c0-41e5-adfd-2fedd302c561", "comment": "Malware payload (Mirai)", "value": "bc9eee4f642802b51b946bde156b691782a5df482b0f5b87e1306d203478eeefc4cb20edfeb5848fe1bf9792d0413edd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399719, "uuid": "285a63a2-294b-4b3f-bc3c-7b0b410e7565", "value": "T15BA33B85B8919B21C5C219B7FE5F51893313077CE3EF32128E285B64B74786F0E7A94A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399719, "uuid": "9adfb9c9-728d-4552-a06c-325dad059e0b", "value": "1536:2AnDvE1tXBHveE0AS1yh3IF8taHWRTdbik6LutWF2zHB5vJEbYd3VV:5vgtxHB0AeOBtaC6LutWF2zhjaqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399719, "uuid": "471995c1-628e-4a4c-9cfb-28642426dd8b", "value": 103964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399719, "uuid": "2dc69406-0e5c-4c43-803b-63ba2f355d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399719, "uuid": "d70fa467-0d92-467b-a30f-6faee8a1e761", "value": "3f5597f2e294e1619c1fe06e6059f8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3ebf3f-d1d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652347139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347139, "uuid": "0cd4e95d-1b42-4fb4-bdfc-56bf32859f6e", "comment": "Malware payload (Heodo)", "value": "9bbaa78456017c75e95998e13a40f4b2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347139, "uuid": "c3f406ae-71ff-42be-b9dc-8f05897a94ca", "comment": "Malware payload (Heodo)", "value": "cd2fd4c61ce82d7f3d2502c0e6465f79928bbd6483875fb6aa12a67cb2fadde0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347139, "uuid": "1e15d12c-6953-4378-9feb-914aaacaadc8", "comment": "Malware payload (Heodo)", "value": "38a715e9e47205c822bf62f8d5703984c23e76d5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347139, "uuid": "a22e4003-17b2-45b6-9fce-8af5d649a7d1", "comment": "Malware payload (Heodo)", "value": "8ae84cbfe73ed50cad234426c8f7b45cc4996b58f3ecde332a9e73c7e09d9829b3c0388d701097c3c120951e21dc5ef4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347139, "uuid": "9158aa89-d3f2-4de3-99fb-9893ec838467", "value": "T17D03834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347139, "uuid": "89b63a66-5744-4380-9802-a0004dc5fa46", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347139, "uuid": "1d877a85-c944-46c5-923d-41aaa5f2f7f0", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347139, "uuid": "a8d565de-e3fa-4aa6-9c1f-c5abdffc71f4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347139, "uuid": "462a004d-bdcf-49c6-873f-c2fbd760294e", "value": "ER6848496403395304282.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f9abda-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391546, "uuid": "527137f3-606e-4e82-b628-f54920ebeb20", "comment": "Malware payload (Heodo)", "value": "0d4dcf93ff311262130b9cfb6a0a0009", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391546, "uuid": "3da02fdf-c04c-45ff-9f30-17cabb8946ca", "comment": "Malware payload (Heodo)", "value": "cdec4ba3a4d80574b720b76c580266f915ab725a4ec442967073ecfee9479fff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391546, "uuid": "ee51e3f1-87b1-4679-99c8-e0a2e94cfc2d", "comment": "Malware payload (Heodo)", "value": "7e4bf744a1366383e159cace8d99c066bc2a2005", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391546, "uuid": "6eff4cd7-1e8f-4c39-a352-60de83982ac8", "comment": "Malware payload (Heodo)", "value": "25a03905328aa6cbb107d71e4285ee77a7e4f707ba4401d3fc48d4a2cfaf9fa3c756c2106a3c630d4f3f208507e6e108", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391546, "uuid": "b68abd66-7f4c-4093-b1cb-fcb67b982218", "value": "T1F2E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391546, "uuid": "897ea861-b289-4e6a-8bef-83df1b0b28a7", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391546, "uuid": "be75058b-dc98-465c-a34b-8b156ee29343", "value": "6144:mkajLyaPIvW1TFpvzYNB1MDB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN886nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391546, "uuid": "85002561-c5b1-4111-a602-eb95f51dd380", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391546, "uuid": "f439e5aa-fb4f-4224-bb84-0299dc8c8c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391546, "uuid": "2d6c7afa-6c32-4742-a27e-d8a29b97a041", "value": "0d4dcf93ff311262130b9cfb6a0a0009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4b4c9f-d1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652350033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350033, "uuid": "f793a49e-082b-4f82-88b4-948bb582dca0", "comment": "Malware payload (AgentTesla)", "value": "b33d6b37e331c56bb2935195fb754437", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350033, "uuid": "4cc3153d-8a93-4086-bbc1-9b7e1a4869ac", "comment": "Malware payload (AgentTesla)", "value": "ce011b65266fac1225e2ad4be1550c4b8dbe8362d166e7415408f593aec1b7f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350033, "uuid": "763beb24-d0f7-403d-8e28-1c4594986b7e", "comment": "Malware payload (AgentTesla)", "value": "4c5af6b1803c0dbdc44ca5dc3b75dda51dc69d13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350033, "uuid": "b7b0334e-19bf-402b-a197-38163f1c844f", "comment": "Malware payload (AgentTesla)", "value": "e3ed0bf6de57f1cfb531a97f9e929cb3cd73fe46c9d8548527e8ce4a5e9431c391dce71fdcee9b91e55f88d18067b915", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350033, "uuid": "f6cfe0c7-8047-41fe-95da-cc4495be2258", "value": "T144C41225B327AA32C29D07B6CDD419EC17709F07AE23C71F18197586A7727928EC136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350033, "uuid": "c992a687-1765-40ae-b4fa-22bb0a517c6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350033, "uuid": "c7b6bc2a-700d-48b9-830e-9fe54d0daae1", "value": "12288:icNYYOKLcqdIzliH9l0PzIIMtymcOyTIqHT/AHbogJA/BmPZYzyiD1:i8VrcAIxiH9l0bIIMtMZLDkHJApJZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350033, "uuid": "bd8dea46-d542-4f29-8fbf-6c2b9584075b", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350033, "uuid": "bf548233-e987-4a79-8d9e-8b8ba1f9d9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350033, "uuid": "49984ec6-dba2-418b-ab51-d4185b61f531", "value": "Mvmsrl 0512-22021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3279a6-d1f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652359804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359804, "uuid": "22152acb-75ae-439a-a39b-4b580fa03e59", "comment": "Malware payload (Mirai)", "value": "a95d93a533a74f4f260b87e7882fa4cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359804, "uuid": "00f3fd88-a0c5-4dc6-a825-09d451d6c06e", "comment": "Malware payload (Mirai)", "value": "cec4142e26a8725b4a4e644417f3ad504d70ba04f1f77a8c00cb366477591a31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359804, "uuid": "58f1c4d3-9094-4d5e-9589-e8f34d1f4420", "comment": "Malware payload (Mirai)", "value": "e8097bcc70bc1578b7cd950ed77baaa2156c386b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359804, "uuid": "0cfab914-da9d-4337-a18c-a96892ada3bb", "comment": "Malware payload (Mirai)", "value": "36f9b82974756629bbd7ca41a7cea7e82eedb9260143c2bcd7a0534f4aec7f51225dacedd4467bbdb4399e0c00148204", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359804, "uuid": "5300095d-db27-4ff7-9c46-3eebbc308830", "value": "T1AFE33B86EA408A13C1D5277BFAAF014A3322DB55E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359804, "uuid": "4e99441f-105a-4203-9c45-975660d9ac25", "value": "3072:t1a5fdUEjnBGrYkRaaWgV9mrsplDKZUmQBKXAVanlX+F8JyvG4hLnAVIl+3jJNx0:tc5f2EjnBGrYkRaaLV9mrsplDKZUmQB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652359804, "uuid": "6777b51b-ccf7-4905-b039-5b2e0424f3fb", "value": 152486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652359804, "uuid": "2f614ff6-7719-42b8-bb6d-fba5c0c58afe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359804, "uuid": "2aaf5ec6-9285-4007-b05a-de4d9c45ad41", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dad942-d20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652370606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370606, "uuid": "aa9952c3-00ac-4257-82f1-c1556a84a1c4", "comment": "Malware payload (Mirai)", "value": "d6b845aa0f61d1a958021d0a59f1d9f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370606, "uuid": "e47fb897-7113-4cb1-be74-62422900d471", "comment": "Malware payload (Mirai)", "value": "cfe5a90a5aaf2239d668c1016c5aefc1ea5005aaa8436a0ee5b667d6dc1c3aa0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370606, "uuid": "495e0228-8eac-4f67-a131-e769363e013e", "comment": "Malware payload (Mirai)", "value": "514b6a76c60cd8d22e1491316778ffe0b3eb4989", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370606, "uuid": "8160dec7-7881-4688-a801-b66f4be414fd", "comment": "Malware payload (Mirai)", "value": "941dfc7f37b2e490c7ff3af543d479b2883bd6b7ee43b858ca8a8a4d13779f3fc466faeb1925a6534924f75f05680962", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370606, "uuid": "315eeb4e-f8c6-4ee7-b99c-88e704ab1693", "value": "T10BB2E025319F6DF6DBB10D33EC5C434723A713BAD2F5A862056C9B68D88660632F8D0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370606, "uuid": "71503f4e-0263-4d5f-8403-7d2d91962b27", "value": "384:hDL68MhmaUXQJyaiD7XSqQPi0DrhNjj0EG2HKNVJ9M14LoiZLuzhymdGUop5hf:h9MhmNhHXqPpJ9QsHMKeU4Ys3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652370606, "uuid": "8af2b186-5dde-4928-9aca-a4ddf6c89901", "value": 24648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652370606, "uuid": "930fc6f9-e710-4d99-8161-84c7539bab31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370606, "uuid": "bfbbd444-8d58-45f3-bc5a-f5a916e4b20c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6819b19f-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652355665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355665, "uuid": "eb712e02-117d-4c6d-b554-4c7af60bcb35", "comment": "Malware payload", "value": "896318d22f9113399f4fdfb94faee55d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355665, "uuid": "de0784e8-1a16-41de-9dd1-fd82a3d74432", "comment": "Malware payload", "value": "d0baf9f8568b46a03447ecb65f5b7f5f94caaa8f50b09884b60e2e1bdbbbc3f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355665, "uuid": "e6b79525-33be-43f8-b37c-965b03f759fc", "comment": "Malware payload", "value": "18e97005f4f9c2dba3b8ba816bea56fecb0751f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355665, "uuid": "7bbc4cf8-e739-49e4-aa9d-86c96544f295", "comment": "Malware payload", "value": "297f8c6f63ae3166fd3aaa42f69eb2b99caca01adf39875d1fcf336c082a9c00429ad66ea12bc834a41a770e1a43d5e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355665, "uuid": "d2916f48-5e81-4697-aab5-9d41e57440ac", "value": "T14C03F12C0149A06DDDA3A87787E9077DA8144F569372E44B3BF3E2AE4D170793716F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355665, "uuid": "12e492f7-c3a2-44d1-9e54-22c1a7808fb1", "value": "768:8fZUJB5VXDTFJPlnuxjY70gCtQzhvZuWMEGmTdwQQlrUctwyJgGlzDpxYsB:BJB5VTTvPVuxjYwZalRuWMEGYmQQl4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355665, "uuid": "263d6770-8b4b-4f4b-9506-e42e8dc6fc78", "value": 40416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355665, "uuid": "63c75f97-e0d3-4185-ac3b-c17b5ca4f58b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355665, "uuid": "01b31727-1195-44c7-9790-039e1c17d207", "value": "896318d22f9113399f4fdfb94faee55d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc3ea3a-d241-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652393978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393978, "uuid": "6e5e9131-29d6-4da4-84d5-1a3e7cd900e9", "comment": "Malware payload", "value": "178e9e23b589b663a59d0a12e2c35a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393978, "uuid": "b41436b0-e116-44d7-a242-651929599784", "comment": "Malware payload", "value": "d0c19bd409c6c32da0bc11c04298b89ee2ba9cd5be11123494041c724437c58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393978, "uuid": "3ae6a33e-02de-45bb-9977-a40e98fe4836", "comment": "Malware payload", "value": "def3007a6276998fecb9159b63c78cd505f4fa41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393978, "uuid": "6e1891bd-a6f9-4b94-91df-45b6bc780b05", "comment": "Malware payload", "value": "e9237b650962ffc784f66848e101bfe3014c6b662408ab580492579dc3d0cb56c3d4e3e1aeb719ddf22259b2a817036d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393978, "uuid": "58386f30-2d9d-4b69-8a34-fbfb62f349e2", "value": "T1EDE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393978, "uuid": "a7ad510f-71c4-4400-abfe-f719a6b6e1ad", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393978, "uuid": "5b8d1dc4-0eeb-4911-a6cb-4d556b5cd596", "value": "6144:mkajLyaPIvW1TFpvzYNB1M2B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8H6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393978, "uuid": "a76a0a08-68bc-4851-ae1b-c1d64a9619bc", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393978, "uuid": "600ea387-77c9-45c4-a997-c7ca51f52c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393978, "uuid": "3c517d9f-deda-47ef-8d77-c0e2bd5c4b69", "value": "178e9e23b589b663a59d0a12e2c35a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b60f18-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337675, "uuid": "04fb5e02-4f24-41c1-85e9-f1e52f06b2f2", "comment": "Malware payload (Gafgyt)", "value": "b6fd0a0f0e2a7d947d9bdb59cccc519a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337675, "uuid": "6d732e0d-39f6-419c-a4d2-43e9f257e6a0", "comment": "Malware payload (Gafgyt)", "value": "d18b6736660625a01caf28de7fb817b837f39193ca7e3316e3f32e2e86cfd814", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337675, "uuid": "04225f97-74de-48b8-800a-76e66681ce7a", "comment": "Malware payload (Gafgyt)", "value": "b6dc8bc36fc88f08efc3bdd8e3a10ecbf9b3f79b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337675, "uuid": "e89a637b-a21f-4d84-9c62-bcc7970fceda", "comment": "Malware payload (Gafgyt)", "value": "94eb8322ea6b89e53018e11ffd05c81e1c161a6737363d6446d6046eab323445042a25f1e94b7cc6e7a8e9d7b3ab077c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337675, "uuid": "1716ad82-384b-4936-9dab-12bbebda9fff", "value": "T12B930892B900EFB6F40ED77A04D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337675, "uuid": "14d5c1f1-ea50-4bce-ade4-f375e7c1d972", "value": "1536:4mZVaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gM62f7vTmQ9VqXjewf2Le:vYp09W6KTG/IB6Yy36xNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337675, "uuid": "91ad8d6b-9b91-48a8-b59a-e0f5af65b41d", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337675, "uuid": "d2051a86-b3b2-453f-ab9a-e3637bbfa641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337675, "uuid": "c5d441b2-0b94-46cd-b328-1bee12ad40f8", "value": "b6fd0a0f0e2a7d947d9bdb59cccc519a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd7fe0a-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337075, "uuid": "6140138f-f715-4606-8fdd-ce2364779593", "comment": "Malware payload (Gafgyt)", "value": "9caa9e13ef425ab5c26afb19618a9c77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337075, "uuid": "a19128ee-baff-487e-a703-a5d9ad05ec3e", "comment": "Malware payload (Gafgyt)", "value": "d1d835e27b30d15141663daf873d2d8eb814f77d936777e0863bde772ee10778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337075, "uuid": "3a5e45c7-5f6b-4bab-bffe-51a873ca426d", "comment": "Malware payload (Gafgyt)", "value": "2c4afde7f47a3c44e6a8159906306d0fa28b94a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337075, "uuid": "fbf51cd1-7919-43b2-97a9-a49284376af3", "comment": "Malware payload (Gafgyt)", "value": "1360fe2bd2ed03a0d99fb7f209177e98e544acf63edbc21857ba31b593139e84fbeb508accecb3d881d0b80e12c5c762", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337075, "uuid": "f0b5f1a8-23f4-4f59-aee3-6da0fd02cfe2", "value": "T187832A43B72D0B43C49B6AF12DF72BF187A9F96117A76180A10EBFC44772AB02512F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337075, "uuid": "06509de1-94d7-414b-bc8d-3eac33eaf232", "value": "1536:tQe/XQMozMT/aj5ecEo39igRNaSo3y6VZCEmQ9VqXjtWf2Xe:tNZrSUcEo3tPKyyCEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337075, "uuid": "137c1e4e-96eb-407f-8aba-32b0071bd340", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337075, "uuid": "0a9db0b3-918a-47f0-8e37-bf61cce07ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337075, "uuid": "1348408b-47f6-437d-b054-f247ff20431b", "value": "9caa9e13ef425ab5c26afb19618a9c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24aa9f59-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "1596c971-8f43-4330-994f-3684b237cd4a", "comment": "Malware payload (SnakeKeylogger)", "value": "b221eeeb59a95a2318c47771cfca7e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "34ee7b7d-5d09-48f2-95d5-35e278583921", "comment": "Malware payload (SnakeKeylogger)", "value": "d22e6e9ecf1b75744b836d547e109a666085e00522327000ceaa48c5bfd09fdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "3075e198-1469-436e-8249-e222f6234724", "comment": "Malware payload (SnakeKeylogger)", "value": "673d8568fce658073c12abf0f4e10e2d3906ea49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337083, "uuid": "712c7f79-6a50-4f87-bb60-f4225a6cccf1", "comment": "Malware payload (SnakeKeylogger)", "value": "3d07e6b4342801fba7a7c643673214011bbd06ce742cc13fd16d471b5a0069d0b7772d6d416d68551b5af770fd8c2c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "1a598311-b1a5-4db7-8674-74ace538828d", "value": "T1B8D4F10077A84BA6D47C07F86A36851507F17C1ED622D79A0ECEB1EF1DB3B014A52EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "da871bdd-0ddf-408b-8faf-fc5a389b0277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "fa2f9359-1aca-406e-b4fc-f9069eb8a266", "value": "12288:c09u9WRvkP87aF1rn+4X3TZz2fRsrBvsQ2r:Xu9Wtjarn+0ZzL10N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337083, "uuid": "f8b45065-aedd-4961-811c-6a5645846337", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337083, "uuid": "0ddb5644-42bd-4f15-9b95-2fc861cae6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337083, "uuid": "31664dd0-a17f-4e88-9bff-f4dfd2b6b8c0", "value": "PLvgIXOA6HzaJQW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78beb555-d1ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652342808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342808, "uuid": "ff8c942e-58e5-4d29-9fb8-a3c83211411c", "comment": "Malware payload (Heodo)", "value": "17405af200d73c164f1cc2fbee421f0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342808, "uuid": "e0611ca4-e62a-41ea-b41b-c50f9e985c86", "comment": "Malware payload (Heodo)", "value": "d2ca9798cc615221a1a435df9ec413ed27c3796bf255870b7235b8538c019175", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342808, "uuid": "9be95762-9e4a-48ba-b3f7-e27039685e92", "comment": "Malware payload (Heodo)", "value": "e5370367e3df97fa20e5ade6e562d9bb017213a3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342808, "uuid": "84678a4f-f315-477c-a4cc-760e443b520e", "comment": "Malware payload (Heodo)", "value": "ac0eb26f230eb4d3d983e13250e12c328686c6293c34f048f979c5b7c91df6efcf08dbe46209c8a09b54ef7810c75a18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342808, "uuid": "889c453d-1aa9-422e-b882-11f5f4fc4d72", "value": "T12EF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342808, "uuid": "7653643b-c08d-4566-af44-676c71017581", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342808, "uuid": "dc9a73f9-41c3-43a4-acdf-3214100fdaf9", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmStjNwgraKRT61cKGNx:S4DzZKnH4ERGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342808, "uuid": "0de7e3d7-737d-42b0-b852-e8c9dec91bd1", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342808, "uuid": "7aea7d60-c9d9-40e7-9d91-f8e88031608f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342808, "uuid": "6e9a97bb-353a-4e4f-83f0-79bf8139bcdc", "value": "17405af200d73c164f1cc2fbee421f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f6ca00-d23c-11ec-8e58-42010a9c0032", "comment": "Malware payload (XpertRAT)", "timestamp": 1652391787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391787, "uuid": "aff375d5-b5de-4759-9866-e879b25cc804", "comment": "Malware payload (XpertRAT)", "value": "d1d7f23ea413b011f029e5d97890c41e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391787, "uuid": "a2796838-e993-4dab-ab12-d63d63a027cc", "comment": "Malware payload (XpertRAT)", "value": "d37b127c493bbf59bff2017e49513c0f80a5db906715f5e22bbb23d24c2cca3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391787, "uuid": "56413d4f-4c36-4dbc-b22b-a633e72472dc", "comment": "Malware payload (XpertRAT)", "value": "82153f7e21609a7dfb1ee98e56915393bdb504b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391787, "uuid": "c3014725-c185-43ca-ab0b-7b73eaa3dacf", "comment": "Malware payload (XpertRAT)", "value": "155736f048fea0f63a0aca28771c4e5954db8d345b575eccdc6849c24832b45be4ec9f38e9bd0ee0de7b97690c86a6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391787, "uuid": "156e56c1-d322-47df-b45a-3cc335cdc220", "value": "T1C9B4122931E83B62D1BAAFF81074300603F6A3263552F76E5DD520DBC6A6F554360EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391787, "uuid": "20cbe512-1c96-41b4-8242-9a79cb3a3946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391787, "uuid": "1f1708e5-7148-47d3-9ec5-1645978161d9", "value": "12288:7O0OyIAJCtCOqOHg4FZKskgpd/7rgZ2QRPE8X8NE/Ac8+K:60OylICOxg4rKNgbrgZUE8NE/Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391787, "uuid": "955b34fd-aa64-46f7-ac68-5b50ddbe93cc", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391787, "uuid": "282c214c-feb3-4dc0-b8b0-9600a4490d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391787, "uuid": "15a9a75f-0649-4cab-8ff4-62b72af893fb", "value": "SecuriteInfo.com.Trojan.Siggen17.50772.426.3507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8251493e-d1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652350125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350125, "uuid": "991932b8-341d-4e4d-8d44-7162b026996a", "comment": "Malware payload (Heodo)", "value": "5bf35196c653d521af1928837f9dcb55", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350125, "uuid": "e5e376e1-5cca-420b-bb84-280eb615685c", "comment": "Malware payload (Heodo)", "value": "d37d449b03ff0cc59147f985ce8ddafcd5c92d144103d88d0373cc4a1a74f0a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350125, "uuid": "6d468aa2-2f26-4cfa-912a-74d645d8110d", "comment": "Malware payload (Heodo)", "value": "6eeb95bbb73eb1e71c9922227d16d98f9c2c276b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652350125, "uuid": "00c32798-7590-434a-a98d-c727ae19cfbe", "comment": "Malware payload (Heodo)", "value": "99477456356be38f01d30be9f1b98a5233a36e494a1ca4c1643bca568ed3d2d1e6aaea813030d934c1d7337dff1512ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350125, "uuid": "1bfe71fc-7e38-4778-a04f-9094e641dedb", "value": "T1C903834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350125, "uuid": "f1db8f38-a45a-4eb8-a74c-6c9d14b10a13", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAg:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652350125, "uuid": "bb9aa1d7-f8d1-4b36-92d7-f1346ae6ae9d", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652350125, "uuid": "5391d11b-a597-4ec3-a6d1-ab5f923d5206", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652350125, "uuid": "0703c8ac-5ab8-4654-b2e9-db93af320b48", "value": "Rechnung 2022.12.05_1200.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d009db-d202-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652366667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366667, "uuid": "2d55e254-056c-4711-b659-4c06c1524e2c", "comment": "Malware payload", "value": "23d3da6eb59fd0b03ccec302d25af1b4", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366667, "uuid": "e978049e-27c5-42de-a0c2-aaa90c2cd81b", "comment": "Malware payload", "value": "d430f76d922ff9d8e19cc0787ed5d747f74c468d6049a2863e9420cb305ca065", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366667, "uuid": "691cf719-8ece-4e05-80af-b4acd1714e02", "comment": "Malware payload", "value": "bf8912385053e7c3947c1f6e784edd0255d25a9b", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366667, "uuid": "d1eb98dc-d8bb-4121-996f-6c391cfb6977", "comment": "Malware payload", "value": "0e31195a6a2a2458d80edb5faac9c5d15ec783de56edd04321487df453cdefe0f9089b3218cbafb9ca6fcf45f0a7cefe", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366667, "uuid": "6c21e5ca-534b-4e57-b702-0367f8e02aae", "value": "T1BE119BD57EAA41C4D50F4E74CF654D4357C8278761FDD825D30F15850C511E1775815E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366667, "uuid": "31a0b007-9929-412a-bfab-c8e4de4185ab", "value": "24:9R3IGmYEqhM31N+JRYtT2GGEnjio+xgVzKyHH50l:9Rz7Ex1sJZEnuLxgVF50l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366667, "uuid": "62ea8d3b-09e7-49ca-a379-171742651432", "value": 907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366667, "uuid": "dc63b0ad-9fa4-4f6d-9e44-f2959007c1cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366667, "uuid": "966b7b2d-7355-48a8-a5c8-c8ad2f4d1c18", "value": "U125702573.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab770892-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317982, "uuid": "be195a92-96d7-4cef-8b1f-691502d9f6c0", "comment": "Malware payload (Mirai)", "value": "ad1991b615d9bf04dc6260c9653cf5e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317982, "uuid": "9cb7b0b8-2f3b-4f1b-acea-0a7812c47e52", "comment": "Malware payload (Mirai)", "value": "d4a85def79f2ed38cee0dee47822123eda8967178dce2b9777ecfb64d9158427", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317982, "uuid": "d4474cbb-b886-4f7a-8d81-9d52a3ef841f", "comment": "Malware payload (Mirai)", "value": "3128b3aa24880a075076c8163fcb3aaf375e9f52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317982, "uuid": "46868ec9-1372-4401-9e60-5792f6db394c", "comment": "Malware payload (Mirai)", "value": "06c1696af2f29b496e93abf6a285541af8f3cd8ef312b07aebe349161361322e4f02a4d78c78249e143e54da47a869ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317982, "uuid": "763cdc63-3ced-46cd-82c9-21e9fe5c70b8", "value": "T16653BF71D46A5CD4C2990634B2EADE382763B804A5632EF1491B43FA940BEFCB2193B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317982, "uuid": "26ca3887-a492-4770-aa61-c3dc3c642530", "value": "1536:Ckaujos/XkfCu6qIYAoH2O7smFYyBhJIKNfpA1CzDtO9d3nSr:5ZtA6AAeHsidIifpA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317982, "uuid": "2b1472ef-d80d-43b4-bf04-620e169af652", "value": 66680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317982, "uuid": "f059c162-07e0-4d00-842c-e125ea0c3c6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317982, "uuid": "e7db5909-2a75-4756-b64d-2fadb7b09de3", "value": "meihao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf2b8b1-d227-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652382973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382973, "uuid": "3619873f-5c10-480f-8382-e003839d44d3", "comment": "Malware payload (AgentTesla)", "value": "5d27e82459861cbe558cbe64f1a94b70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382973, "uuid": "c3dcff5f-e991-4393-846a-528a6b7db5b3", "comment": "Malware payload (AgentTesla)", "value": "d69bc873e4dec60fc11bbdaeddd92dd368d39a40f9f32a716b00af08a80ed051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382973, "uuid": "f7de306f-01cd-4df7-a97c-78a791b1aa6b", "comment": "Malware payload (AgentTesla)", "value": "08dc4d0ac0442b1b81116bd38793f72ab82f3060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382973, "uuid": "115f9cf7-1e41-4c6d-90bc-c2283453c3e0", "comment": "Malware payload (AgentTesla)", "value": "d62f58465b3cd85c96a468e96e5ef31c3f68258b6d937c73d5bc06893163b7026210475d4cf2d6bda539b4cc054c94f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382973, "uuid": "a120b449-bda6-4177-aeb1-9b0dc9f9ea36", "value": "T1F484225B7474D9B3CDD2213109736536EFDEC9202A1365034B64BB887DFB2826A5FB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382973, "uuid": "156779c2-83e8-4537-9a24-2abc46e02f5a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382973, "uuid": "7ddb451d-b800-4bcc-b2ae-f6c60dc7f37d", "value": "6144:LOtIO0hATWhS1Tyo5SThQWYhGgyFQ9+XFoXBf6gSmAdUkuhj6C1NQBoGYAcE4GHh:LOL0hWBy/ThDoGoXUgPkC1NQA2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382973, "uuid": "39799077-09ae-4037-9e27-0986e3e9a45a", "value": 390346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382973, "uuid": "a3f6c7c2-9109-40c2-b864-e7293b23d24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382973, "uuid": "7148e44f-761f-4424-8a98-72a020884cff", "value": "5d27e82459861cbe558cbe64f1a94b70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836d153c-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652340249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340249, "uuid": "1e23084b-304f-4625-b595-7edf92a5af6d", "comment": "Malware payload (ArkeiStealer)", "value": "7fa7a912c6c5bc0202c0b304a099d03d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340249, "uuid": "09434294-d8fe-4f96-8fea-7df3cdd794df", "comment": "Malware payload (ArkeiStealer)", "value": "d7a502706250a4dc3f0adb323870025da07261628dddb00cb21e84e219967e62", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340249, "uuid": "6174152f-50c1-4cce-a59c-d2f96ed0def9", "comment": "Malware payload (ArkeiStealer)", "value": "0cef0fa1ebcf44d72c0794939f04008b23cfcf79", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340249, "uuid": "99ff5454-57f2-4195-abf9-578dbffc1465", "comment": "Malware payload (ArkeiStealer)", "value": "74c632081a52a3791e8c4bdf3b9bd14513dc90fca0dadc59500b38430ae0030e8478e04b0a9dc40537a08a60d040b271", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340249, "uuid": "36430002-df76-4419-88d9-c0b6b4a33533", "value": "T1F6317D54AEEB2B10E2B7A739B87F6251C439391FF615CE8D0081E34E1857B25942DE3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340249, "uuid": "1b896f9b-78b0-41a1-8655-003aa2379a8e", "value": "48:8iBso+llqqTyydtqYqSipZp6CfzIApEU:8iBJ8l2YSv8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340249, "uuid": "33647b84-af4e-4bad-b9b5-97274bb9c19d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340249, "uuid": "ccd8045f-281c-4d54-a563-676c5b1a71bb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340249, "uuid": "de1e9b20-18d5-45f1-8aba-dedfd93448b0", "value": "Kaufvertrag.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8168b5e-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652379394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379394, "uuid": "5eab160d-616a-431b-9426-63fd534d3f02", "comment": "Malware payload (Formbook)", "value": "611aa8e3435ef26a1086c04f0defc0d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379394, "uuid": "596a9982-e4fe-4e39-b2f6-701da7499188", "comment": "Malware payload (Formbook)", "value": "d84c53608acc9f52ee13a78e430dc1458de7dc5fb690e4514bca9c364a3ccacf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379394, "uuid": "31e64083-fc37-42f5-8367-c302453b1bd1", "comment": "Malware payload (Formbook)", "value": "68c49ab3ca28bdf9476a7f0acafadab4324f5172", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379394, "uuid": "efc96f78-2368-48b2-8cff-8df35c0f4d5b", "comment": "Malware payload (Formbook)", "value": "5097313304141143df9050f3d758c95351962af53b19c1cf98a182c043af6d69618395ec38981e2b4e58dd55789ca60f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379394, "uuid": "75123f07-e1f5-4a85-9e61-a4ab67be0633", "value": "T1EA0412D962C01D47E7A3E772EAF988273469BCE0017E4B69362D7980B3737284DC09B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379394, "uuid": "554ce28e-e97c-4665-8d00-01464ea4be38", "value": "3072:sG2OkVgmuRvcKhVK9xB2nAFvVszsIQH+cnbHvKBMNGltHtk+NhncPXwwRKjN:6OkV4vcPlFvVZIoTbHvJutf8Xwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379394, "uuid": "1a063158-e057-4aef-bac4-40714ad5ad25", "value": 187880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379394, "uuid": "f6bbe1d9-e944-4558-8a43-c6fc2bfcab5f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379394, "uuid": "29a68339-e5d2-4296-a92e-01c2fee66ac9", "value": "ORDER M52022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1306eefc-d1f8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652362394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362394, "uuid": "6a0edd24-8a71-4c83-acad-60861954c53f", "comment": "Malware payload (Mirai)", "value": "e8522cfd69e6cf2a598d8a6fe4093071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362394, "uuid": "0d99f564-43a4-4336-9a15-f54e344d5c49", "comment": "Malware payload (Mirai)", "value": "d9a660db87e1712569cd330861c8fcce9b69f96709acb4bf9c857064c7afb469", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362394, "uuid": "3c0603d4-cf65-44fd-b496-99fd512de5fe", "comment": "Malware payload (Mirai)", "value": "22faccb9fdcdd4f8bc9d8c283c71c010678707b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362394, "uuid": "ffc3cddb-8dbb-4636-8f60-a25ab45d905f", "comment": "Malware payload (Mirai)", "value": "2004018d3ba5ab705c34812f4a9bda5b090dea8e8a4c6336a00d1899828709dd2a6d1c21beb948579c5f1d78e0edff55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362394, "uuid": "edf8e540-16f4-4d93-b498-48e5159c6df8", "value": "T1BF533A9D28420E2CE9D35CFD54228F0BED562310A4D71B0BA69EFDC37EB3369AE12545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362394, "uuid": "c5039bf4-220b-4a7d-9057-12a4cc2ee4df", "value": "768:wPCi/x3CqmzaDuLmaEeB4vvKjxXB2WEaPP+WUvFWcFNw7Iv6d+f1prIRULQek/:oCi/EJzYuLmaEIL+547IvSg1pERUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362394, "uuid": "7dc5e471-2798-4b65-a062-3832e5d9e7bb", "value": 62100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362394, "uuid": "c3f84f99-d2f7-4b81-8030-63b3cc5c9c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362394, "uuid": "d452847d-690f-4b1b-b3b9-c1434ee81809", "value": "e8522cfd69e6cf2a598d8a6fe4093071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65037c56-d1f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652359954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359954, "uuid": "86308254-bfdf-4903-b987-f0b6a7852463", "comment": "Malware payload (SilentBuilder)", "value": "7bcc5d48e0fa7aa32177adec316399b4", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359954, "uuid": "cefb2dab-e225-481f-9f6a-a2de4395133c", "comment": "Malware payload (SilentBuilder)", "value": "d9b26b715bc02321ececa73356414b3fdd33b0be5889ceb3b292c3ccd6a093d3", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359954, "uuid": "10bccab1-4358-4ecc-8dd4-41adceafe009", "comment": "Malware payload (SilentBuilder)", "value": "a6f050f58674f342a7eafde9383a7088c207169a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359954, "uuid": "43e105dd-239e-412e-96ba-eae49f87c240", "comment": "Malware payload (SilentBuilder)", "value": "cc42f074c58de422404eb5483b7b49db4e9ad80fa22d483ff3b568c60750a1fa14129169dd49474c30c66984879bc9ef", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359954, "uuid": "442f8db9-858f-4468-82c5-93d496f2f522", "value": "T10E03834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359954, "uuid": "e81c2782-08e9-43c2-b5e8-5d8a590ea76b", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652359954, "uuid": "ad055f8c-9bc0-4e23-8cef-5e805bcc0d29", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652359954, "uuid": "92e74139-ba29-4687-9558-b5e4675b313c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359954, "uuid": "c2cc9097-c1f2-4609-8768-5ad2f5743ff0", "value": "Gmail - Documento.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f413564e-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652338720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338720, "uuid": "3b2eb964-5199-42be-926f-9e1a01ce50f8", "comment": "Malware payload (Loki)", "value": "89fea7bf996125881bdcf7dd38de31c9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338720, "uuid": "75ab87f1-3928-4060-88c9-51db0bd75fda", "comment": "Malware payload (Loki)", "value": "da4d52757af4422f50f5a6ee4a93b54ccd0463e7d99790d883dfe0e159f08baf", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338720, "uuid": "40ac2238-b204-47bd-a4e9-725f2edb45c3", "comment": "Malware payload (Loki)", "value": "1c29579d48b2d5c4913b40db899441582972399f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338720, "uuid": "c3e6595c-3c23-4aa6-b201-348c334302ff", "comment": "Malware payload (Loki)", "value": "a205e192a1e17ff1fd1fcac5173fe7c1b9168ebbaed5248936457aabc00201e1991055a7d83c8b16097fe0612d134ab0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338720, "uuid": "5b0e1317-0811-44c8-9b82-a038ecaf7197", "value": "T10E0412CC3967BB28C13815FA6374903156FDCD9198B29F96ED06BC55D3F08A290723AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338720, "uuid": "0880ee63-5725-4512-86aa-87ebe16c3386", "value": "3072:VcCZBVLnW40Yw7VyBEYqv/5Pz3n2Kbyi+bhVtMzA70jFJuDkJWStAO/ns+HHmKh4:HBFW47ID/57xbyi+V3Z70jFQkAleFVh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338720, "uuid": "3e2bdd6e-5154-42ff-bc57-7ed00d5b98c3", "value": 188376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338720, "uuid": "c30062ac-3edd-4abb-966b-fb7ac366d680", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338720, "uuid": "6ebf7e0b-e8d3-419a-974a-ed845bebbed1", "value": "remittance advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353504f6-d1e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652355579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355579, "uuid": "f7e93730-a880-4c2d-ba31-aef41d6a1372", "comment": "Malware payload (Loki)", "value": "f0f88a07d09f67166c66928fba2acec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355579, "uuid": "bc8baa90-9e5b-4860-98e6-4a37390181b4", "comment": "Malware payload (Loki)", "value": "da6abf1cf5f714cb5ce1529f5e2ef93201325fb9eb45af81fd22d82fb3857d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355579, "uuid": "84acf4f3-98dc-4943-b434-0b13b30f73db", "comment": "Malware payload (Loki)", "value": "df73292977606a0a5d5b53bcdf638dd042b8dbc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652355579, "uuid": "b4e477b6-37e6-4607-887b-2eb1d241182b", "comment": "Malware payload (Loki)", "value": "8c34395aa362df35a9579128b689bfc33f8796367769d7398f3eb07f5d9a5ab5cdbebda86f08a28f6b12c32871f202fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355579, "uuid": "bf694c12-e34f-4718-91f2-51d17f211382", "value": "T1E7134AD6A75EF1B0D6084A3FDCDEDE1492A0DD411912D81B20A87E072A733D3CBE569D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355579, "uuid": "ad52c461-c52a-4b5e-8183-1591717ecde9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355579, "uuid": "15e5f4bc-bc28-4da7-b98c-70389b3b6093", "value": "768:qfhOwT9FqtcSGbyjV4BJ4gSBJ/yZmc6O52Y4Gg:8PT/ZbU4BJ4J64cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652355579, "uuid": "60f3bcdb-cfce-44b5-adef-29c574eba4bb", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652355579, "uuid": "2401245f-ed03-47bd-b2e1-563628bb9ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652355579, "uuid": "da3bb0ce-646e-4386-b9f7-cfd759ff3f10", "value": "Item List 557 & Photos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3c3132-d190-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652317931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317931, "uuid": "ab855d0e-f055-4f96-892b-0954229fbeab", "comment": "Malware payload (Mirai)", "value": "460d7fe1f69d9aadbdef69cac753008e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317931, "uuid": "d631f7c1-2e01-4ae5-8f5b-baf79aad5b7e", "comment": "Malware payload (Mirai)", "value": "daa6592ee559505d7d594a6c3f7a6cb4e88259c3897234879d351d2505f91147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317931, "uuid": "7182c6f3-4751-4e57-bd13-154ea44a6281", "comment": "Malware payload (Mirai)", "value": "7765504618234d82bbd2ec33529066bb26580131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652317931, "uuid": "58e2eb92-8752-4b79-b616-c7a69f154a30", "comment": "Malware payload (Mirai)", "value": "2a9a7cc6d9655c51a35197b13f06da2b45b6ea00b41e3ff7323becb004f338a990ea827ad3708088a9d93afcd674d2ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317931, "uuid": "fb5c04b0-b93c-405a-8643-3bfcd5b04183", "value": "T1F0F2F1B1B3807371C7712CB674AE03507706B2B6C6EF6E26370ECA98D66325B6769805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317931, "uuid": "94541190-5313-4a96-9a19-7bfd6a604f82", "value": "768:Eg2mD2Z3a++9mlbJhHTdxRk1jQ8jMom2I3rGLCdlQ/GRjjrILH79q3UIl9:Eg2mqjVhHTvu7MfNd1dwKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652317931, "uuid": "5009c87f-cfe4-4408-aadc-adf25e235211", "value": 35244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652317931, "uuid": "b93b7082-b342-4822-811e-1882ec1c2b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652317931, "uuid": "7fb2dd29-9258-4926-a82f-9adff827f236", "value": "meihao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6707d80-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340737, "uuid": "0fd40a1c-f135-4e58-8f98-1cd211a22292", "comment": "Malware payload (Formbook)", "value": "706a52c35a1c1186de5b098fd6cafd8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340737, "uuid": "a30bae2b-e106-4fc9-ab49-a4883f9e2f27", "comment": "Malware payload (Formbook)", "value": "dacb77cc1043b74ae83d504072258f6157c6bb72fcf340356cbd932cb10bbf28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340737, "uuid": "068120e7-a7fa-47dc-90cb-63bd4a83db3e", "comment": "Malware payload (Formbook)", "value": "a4adc3ef6f5e5a97bb1c36f24ecf07bb7533e427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340737, "uuid": "de6fb467-ae69-4adb-9f7a-b62c5c8fd963", "comment": "Malware payload (Formbook)", "value": "9b294fb3da3ffa4898879b2cded32aa0d47667da52e565e8dc0e83f0c7add9f6d086539b1785d6be712866ccdd2ee261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340737, "uuid": "d3c8cc12-f166-4e86-bad9-31fe0d5a70b2", "value": "T104441210B2B1E1B3E8621271AC2AEF7B6B8FDD2500F6570363413D55BD6A7C2E81DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340737, "uuid": "fd09b800-e596-49c8-bd65-6184563662cc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340737, "uuid": "a28892cd-8c69-4c9a-ad53-9c21002a89d9", "value": "6144:LOtIOhbpPISFI0FnvlLu6QpVWXY/XoNepvUZIuvMdKOP1RI+kd:LOLhbSF8nvlLu6IVWo/3vJuvvOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340737, "uuid": "c1c9f2ec-5569-413c-8fae-20114b07435d", "value": 259310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340737, "uuid": "e160aa47-18ad-4174-a79f-3ce57c98fcca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340737, "uuid": "ec1bfa60-baa6-4e3a-82c7-f6a39e4047b0", "value": "706a52c35a1c1186de5b098fd6cafd8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c16fc2e-d1f8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652362382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362382, "uuid": "f8449856-75cc-4488-b7bc-8091bcf2e987", "comment": "Malware payload (Mirai)", "value": "38722ab5f23b3dde921f781c1e181f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362382, "uuid": "9503dcb9-1382-4d3c-aee2-faddf7c310bf", "comment": "Malware payload (Mirai)", "value": "dad06d8d972ffcefab72bc278dcec9630d51e07dd4b5ccb9a95ec460e101489b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362382, "uuid": "8d918b4f-bb59-496c-9eab-45f672dc0df9", "comment": "Malware payload (Mirai)", "value": "2ce300fd86ac7808dddbcaaf34d6f3310bd6037a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652362382, "uuid": "130b6093-f236-493c-be97-15d733a29969", "comment": "Malware payload (Mirai)", "value": "9d9e8a4386f8597b6d92a120366592fc96158a9175e9aadeccd84ec8e5a1056dec02d8aae51c994f50e6692fa1dd7582", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362382, "uuid": "6179f193-835f-442d-9086-da10a5678ffb", "value": "T14DA3944ABF215FB7E89FEC3745E92706288D611720A93B79B934D904F21B31F19E7860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362382, "uuid": "2b8d8806-0043-4399-84a8-b43aac510036", "value": "1536:a2fsCDpMtQagM6PkH406j5Tb06wnDQhPqf/Jc+n7bdEgvchAp/:a2UCDpMtQagM6PHj5P0tfJE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652362382, "uuid": "9d9b14f0-c798-407a-8a59-66d5a3c04b65", "value": 101676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652362382, "uuid": "4892000f-95b3-40de-87fe-c356b5fe94b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652362382, "uuid": "3cfeb8c9-8c46-4140-b2e6-eaf1033203d1", "value": "38722ab5f23b3dde921f781c1e181f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf13aacf-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338657, "uuid": "116ea343-b261-4e3e-929e-92551ca27fbe", "comment": "Malware payload (Formbook)", "value": "45ad0ad3590f1760cec268ac36a57ca7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338657, "uuid": "6925bddf-67e1-4ae7-9bc0-479fc0d5b1d2", "comment": "Malware payload (Formbook)", "value": "db09d4c4f4e6cdd534b6d0d261c03a2647d96252c85480f5b4004db774dc6d2d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338657, "uuid": "55611524-6fde-4474-bbaa-ecff58273d69", "comment": "Malware payload (Formbook)", "value": "0e91d14448258e47275ca0634289f40848716445", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338657, "uuid": "a5ebc44b-dc4c-4253-a9dd-f39be3c19172", "comment": "Malware payload (Formbook)", "value": "5279d78dd07ceff4c38908d209e966f0ba8ed9ce99b7d0a7c0734cd8250f8afcfc35899aa9533000a8494b0b3a16453b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338657, "uuid": "ac64946d-1e0a-4c54-ace7-dbf46c85f25e", "value": "T1390402611E20CEAED1C24C7C3838A991B1D5CEBAB44C8606F192359EDFF6B419D84B5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338657, "uuid": "3306bb22-6e44-43f2-b75a-d92d5fb627ed", "value": "3072:u6tZ51aUF39UzMwdz4/l/qHfXzsUd24/4M9wBLU6WYMnP:RZ5gUFyzXz4/l/ILsW2omdMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338657, "uuid": "73049622-90c1-4763-becd-0706e49ac992", "value": 188168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338657, "uuid": "b84ca393-3b07-472b-888f-540ed4411607", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338657, "uuid": "50d3363b-7f82-4483-85bc-7e1a46359bcc", "value": "MV LADY FLORA 47K.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46570892-d248-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652396840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396840, "uuid": "15e62e80-ae54-4505-af80-50c109701c1d", "comment": "Malware payload", "value": "fcea11e2db1e933688f603398c7ee641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396840, "uuid": "ea4d4ab4-a044-4dee-82be-c18bb354f80b", "comment": "Malware payload", "value": "db23df298456ee708d4f7e28ebcb9bba2090ee7e45d559fac15e866475ef504d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396840, "uuid": "24958e33-236c-4df3-bdb5-d825aff7bd96", "comment": "Malware payload", "value": "ef4d3557ef72f3d940765091aef64a287bba738a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396840, "uuid": "ef442404-654a-45d4-8467-1d996207aa02", "comment": "Malware payload", "value": "5f8f45bbc5a570783d6540dc4391ffeb9911dcceff6ed0235e16b6387808a37fe4f3d7d61917038a64f2f58b1ac4d622", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396840, "uuid": "62b7728c-6e83-4e86-975d-fe79efbff47f", "value": "T14CE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396840, "uuid": "d164d161-f54f-4e2a-ab4a-a340cbd396b2", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396840, "uuid": "69aaa423-44db-4426-b426-c210362b0e6a", "value": "6144:mkajLyaPIvW1TFpvzYNB1MZB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8W6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652396840, "uuid": "dda62067-4a48-4329-9062-6b6a5c054597", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652396840, "uuid": "7eb09f6f-a8b4-4f41-af9f-b216fe0f1737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396840, "uuid": "479958f4-fcef-42d4-b82b-5d1831f4ea85", "value": "fcea11e2db1e933688f603398c7ee641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc67ba0-d1ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1652336021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652336021, "uuid": "52a691ab-eaf1-419b-9e7a-f91bfa1ec5f6", "comment": "Malware payload (IcedID)", "value": "060443937f7fc5293e101ab42944fa34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652336021, "uuid": "9b7ebcb0-9393-435d-aac9-a1bb897c48d8", "comment": "Malware payload (IcedID)", "value": "db91742b64c866df2fc7445a4879ec5fc256319e234b1ac5a25589455b2d9e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652336021, "uuid": "df0ea24d-14bb-4119-9fab-f3b1d3612569", "comment": "Malware payload (IcedID)", "value": "60fcda49f1f6be1b3db8b8a820d781a03b9b94b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652336021, "uuid": "e4a72323-b486-4121-b30b-3a049fd0367d", "comment": "Malware payload (IcedID)", "value": "c33859af2b123156bc11388e594ae0855bdeebc314126d90fc486ebae5ff2f5b5b5c28e8bfc508928814523eb2269c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652336021, "uuid": "f59d3a52-4b20-42c3-8e0c-4cf561dcb2ce", "value": "T190C4AFB876147CD6E66F567BC9D6BCDD13B627228ACBA8CD806477C30563372EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652336021, "uuid": "8ab844a9-79bc-4500-af3e-b6e44b67b76e", "value": "05b82023beedae5ff5647068c869c0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652336021, "uuid": "1adf5ccc-93c2-49bc-848b-fa8b8e9d1a29", "value": "12288:jcOZsM2/zZD5zFR7UM7zTogg+3XEg7WFvrLFWIqFGDEVAU3:jc+svlDlFRP3HpWFvrLMI8kEVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652336021, "uuid": "d5f85e33-63bc-44db-8636-7d175ee52c63", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652336021, "uuid": "1d579dca-fde4-435c-b41c-606805b71d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652336021, "uuid": "649abf2b-6cc7-473c-8ac8-f51e2a57205b", "value": "olasius.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a413dcab-d1ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652344598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344598, "uuid": "700c4673-e66f-4609-b514-e580847a20b2", "comment": "Malware payload (AgentTesla)", "value": "b8b90797cd5492dabd922363a10be89f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344598, "uuid": "e4b9d76d-17a1-42e7-b8d6-e61411d73f44", "comment": "Malware payload (AgentTesla)", "value": "dbeaed64df79acb9ca2c3020a521ffcdf044257d29f3fb35e2469015e952f438", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344598, "uuid": "547264c8-0316-4202-81bb-032774863e5e", "comment": "Malware payload (AgentTesla)", "value": "e18004e9433a5319b7a465e282f60cf5f572c686", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652344598, "uuid": "a16be4ea-004a-4572-804d-082faf72054c", "comment": "Malware payload (AgentTesla)", "value": "e909d6ba3a568ee5a1dff5d4d93a324ae34f36027fb4b14cc67c67caa94e861f5062869d2123723f18fcbbfcae90621a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344598, "uuid": "0d7a138a-bfd1-4302-afe7-25c2a69e179c", "value": "T14FC412903667DA22D56E0B33CCC521DC0332AF055C27DA6F5DE932899B77BE60AC461B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344598, "uuid": "71eb3336-db6e-44b4-88db-9b1235ea77d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344598, "uuid": "17d365e2-1e30-49cc-91f9-aeb52e532841", "value": "12288:WsqQ3YOgCCerS+b3g56puyXpSrILeOKRfuaI86qPppve28T3xf6i1AZA4j+Q1:WsTorC1rS352uyXcrG45hve28T3Bgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652344598, "uuid": "61e6db0c-df1d-4106-9caf-5332dece52ac", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652344598, "uuid": "1bae38a5-19cf-4e76-8fab-31be0be5fabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652344598, "uuid": "ad8a5ac4-22d6-4d26-9a03-3d2cc5f551a1", "value": "TRANSFER\u00caNCIA BANC\u00c1RIA 1517796961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a293442-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337065, "uuid": "263ca205-3625-46d2-83ef-caafad241c70", "comment": "Malware payload (SnakeKeylogger)", "value": "c46b77ee73e02abc57002f0f86169a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337065, "uuid": "495ab6ac-c42d-4365-947a-1f089916b677", "comment": "Malware payload (SnakeKeylogger)", "value": "dc2285f221a3dc4d0f285a3a3a91269bc00dce48d7cf50ac124566e012ab2810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337065, "uuid": "99facddc-0cd9-4272-8535-80e06f317328", "comment": "Malware payload (SnakeKeylogger)", "value": "a7aeb3848f25003b20270e2a72abeccce9a10fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337065, "uuid": "a7360f9a-00c9-4f15-924e-4c559b924e19", "comment": "Malware payload (SnakeKeylogger)", "value": "535cbc039c9bb2ca87698d24a5577d31bb8de77b2548710dcc4760e26674af1409274b7d7b5c2ce6cbef47758fac6249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337065, "uuid": "5b8da081-a4fd-4153-bd99-e41cc9f5d849", "value": "T141D4120836E8DB68D9BE2F7554B830245AB9B917BC33E31E4FC0658D3A637914E147A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337065, "uuid": "ccbcb2e5-e7dc-42d3-85c3-d9f88a7c571a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337065, "uuid": "c38449c1-0f93-456d-952f-ea4761ddf576", "value": "12288:Tp1puXQX5N8PD8yAr1Z+LftzXcqMp+9IGRWgp:TnTy8yc+fhXcuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337065, "uuid": "b1b53af2-b2d3-489a-a009-549000fcbded", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337065, "uuid": "5bc930d3-1804-464d-91d9-e9543b4fcdee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337065, "uuid": "9c1c502f-859c-42c5-9e50-3de4f5d928b7", "value": "Scanneddocument05112022pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2dca3f-d1c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652342602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342602, "uuid": "80757d51-6c5e-4b6c-a7ff-ecd495bf1731", "comment": "Malware payload (Mirai)", "value": "a346bd45a497a4cd6a7cc42a31dd5fe6", "object_relation": "md5", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342602, "uuid": "11166573-769f-4c52-9722-69c2d6752e4e", "comment": "Malware payload (Mirai)", "value": "dc264627ab1366440f1c63543058664ba0cf47f60cd279aa97c89961e9a02901", "object_relation": "sha256", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342602, "uuid": "e5e12326-f086-4ce3-9430-a921693fce43", "comment": "Malware payload (Mirai)", "value": "d57c681f90b45c93c29eefd1f25431283066c02a", "object_relation": "sha1", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652342602, "uuid": "538ee925-fa9e-4322-b051-b092bc811dc8", "comment": "Malware payload (Mirai)", "value": "325dce7f07aef93712164a8e18d0f59dbe72e76a3016953b3425173892ef620dc843bbd0a8c7b429788f4dd40ee9338f", "object_relation": "sha3-384", "Tag": [ { "name": "2-56-56-162", "colour": "#08BAED", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miori", "colour": "#1665DD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342602, "uuid": "815e4976-2c09-49d8-a40c-8224f36bf34f", "value": "T1F723830ABF600FF7EC6FCD3745A81B45349C640A22A97F756934C928BA1A15F46E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342602, "uuid": "a0221d8c-2ac5-4757-b1b4-c8de65a4de0b", "value": "768:ls48VsctvOGd+1xUQ29T5dyere2ye2HLEEYUXi6ogWDd:ls48VsyvOu+bUHUGvy9HpzoRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652342602, "uuid": "9148680f-9d10-4522-9133-9e6f7159d19c", "value": 46856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652342602, "uuid": "34556f39-36f3-4a29-bf1b-9aac5d97eccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652342602, "uuid": "ebc560d2-6b44-4136-8ac5-b1aa47f61e87", "value": "dc264627ab1366440f1c63543058664ba0cf47f60cd279aa97c89961e9a02901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db69d024-d21e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652379051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379051, "uuid": "49429a32-984a-413b-8216-4d37e18a8814", "comment": "Malware payload (SnakeKeylogger)", "value": "e7c04b9c634307368175de4f6d2427e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379051, "uuid": "8e724df2-99df-4768-8ce6-d2bd23c5a464", "comment": "Malware payload (SnakeKeylogger)", "value": "dc80aa02fb899ba3a209e0e783a4c31b708185e8c4eea3515558d5e24694eed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379051, "uuid": "8b0cc649-a660-4427-b9f3-47039ab265f0", "comment": "Malware payload (SnakeKeylogger)", "value": "909ef39c0d102e3df71c28d0f1c512533ae8b60a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379051, "uuid": "ff89e617-41c0-42f2-9749-b3ddb54c0e7d", "comment": "Malware payload (SnakeKeylogger)", "value": "032e6fd5c2d429ffeec960af72b7b9f2e61ccef5ad120aefaac52ad83add029bb09f87c19a69929d6cd1041c8a7e288b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379051, "uuid": "77bed3b1-90a4-4938-b4b0-e0db31747476", "value": "T1AEA412247127E822D46E0AB6CDD950DC1371AF839D23DA472DDA315A63327F28C91B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379051, "uuid": "ffb44358-7c55-4a01-b8a3-128f54e92375", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379051, "uuid": "19270548-0917-4705-9d24-7c4923892553", "value": "12288:ACWaoOdyu4j1Mvbs4DfHN7X6PsB/y2jSkZvz:ACmRFLoHNr6PU/Wkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379051, "uuid": "70b442e8-3f4b-4f1f-87af-c5dcac509621", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379051, "uuid": "17bd5abb-4d67-4b4e-91bb-cfbb06b9a57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379051, "uuid": "ad3ecce8-9ac6-4be3-9483-01f32d610dfd", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d859a246-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340391, "uuid": "1f755862-c8fe-45ae-bf11-dcf5e00f6625", "comment": "Malware payload (Loki)", "value": "e209164c829d0fb45a0d0be724217e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340391, "uuid": "3d092dad-17e7-4b7d-8a63-bc628b95df9e", "comment": "Malware payload (Loki)", "value": "dd24ab5fe574c6c35990e8f63672d9b146fdbed1dbc6e9a2150e565413fada1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340391, "uuid": "3f3461b1-cd15-46b3-9640-d65770d6b050", "comment": "Malware payload (Loki)", "value": "8e8c95a31b37727bbfed597a7dcebd6a77e29529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340391, "uuid": "93d9a955-3cea-4e9a-9a2a-726f608871a6", "comment": "Malware payload (Loki)", "value": "423fd98cec5abb7a344a86de84ee9288f28a33001e29954f8cf1eeba894d17e2d40a10b4dd04d11630c36aa13c996ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340391, "uuid": "355daf66-b051-4819-9fbc-1bbae9f58d08", "value": "T1DFC4011CFBEACD11C1BE2B3BD4F5142647B8BD4AA533D30F298C268D1A4279A4D81797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340391, "uuid": "6b47ab45-3400-495e-b1f6-7e9ce197dc12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340391, "uuid": "82db2d1e-ee6c-4ace-9c48-717455744d2b", "value": "12288:/64K6eQpTpScyZ5qc66JqUpYDFjQM7Ef5knJQpB3njL9nSp5p:/64r19E4IqzGY/JG9nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340391, "uuid": "ce9ffc69-32fe-48d2-82d7-4b049f5124b4", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340391, "uuid": "ed90cba0-4ff4-4e6d-b472-0320f8ea59a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340391, "uuid": "61034a8f-49a5-4873-8607-af5b32868805", "value": "\u03a0\u03c1\u03bf\u03c3\u03c6\u03bf\u03c1\u03ac_pdf____________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcff54b3-d219-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652376960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376960, "uuid": "eb3c1f18-7d2a-439a-b232-157d27f0e678", "comment": "Malware payload (Gafgyt)", "value": "b9deee339c82666c578df451fd8d7942", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376960, "uuid": "b9969d19-7331-4f7b-b693-f780d6b32e91", "comment": "Malware payload (Gafgyt)", "value": "dd7823da66006773e60d796f2c35fa0d281052eabd09e6f49ac6ef151b7c3ef8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376960, "uuid": "5966a9ac-ae85-479d-8a5b-510b06130db6", "comment": "Malware payload (Gafgyt)", "value": "74afb6f093130444e66c2874a94359cc303fe66a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652376960, "uuid": "35dac430-bfa2-4d45-a471-88d45aee384f", "comment": "Malware payload (Gafgyt)", "value": "052381c8b9dbd6734caefbd901812f2b7fdb7e208145567eaefb7d42a4d031a9ef14f6bf131d86cff8a9867fc900f294", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376960, "uuid": "73cc9f6c-2933-40ba-9cf4-ad18c4725167", "value": "T127A34A27A552C67BC0CB56B43BCBDA619833B4F80736720B33E46DB52B168D92E59F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376960, "uuid": "16d74338-ca62-4c4b-8839-a5680119e7b2", "value": "3072:yCT+f1WqJOurLKn6T/npSSMnm/8WOXFIaZYxe:LqJOun99BMnm/8WOXFIaZYxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652376960, "uuid": "e59ff317-50cc-45a0-a396-8d9f6acf51cb", "value": 101534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652376960, "uuid": "26855808-9dd6-4f2c-be61-4c0d8ce9a516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652376960, "uuid": "c1cf9ccc-bec0-4777-9198-edf302791bda", "value": "b9deee339c82666c578df451fd8d7942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929ff465-d1f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Growtopia)", "timestamp": 1652360460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360460, "uuid": "8ba782cd-0526-4f78-8d23-61ee6bdc4b67", "comment": "Malware payload (Growtopia)", "value": "539ecee8a948f969bc36ac74c5ffbb8a", "object_relation": "md5", "Tag": [ { "name": "enitsstealer", "colour": "#ECDEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360460, "uuid": "15f2ad4e-28a7-4ad3-96c4-6dff7297618a", "comment": "Malware payload (Growtopia)", "value": "dd80e4171b8ac0c23233101adcb5258cae6b9032b61c2ebdada54eb79b448bd8", "object_relation": "sha256", "Tag": [ { "name": "enitsstealer", "colour": "#ECDEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360460, "uuid": "9b7fc0b5-9cbd-459b-9332-13da729b4b5c", "comment": "Malware payload (Growtopia)", "value": "35514b17c84af37505dc2f7bb7eba419a74c4aa7", "object_relation": "sha1", "Tag": [ { "name": "enitsstealer", "colour": "#ECDEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652360460, "uuid": "087630c7-697e-46c4-814f-a831664b42cb", "comment": "Malware payload (Growtopia)", "value": "9114853d00c7298cbcca95838091ec271e76abd16a59cfaf9c7f492bfe810879f1434316c49df65072101ff5388a4541", "object_relation": "sha3-384", "Tag": [ { "name": "enitsstealer", "colour": "#ECDEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360460, "uuid": "cfa5eff0-f5aa-4ed8-8f31-b506e47d1afc", "value": "T1F0736C2433EDAA57CAFD8BBAD03641824FB4D60B9403D7C95DD9A0FD28D3B5006527AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360460, "uuid": "9b5ef4d5-f04b-4c84-bd5e-54f2aa23d8e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360460, "uuid": "7da94fa7-51dc-4169-b3cf-fb901f004736", "value": "1536:/QPPNxxjAjW3r1jGLHjW3rDWVmpyqyVmhL6XL2I4OIi+5kzJZN/JTEghT:OPNnj+VmYuaIszvFJTEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652360460, "uuid": "33cfdb1a-669e-48a1-a260-8121d2ace019", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652360460, "uuid": "bd96daa7-caef-48ff-89fa-9b9f01202b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652360460, "uuid": "aef3b5e1-89d5-4c1e-9859-59ced5c524e2", "value": "dd80e4171b8ac0c23233101adcb5258cae6b9032b61c2ebdada54eb79b448bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514e08f8-d1d7-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652348325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348325, "uuid": "8914d961-e78e-4bcf-bad9-20b6298201e7", "comment": "Malware payload (NanoCore)", "value": "06981ba465eb7eca5e8da7572511e3d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348325, "uuid": "fbcb3b68-cfde-414a-b6ac-d055a644a18b", "comment": "Malware payload (NanoCore)", "value": "dd810d37c396be1e34d2fe8b76c5ff30c17b6bb64afcc1c682182fb6934a3f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348325, "uuid": "39771666-e840-45eb-9717-720f6a565198", "comment": "Malware payload (NanoCore)", "value": "75e5740ef54f5c7b4df89589423ad3fea84dbac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348325, "uuid": "fde7bd55-201c-40a3-aba7-f77a2fa01200", "comment": "Malware payload (NanoCore)", "value": "381b51ba207a514df67c2ee69e46f820bd3efb42b28898e0e450c8b1513c768be854151e6a901ccbc5b79104c76668a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348325, "uuid": "7e3e7cc4-0ded-49f6-8a3c-b939bed540e5", "value": "T1BCC4231811A8533BE4AE1BF9DDA281DD27B0EE366D40CB1F8CD175EA46B7B44885270F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348325, "uuid": "9f7012fe-6a29-4c9d-9004-c386c18b274d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348325, "uuid": "b2e64d7e-6afa-4a5a-aa18-1cea6139b2f9", "value": "12288:EcRhTV0MEfIFgiLcyvXbfxg/P3reRgCkie:EcRliMeu3gyvLf233reR6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348325, "uuid": "13f23d5a-b91e-41e9-a858-16d3b228231e", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348325, "uuid": "b590f99f-e0d2-4cf5-9423-2de0905626e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348325, "uuid": "77daf358-4978-47c1-8f57-4e307629797a", "value": "MARIAM HONAINE'S CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126428a8-d19a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652322020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322020, "uuid": "e69b6cf5-0019-463d-8c01-f29a39aad86c", "comment": "Malware payload (Smoke Loader)", "value": "8e6830ad7c20976f9c39ce773d8240cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322020, "uuid": "f978b274-69ed-45b8-983e-2eeee12100a2", "comment": "Malware payload (Smoke Loader)", "value": "dd9194cf20f72e8f2f0b2fd08c9a4175e222b18de4738b43aa9274f5111cb01b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322020, "uuid": "57bb78ae-89c6-41e3-a5c7-01e5cc0031e7", "comment": "Malware payload (Smoke Loader)", "value": "28d6ef269604304951f332ee3105fb80b6366592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652322020, "uuid": "00f306d2-6da7-44b1-b535-110935a3254d", "comment": "Malware payload (Smoke Loader)", "value": "5ad0dd3fe8fa5bd3a6cf274712391a1f363f20180e18fd77275b6ea66c1096cde8605433fca8cef7cc64d326774e725c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322020, "uuid": "85d71a24-9fb3-47d9-a4f7-4453f0d1f01b", "value": "T105C27C423BABA102EE878D306ACA81335EB1F391FCB3465E10F6C056DD867C11BA591F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322020, "uuid": "23309d02-2a89-4fc2-adbe-08c46a819bd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322020, "uuid": "0d0c00bc-b6cb-4330-93a7-6ee3c691558e", "value": "384:SqFzn6UpQKytf7fReIaqu1HnYPLO+fGfZFj3+fGfZjp23+r/jLS:SqFLcRsqkHe0Fju0jp23+zjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652322020, "uuid": "ab9c6db0-79ee-49ab-86e1-2cfb0a3ab696", "value": 26448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652322020, "uuid": "5f4f4ce5-a276-4759-94c9-ce25e263bdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652322020, "uuid": "203befcd-004d-4f18-96b7-79b020c280ac", "value": "8e6830ad7c20976f9c39ce773d8240cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f15770-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340712, "uuid": "7f9a8da0-b85c-4eab-a43e-a4cc9e2023b9", "comment": "Malware payload (Formbook)", "value": "950e8e4e4bd8bd2779cca54b71657f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340712, "uuid": "a5f2ceb0-75ea-4a4f-bf35-55b947875f7b", "comment": "Malware payload (Formbook)", "value": "de17d089be1df75fd68d4ee21311656b449ec93b1de6bd6e89af9dfe12d36bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340712, "uuid": "bf4f4003-27db-457a-98a9-c52570662d66", "comment": "Malware payload (Formbook)", "value": "25013e741f80893b72c0f7e542ac3da65c1a3399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340712, "uuid": "cbf086be-a82d-4a0d-abac-338b1417fb0b", "comment": "Malware payload (Formbook)", "value": "05394a980e45214ef0c166ef108a6ea8c69bf1ba732fa5d77a9906c5bb77c00044880a7db5b37df205889061b26b536e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340712, "uuid": "82140760-8d3b-49f3-8b91-aca06836abc6", "value": "T1374413162BD1C517F6B1A73A8F376B379CFACB19649091069314221EBEB27C2CD2F542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340712, "uuid": "eec39c1b-b9b8-4863-97c9-7a9554ff9de1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340712, "uuid": "1318d01e-3ba5-486b-b80c-f1fcce868f99", "value": "6144:LOtIOFqgeDEsrpbqQoh6FYYu23Lx8sh7lXOQ6k:LOLFq1DppbCF6dJt6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340712, "uuid": "8a217c8d-40bc-45b0-89f4-45723de1a6ad", "value": 253696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340712, "uuid": "85d890a8-7b29-4aae-b697-2aacb89e9fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340712, "uuid": "28e00a75-be7c-434c-8611-d779b9f0baf4", "value": "950e8e4e4bd8bd2779cca54b71657f16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e3cf0c-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379151, "uuid": "8ee2cb5f-6df2-46e3-a869-2883891b4048", "comment": "Malware payload", "value": "bf0bb880e49e93b4b7fe176812ab57c8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379151, "uuid": "401aca23-61a6-42cb-98ab-7a1a863cdae2", "comment": "Malware payload", "value": "de2172ebe6d41ecbd98e922fe782485dafec6447376344ff61d5ffd788f49feb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379151, "uuid": "8e0069c1-d2e4-421d-aec9-f732a7aa11be", "comment": "Malware payload", "value": "a1ca7f99f4479e56aea5bd83f82961a5bd781e2d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379151, "uuid": "40ec6f25-a017-45d8-8ff0-dc576796bcad", "comment": "Malware payload", "value": "081c063ff54a9c0f5a0181f837af3a285e686169b2aafb43a8b9e63e1d9b03c9ea48103c3aa29d1336e575fb3e6e62e5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379151, "uuid": "cd7965b0-76de-4acd-b623-80f9157d8fc2", "value": "T1F5265CD7B2C9693EC06B163A09376A59993FBE212A068C5717F43C4CCF39481363AD5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379151, "uuid": "3e46dab8-c079-4124-bc09-c6384f5afc39", "value": "49152:A+HvNq7WICN5ASSKERQWkF7wHFWBG6MTMLCVOYLyA:NvN8WIYJKwsOYeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379151, "uuid": "a728fcdf-f04c-4bcc-ba09-bb10a06112c2", "value": 4511744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379151, "uuid": "3d44ce86-597f-43d4-b4ea-7c7ae408b13f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379151, "uuid": "fe3bbeee-10bd-4fb4-acd6-7f11bf76e6bf", "value": "Archivo.FactAreadeClientesdeEndes_aNopagoNopaid.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82de54b8-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340677, "uuid": "9ed1d875-1a37-43e7-8d52-dd7f3ef8c75e", "comment": "Malware payload (Loki)", "value": "bce919cf4fa0ea578e827b11c9966dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340677, "uuid": "0c765a45-6a76-4f6f-a9ef-ab45aea14593", "comment": "Malware payload (Loki)", "value": "de5cb159429d3332cb3982c2f8fd4354942e756b73fb0f8b05d47c3b7306091e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340677, "uuid": "f60f79bc-0ab2-4e34-b31a-10a65fab9db4", "comment": "Malware payload (Loki)", "value": "6191fa2d046b5f3bfda4790609ba6d7945c2d352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340677, "uuid": "53c5052f-7467-4339-8140-6be8350c49c8", "comment": "Malware payload (Loki)", "value": "6b8f19d60596fdd671a3b26064dd560f25eddc7749d84b4047ef11f3dc62851d976d12774adf8133e2ae6f440f482070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340677, "uuid": "41a0348f-a6c3-4583-9317-50cddde54f9f", "value": "T10E0402004290E133DA935B321E7B8B179FF99C715851DB6707B1EAEAB8672C1372E742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340677, "uuid": "7e27d6f5-256c-4038-84bc-b315bbf5877d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340677, "uuid": "1f73167f-8e0c-458b-880f-58c02b304dc8", "value": "3072:LODZGPEounbOSN75sL2oxbsi9ZVcyP0KXcdjrPZLAKkaRNZD8qf2ymhSxbZdjP3m:LOtIOO2sL2es6tMvhD37DDPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340677, "uuid": "956d2d12-afed-4a94-bdac-381a010d6952", "value": 182293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340677, "uuid": "cc7dfcde-0ac7-4393-8ff9-adc862887dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340677, "uuid": "938e8c3c-c286-4d91-95f9-22d7dc83ea61", "value": "bce919cf4fa0ea578e827b11c9966dad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4c3b0c-d191-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652318471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318471, "uuid": "32929da0-7585-48d4-9dc0-d1ccea6e2f37", "comment": "Malware payload (BumbleBee)", "value": "c4459d8a583f66ba843bda778d2e3d48", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318471, "uuid": "dc2309a0-cd10-4beb-a6dc-83afc5799007", "comment": "Malware payload (BumbleBee)", "value": "df0d696632c25d7dc0f18b43ee985e7e4b4b7b7efb79ea0672d07e581c9bd561", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318471, "uuid": "fa710c33-9235-4719-95d7-583226969585", "comment": "Malware payload (BumbleBee)", "value": "c87e4e609a21cb67c1e47e1d2df8a10178ba6b6b", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652318471, "uuid": "78acc72a-4a49-41bf-8e2f-f0650ad86252", "comment": "Malware payload (BumbleBee)", "value": "a339fc288d75386b4b9a1b962ff761aabfa8ea6b1f696034d800ce948d8cf43e6e555e6daaded9168babe0bb107c0034", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318471, "uuid": "886d29ad-ca0b-453a-9d76-71f653cd8cc1", "value": "T16AC5C063E7A55F44EC0198F6C70FC7A3E885F2990F029391E1ECCB65B2349A78A5D352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318471, "uuid": "32d2ee04-3723-44bc-bb3d-28d72d0caa4d", "value": "12288:+iA7AudUwpc4ia1+vM5Yv1vZ/1ySKbpZV9P3ELifhF9SCIiT2:+iA7djy0AjYt1lTfhF8iT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652318471, "uuid": "3d159a09-9697-4ef7-ba94-49d7bda15aa1", "value": 2555904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652318471, "uuid": "7b90b493-b205-4ff5-a1b5-b16fc87e8e0d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652318471, "uuid": "eeef20c3-9d4c-44a9-a967-d7aacc45f676", "value": "document.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c29bc3-d1bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652337078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337078, "uuid": "075d8b2b-6178-48f7-a700-b5880d7fbc5b", "comment": "Malware payload (SnakeKeylogger)", "value": "8304d0e5da2ef8c1a0884a85b95be50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337078, "uuid": "181a577d-3099-4488-bad9-cf41bf70c6c6", "comment": "Malware payload (SnakeKeylogger)", "value": "dffe45189680dbc7d56ae5aa90861f798b109efc8cae5a693c0e521b08d2184a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337078, "uuid": "173f5c7b-37b7-466f-9150-5e132936f807", "comment": "Malware payload (SnakeKeylogger)", "value": "18971e0d45db52a13653a24e54a5bfa7a80f6616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337078, "uuid": "4a7286d4-61f3-46d8-9b33-857ea6a8a62e", "comment": "Malware payload (SnakeKeylogger)", "value": "27e7de9294bb9aa1686abb3edbfc4040febed6198a080b9516a093690c6be16d6a2286a701cfd0f7ead662220fc68025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337078, "uuid": "ad448d83-b8a1-4e80-a6bd-c8683031d42d", "value": "T100F4849C722831DEC85BD276DAA81C68EA90757F931F4107A02715AD9A1CAC7EF14CF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337078, "uuid": "2397e01d-15b0-4d63-8f6d-73ae388792a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337078, "uuid": "7068be71-843b-4bd9-b4bb-16d159694eba", "value": "12288:kCsVEuVblxTy9eyZYkWshnYrYVLknEDzt/dtTj9VDUBIQ3Q1/anlLSlFdGNOP54+:bstDxT+ZBWsuriBJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337078, "uuid": "a6aa470f-55a4-42d1-b21f-ca7d97839a85", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337078, "uuid": "edd30a8a-14e3-4a29-81d9-70add5a3cb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337078, "uuid": "fbcf8527-8697-4786-9d5d-bb06b70fe20b", "value": "NEW ORDER PO_1411184672 RFQ,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69876196-d1c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340205, "uuid": "080f6547-45af-489a-9f27-d3ee7eb428c6", "comment": "Malware payload (Formbook)", "value": "f388f62ae1aa521171b6e11af7a0e389", "object_relation": "md5", "Tag": [ { "name": "EmirateBank", "colour": "#77C7D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340205, "uuid": "4e6aa544-c6df-484c-a41c-6c5a14301a71", "comment": "Malware payload (Formbook)", "value": "e01aab97bf2805546ef29b22bb0d9e3e2205d4a319faaf6f7f4ce966b8aaa149", "object_relation": "sha256", "Tag": [ { "name": "EmirateBank", "colour": "#77C7D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340205, "uuid": "66f4629c-e6f3-4e4e-ab02-dcde4829921c", "comment": "Malware payload (Formbook)", "value": "281c9a052f006ed7b0d1f2590081907aef9cd468", "object_relation": "sha1", "Tag": [ { "name": "EmirateBank", "colour": "#77C7D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340205, "uuid": "a939f3a2-183e-48e6-b417-7b8403c48de6", "comment": "Malware payload (Formbook)", "value": "0a8c3fa8675cdc531ad015b165920357fb56a3bbc6ca6d773c47927652958f0633d50e77a23a9c5253c9daebbdd822c0", "object_relation": "sha3-384", "Tag": [ { "name": "EmirateBank", "colour": "#77C7D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340205, "uuid": "9cbea5df-5f6d-4d02-8184-67fec3fdb7ca", "value": "T175B40214327BE626C11E07B2CCD550DC1374FF269D53EB0B18EC355A1AB2BE60A91B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340205, "uuid": "2a8a7365-a36a-40e5-83eb-157f40e36d1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340205, "uuid": "193c793c-a902-4579-8dd0-641ee24b7408", "value": "12288:XMhLm6PEOCcvFkND+bn7fQLR9YxcXxkHusiiVKJ7p:y98DcvmZ6TQLRWSxkJiisdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340205, "uuid": "21d1a1a2-2cbf-437d-be77-623e86a74ec2", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340205, "uuid": "08505047-d433-4cad-8773-ccc1f4751a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340205, "uuid": "c9c8e389-59ed-4f90-a68e-5edf11d7eee2", "value": "EMIRATE BANK SWIFT 12-05-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b11dc2-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340680, "uuid": "5e248062-9bb6-40aa-a81d-59d065a10d8e", "comment": "Malware payload (Loki)", "value": "76f60d8b7e3ff84e6f804f5bda945117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340680, "uuid": "d8c6083f-7229-422c-ae74-e75066968e81", "comment": "Malware payload (Loki)", "value": "e06081aedcfc5f44b0ccde2ac1a13f287ed6533f74ca5fa050e174e5774140c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340680, "uuid": "6df5ae9e-5d84-40ca-8183-18369be21db1", "comment": "Malware payload (Loki)", "value": "9b80a0b687c3d6af052df852a0036126c18b7cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340680, "uuid": "00226d04-24c2-4efe-8b64-1fef4a577f7e", "comment": "Malware payload (Loki)", "value": "eb493847a5195f74c18bbc27890efe9ad9dee489e77df613cb15f93aaa13f87b885253f8de6459378212146adf2ae308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340680, "uuid": "5b1d6af6-c050-40a1-a2ec-ed2c835ca80f", "value": "T13204020063F4E51BEAA676739E769317DBF8C41329B4520B4B40794AB8B6341AE1F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340680, "uuid": "813fc5be-23b4-4fa8-b25f-1866a7aa22f2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340680, "uuid": "6cf5e83b-0bf2-410d-bb08-26f39f44f3a5", "value": "3072:LODZGPEounb5u2QeI7EZb6EyKAeV2xFEzFCstfNxce3BZxIxnQoAPQ+:LOtIORnIoZOEyZ42xFEzrVxceP6QK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340680, "uuid": "67653b8e-9eea-4291-85a7-6cf783dcc46f", "value": 182298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340680, "uuid": "e3836ebd-38ed-4739-a0d3-680b4da369b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340680, "uuid": "2bb9ff51-a97d-4460-a3f0-10831c9277c6", "value": "76f60d8b7e3ff84e6f804f5bda945117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bb64ab-d24e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652399407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399407, "uuid": "60551419-4dd0-4ff5-8a35-79ae578752c5", "comment": "Malware payload (Mirai)", "value": "a9fb6828d3ec93500d62118bb2880c2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399407, "uuid": "4dc05acd-8e3f-4786-9118-e9d60205e7a8", "comment": "Malware payload (Mirai)", "value": "e0db2046943e8664dd84bd4649654bba31d04d2c0e5b15ce59dfe00b6fca306b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399407, "uuid": "dbe1ace4-a1d9-4902-b013-d803e0fd3da9", "comment": "Malware payload (Mirai)", "value": "cd7309fd4bf6cfbafdc40fa1ae66849a75fb0988", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652399407, "uuid": "dec4d72c-d052-4dd5-b006-1972412b6eeb", "comment": "Malware payload (Mirai)", "value": "a24b2617c63de07809a36c898971d69deaef167c59cc8843061ea71eb149a83e97f4f16f22af8e32cfe00031c9fde27c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399407, "uuid": "70c90ab0-312b-4a4f-8600-62818e45de28", "value": "T175044C46AA409B13C0D7177AFA9F424A33229B64D3EB730699186FF43F8765E0E63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399407, "uuid": "e7de8931-ba62-474d-b55d-76981f90b24f", "value": "3072:em/fCMQqZg2X4swtxEtacuDm9LixDh805k3moPZjXQVbmM/98adKxmOW/EWBx:eSZeVtKtacuDm9Lix18ajcZjXQ8M/98q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652399407, "uuid": "98b2a501-11ca-4acb-959e-2351e4152477", "value": 174239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652399407, "uuid": "868b0168-17b9-49d7-9448-167792756c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652399407, "uuid": "a6e0ca75-c16e-4cbc-9f83-76346aea5ed2", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e0d5d5-d1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652353560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353560, "uuid": "49c71fef-646b-445b-99f3-0785c89c249f", "comment": "Malware payload (Heodo)", "value": "91a620c3f613e17500aa6894e074ff02", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353560, "uuid": "751052a4-c73c-478b-b6a3-a63b1a8de344", "comment": "Malware payload (Heodo)", "value": "e172534f43aacfc50c5a9db8dd667ce4fc4cee92e53a007a808ff604bbc5a77e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353560, "uuid": "3f8a00a9-eb03-489a-ad82-87fd105c50f2", "comment": "Malware payload (Heodo)", "value": "131a2d652e74d451f6488ca5f61431a9d01abc37", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353560, "uuid": "eb2239c7-aea3-41b9-b3f9-cd1026306499", "comment": "Malware payload (Heodo)", "value": "71daa6e91ab8f15757acb9ab10352d88cebd06394187bfd9a6fb974e8f2cbba91f8b6a5b936244f3cd431c8acc12dd7d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353560, "uuid": "dbe0b3b3-1f0d-4d43-aa9f-cccef49fb497", "value": "T1EA03834ABA5AC85DF925C73548E743E9B362FC105F6B0B873645B3657FF89A04A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353560, "uuid": "ab244b03-3fd1-434a-ab90-019be2277e77", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353560, "uuid": "37a853c6-ee22-4834-8a75-aaf8969d0255", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353560, "uuid": "21720f57-2399-4ab2-878c-4d8046ce1300", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353560, "uuid": "75f91a67-3d4e-4b4a-8ea9-25c8938b7b25", "value": "Rechnungszahlung 2022.12.05_1215.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f523062-d202-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652366763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366763, "uuid": "9cb84714-cc90-4fd7-90b4-59091df16b9f", "comment": "Malware payload (AgentTesla)", "value": "b9fb8510739f6a5405df3de48bc6def8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366763, "uuid": "b9f9d7a5-c80b-43f2-853a-84713a6bfd37", "comment": "Malware payload (AgentTesla)", "value": "e1c78b78e726c414ed4827e97d607a3cf2561815b1fef194628c88f08d73e6b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366763, "uuid": "d2b76e11-2ec3-4206-ac6f-da5424ed1745", "comment": "Malware payload (AgentTesla)", "value": "7a1925eea2e6750937152be03d245da32fedd7d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366763, "uuid": "f2054079-8633-40f2-8f58-64c4ba7c24f5", "comment": "Malware payload (AgentTesla)", "value": "8213b5a6fb959aa7a6a429853831d1321494c39bd3aaf6ead60ed010c06774fe61ccc16e9bbb2a526ed4134ac8291ca6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366763, "uuid": "bc3cc5c0-4e9d-4284-8724-c44c373c451a", "value": "T18B04013D7725E069C28B977568550A30A88BFE546F78E911A0AF330FAF32134536B35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366763, "uuid": "19698764-69a5-4bdb-864e-fe3cc3900880", "value": "3072:W3QWaUr5qBOkgJnY1T/yzQbDyuyXqh1ERAj3d2G7yu5HCe4UexOuiah0P694jABT:Mr5q8PJnY1LOtXSASd2G79Ec9Wh0P69H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366763, "uuid": "1ae71791-d5fb-4d2c-b685-69b34f9b3a32", "value": 188264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366763, "uuid": "2b7f3ce5-fb85-4874-88ec-2fd847b56216", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366763, "uuid": "0cdb798b-eaa2-4778-a568-4fb3a930a546", "value": "Angebot Nr. 58022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70142276-d1da-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652349665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349665, "uuid": "8a3f8708-ed99-4196-b818-fb5ab148ce8b", "comment": "Malware payload (Mirai)", "value": "657c2bdc21631b64fb0cf1dbc8d17b89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349665, "uuid": "2b4c3eeb-c23b-4fe5-bef5-bc57c3ae2d90", "comment": "Malware payload (Mirai)", "value": "e1caf65a60d3865067098be3b8c950dfb3816e9fc11f979ddf8b5c8d503bd751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349665, "uuid": "a8549367-3d8c-44de-8351-6fe2ce467c95", "comment": "Malware payload (Mirai)", "value": "69558a51c644c4a8e6c2b62153a1c95e34956301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652349665, "uuid": "2d5e0fa0-a09c-4ea7-993e-1899386e1dd1", "comment": "Malware payload (Mirai)", "value": "4f2568560b8358f692bae4aeba4a7292677a81815c504165cf508d07fb55aa3affddcf87c539be97a3284bfd43af5cf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349665, "uuid": "83ee727b-6c50-45e3-a020-0d325386ef53", "value": "T12EB32A46B8D18622C6D123BBFA3E528D372563E8D3DF7103EE241B6426CA52F1E37945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349665, "uuid": "e5175df0-485e-49e3-b28e-ee8d3c4b89b5", "value": "3072:1U5cq5x+5Jm+Wt4JmBpQ7eDfix3Rjv/q:1U5BpM7fRb/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652349665, "uuid": "9e308efe-2b10-4f2a-b8c7-c94fbebfe0d1", "value": 109208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652349665, "uuid": "7d698182-6cc3-4aaf-bc66-02fdaa95d3ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652349665, "uuid": "bc79384c-3478-4f84-86d3-bd87e2993987", "value": "657c2bdc21631b64fb0cf1dbc8d17b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eaa15b-d20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652370604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370604, "uuid": "663e4138-419a-4aa3-9030-8957ca27b2a8", "comment": "Malware payload (Mirai)", "value": "25949d574dbae0857891e69f5532c7ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370604, "uuid": "48cb5d98-cb6b-417f-99d8-5c3329ff8f83", "comment": "Malware payload (Mirai)", "value": "e28549950ed499a073f9d85b99bac780c3348013e3c065881e9420fe0b2832e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370604, "uuid": "4695af01-b0f5-4403-9341-1d1778a3ef24", "comment": "Malware payload (Mirai)", "value": "42ada57edff3f65adbd003133ccf6c7831e7c298", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370604, "uuid": "42f40bcd-05b1-477a-b03a-8b3c6d55f347", "comment": "Malware payload (Mirai)", "value": "42aa2cd6f157db419443377a9348a59d14149f3d11133f5c811eba6327ccf0947e9e40f234a76caba55408058f88fb22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370604, "uuid": "03bf9963-664e-4451-b929-abf6aab15ef3", "value": "T16E23F141D60C52F2DB26D5BACC2B6F51BA0D9F396687F01543F5321423876EABA39183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370604, "uuid": "7127acb2-b49d-4cd5-805e-fc099ad79a23", "value": "768:95lpPa7b9wvFw5RxAesxlmP7hX8eBlTX4B13Z9q3UELuyTQPvfaYvCinHpx:9JPa7b9w98xsnmP7hX8HOLNQPvDvCiJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652370604, "uuid": "4c058f7b-4937-4dd7-8c8f-8583a613c419", "value": 49000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652370604, "uuid": "5ebbdf32-bf60-473e-9cad-cdaef0db9e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370604, "uuid": "258a5b2e-07c4-40d0-a2d3-33efb61cf1fb", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494bd4be-d1d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652348741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348741, "uuid": "4c6a27ff-c659-4174-bd4a-b61720a458c8", "comment": "Malware payload (Mirai)", "value": "ca29083e77f6cd9715e248763a5061f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348741, "uuid": "4b1ecd42-1257-44d0-8f88-9047dde789a7", "comment": "Malware payload (Mirai)", "value": "e2d8af7614bea91239699cb908158495275e154fb85ae2cd419e27fa47a0dacb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348741, "uuid": "26a53df5-c49f-44ed-bc64-ca738e9fd302", "comment": "Malware payload (Mirai)", "value": "5e3f2b7e07ff3e230bc929225b24677b0aa9037b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348741, "uuid": "38de558c-c760-4477-88a2-ac6d3a56ffaf", "comment": "Malware payload (Mirai)", "value": "ee302df130b4ef70dc408302250b9acc5d14c95843f8f21da75a1979cd59631140fab3f70cbc877c5f9735f62a0a85a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348741, "uuid": "4a73b66f-738b-45cd-8a07-f6034c733a5f", "value": "T1962302816BC2947CDF45D4BFC97D904CF73F96988EE9DD502438DBB02B9242986E02E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348741, "uuid": "0ce42bf1-1570-4a5a-89dc-128e5b5a731b", "value": "1536:Y9Afe4Si20ChlEsk0K4FdP9YttzYm5ZGG1j:/feb7k0rf12tEm6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348741, "uuid": "b33520cc-25a6-4e05-8774-857403a23c5b", "value": 49592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348741, "uuid": "0ed9cf7d-fdc7-45fa-98dc-5e0370b76dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348741, "uuid": "de644a97-5742-4d0d-a0d6-67119db78d87", "value": "ca29083e77f6cd9715e248763a5061f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825472ac-d23c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652391786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391786, "uuid": "475bc133-57e2-4e10-a411-08137394dddf", "comment": "Malware payload", "value": "4c0749e96473a709cc9d70519373b753", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391786, "uuid": "f8fffd81-c12a-435b-ba33-af463bd6189f", "comment": "Malware payload", "value": "e3bd5c67d99a54f767c7bfc8dae167c2d7a981023e4715fe74f2b8422d87a180", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391786, "uuid": "66afc110-087e-40e7-9bd6-eb6ea935f7fc", "comment": "Malware payload", "value": "fe213e1e36ff0480f42ffe1541ae91f3b4cb66ec", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391786, "uuid": "4ec2d3ba-61a0-4cd6-8b18-df7ce2cc41b6", "comment": "Malware payload", "value": "55b26421de5f77f3aa058bdc27091f3128855f1d1c586f8fd254fa5ae3fc50d9b6d66c4a200b627eeda99d67453b6e01", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391786, "uuid": "c64bc7b8-9ec3-4d08-9fff-8393fa0acab2", "value": "T15555025137C9853AD2DE053789BA9B693636BCA10730C0CBAB957D3CAE307D3A978351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391786, "uuid": "61e7fb78-45f1-4e8c-b824-46ac8876ef31", "value": "24576:UtWcpVLSsNMqauHJXrk2EMMpHByeBPOdbD0UFHMEpvTEThdu:GpdSsagk2EMGHjOVD0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391786, "uuid": "97404fd5-c5f9-4233-ad30-5d5780d272fe", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391786, "uuid": "1219a838-20d0-44c4-8636-2cf249277e7c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391786, "uuid": "59a97f97-f09d-41ba-be1d-bfcb35e30c0f", "value": "SecuriteInfo.com.VHO.Trojan.Win32.Agent.gen.7054.32020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62853582-d20f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652372406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372406, "uuid": "3b3aa9d6-1d87-4453-8dee-563e9ac14b30", "comment": "Malware payload", "value": "334bb0e4719011c811828ab952680901", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372406, "uuid": "107853c8-97c2-4642-9262-ee124a4af92b", "comment": "Malware payload", "value": "e3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372406, "uuid": "f284cc54-0eaa-4d1f-a64a-bb5e3cff8860", "comment": "Malware payload", "value": "f6bea9abe7d91618a1bdef0f3e99fa7aadcdec15", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652372406, "uuid": "3b015b79-a1cf-487f-ad20-8f03f5c1c42f", "comment": "Malware payload", "value": "51bc9da20f874590b34ce345d801350e961ab9fc74a6f0413715b622bace46ffcd89a10d5c1c93c9ca56b374db70c638", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372406, "uuid": "69bde5e7-8b75-4b97-968e-93e5e68322ab", "value": "T1E665AF8A7417888CD221BF4E132532541279DC277AA28EF7D17FA327EDABC1B5B74502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372406, "uuid": "225002e8-16ce-426f-93ee-27532cd78762", "value": "12288:l/8NEUcsw84YTxg9SkfY+ZfQqYxCZNrCrXXqOtJ7lpPCe+/F3q2B5KpVSlGekpvG:aZpledT2kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652372406, "uuid": "4bb32c15-126e-4d97-b03b-e4d9dc2333c2", "value": 1474146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652372406, "uuid": "2a3e55ef-ddd4-4311-8ea0-2a72759a09f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652372406, "uuid": "ff2c15ce-0619-4623-ac04-e68bb45e8144", "value": "PAYMENT_RECEIPT_INV8938464944.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9585f917-d1e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1652354452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354452, "uuid": "a4bd6e27-f290-48b7-8baa-caf8585d2a6a", "comment": "Malware payload (Hydra)", "value": "a32c36009a37893be90e4f385b26b5ee", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354452, "uuid": "0f36778a-7b4e-45e6-b08a-496a84085f16", "comment": "Malware payload (Hydra)", "value": "e3dcf86812f72b774ee51563538ad2deb75aba98c583a561046d98e2a41d47f8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354452, "uuid": "caa718ae-2687-4095-982b-c2b9f8c527f9", "comment": "Malware payload (Hydra)", "value": "1f3f0652c0d89c4907281d76de3c983373a5fcb2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652354452, "uuid": "893d90f1-c94d-410b-b153-9fa24d1a87bf", "comment": "Malware payload (Hydra)", "value": "6099d2d9ec8b075460be5d2b0cbca9e67f5f77af72ad025d9b64b9e6ea1ec7b19212f56c356264bd375317347ac085ff", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354452, "uuid": "0c188c67-9281-4ba5-bc15-92f7a76f69d3", "value": "T106252247FB2AD481E5F7CB304AA393F5A0B71C9A6E0342A75551BA6D28B77C09F47C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354452, "uuid": "16bd9274-03d8-4977-9228-b864785ae442", "value": "24576:V6961oNpt1wEEoSkzJkGVMDxb0a5Vl7/tEHFamK+:VQpt1dE5kzyF0sVl7VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652354452, "uuid": "26aca43a-b767-4748-8271-f3090b7c3b9c", "value": 1039000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652354452, "uuid": "ebd63904-d594-4639-8562-b2b2acb0b057", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652354452, "uuid": "e02286a6-7274-40bf-8e53-b3fd3c0fba93", "value": "E3DCF86812F72B774EE51563538AD2DEB75ABA98C583A561046D98E2A41D47F8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad23cbd7-d22d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652385416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385416, "uuid": "104f1c87-320a-4215-bf7e-be33a92dcedd", "comment": "Malware payload (RedLineStealer)", "value": "0eb83e224557d4bf1402466a48567444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385416, "uuid": "794d821e-2b8b-41da-9071-532f309a5e3b", "comment": "Malware payload (RedLineStealer)", "value": "e3e0a3569631d65e57999ae0354e2986676fc99d4f510ac83d643474d869ac6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385416, "uuid": "b96053ba-ebdd-47b9-9016-beb402591d4a", "comment": "Malware payload (RedLineStealer)", "value": "e26766617aa101310528372e2a94de36cb9e0c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652385416, "uuid": "548da5d5-05f3-42cb-86a5-8c42e112bc97", "comment": "Malware payload (RedLineStealer)", "value": "2c7e670f6a04c970514eb2e601c5ea05f432dc137546ee0af5ccdf6274071ffc172c30493c6146a5f7a3f4c876bc4716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385416, "uuid": "a6d501a8-f30d-4e4b-a989-9f1d1cd8fb9f", "value": "T11F84B291F2DC149FE06690B288776D32992322B9963E850A205F3D3B7FEF3434562F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385416, "uuid": "5559648f-1b00-42de-8e3a-e4f9c8dbd13f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385416, "uuid": "b23ee633-e788-4dc9-a2de-e055bef43040", "value": "6144:7MCyiaS8jZBm8MmPiX2fGNMyx7XhcjrzzoTZrQWXS0+kGv:siaSYZo8fRGpx7XhcjrzzoTZrQWXS0+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652385416, "uuid": "2301b4be-f2fa-4573-8ade-27dc29cb56fa", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652385416, "uuid": "eef4f072-6f67-46bf-ab1e-f3614abeb028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652385416, "uuid": "9d34e2a0-4671-46a9-aafd-0fbec13380fc", "value": "0eb83e224557d4bf1402466a48567444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c47bc04-d225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652381817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381817, "uuid": "9285fd01-3269-4a20-98fd-c7bbc47a9f92", "comment": "Malware payload (Loki)", "value": "4b29dbf34a5049758ec7e986a6a85c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381817, "uuid": "ff1fda9d-9fcf-4288-80b6-a91a98b7f506", "comment": "Malware payload (Loki)", "value": "e4a916190f6b012ed2aa5973150f4fdfddb8cf5b9199f96d741daaeb60851437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381817, "uuid": "e51627bb-b431-439f-9b57-3d612403b911", "comment": "Malware payload (Loki)", "value": "62307888c3c31ac1eb6bd581aeb38cddcc85e2c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381817, "uuid": "060f04cd-cc5a-4a6b-8a00-f5ca5607d6f2", "comment": "Malware payload (Loki)", "value": "95f5e3321a1284482f2c2ccd4038d596ef8c482971e852ccc355e38532b135b4831f41c23c4cded2788b1d5ee168214d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381817, "uuid": "d2c35092-93b3-497b-b6ae-9641a971043c", "value": "T19924120035A0C667DF661B329DB337B91FEF8D72189C960B1750A98AFD362C65D0E392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381817, "uuid": "d4cc56b7-b5b7-4f64-bd60-5f7f2a2ba5f1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381817, "uuid": "dce49e30-536c-4424-9455-cda79ff8676e", "value": "3072:LODZGPEounbXxaztBRbBV2FaoasaFg3djiEyuy5sH+/0W/HuayXKg6IXeTsvV:LOtIOXxcpeFaoasacBy91cQOayXn4+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652381817, "uuid": "30e03747-0a73-4fde-af81-bb4bbcc8b2e3", "value": 212378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652381817, "uuid": "9bd7855d-f01e-4360-9625-9a4dc7ef0fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381817, "uuid": "33771bf0-9fce-4490-9913-acd04ca04aa6", "value": "4b29dbf34a5049758ec7e986a6a85c7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a737b3-d1d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652348758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348758, "uuid": "02e344d9-5520-460b-a27b-1be8732444a9", "comment": "Malware payload (Heodo)", "value": "61a868b5e1878967bad63182d306d31f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348758, "uuid": "d6a41bea-d04e-49f1-a4fa-8950277e553a", "comment": "Malware payload (Heodo)", "value": "e4aa0adcc79e1b7e559512343081e8f3b29f97d257beaf8e1e3698f042c651b0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348758, "uuid": "6ade9dc7-4adf-4041-9ee4-a4a3f3fc94fd", "comment": "Malware payload (Heodo)", "value": "292a5451af02f0f40b306063332577065f5f4c1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652348758, "uuid": "c4c7ea22-6d9f-4ca7-9e65-345f03c16288", "comment": "Malware payload (Heodo)", "value": "dffa46d700cc836dc12c0c99117a20d089f761afd55ecd4c18ad4323f1dd89e43cb1db553193db78a96a59b2ba8d64e3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348758, "uuid": "3c576cae-3f32-4023-881e-203a1089064f", "value": "T1AAF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348758, "uuid": "6f945791-0ccf-4500-89e6-1e885c8e5834", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348758, "uuid": "b190f9ea-7ff0-494c-96fc-5bb1c991d232", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSKjNwgraKRT61cKGNx:S4DzZKnH4TRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652348758, "uuid": "e9ecf93c-e3b4-4669-b231-9aa82f36e7b8", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652348758, "uuid": "fa40b943-60e0-4199-a076-91ebdf1881ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652348758, "uuid": "d62fb704-e636-4ea1-9241-a337eb1e90d9", "value": "61a868b5e1878967bad63182d306d31f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d5c67f-d248-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652396859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396859, "uuid": "87eb046b-b153-47b4-ab2b-b1a3aae494b7", "comment": "Malware payload", "value": "4fe90cee4837e643a41aaa5596a58f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396859, "uuid": "9b7b5b26-df2a-4e51-8ffe-749273690727", "comment": "Malware payload", "value": "e5191000eddf397ea6ddaab8966b2a8189c9602484b1f5117fba2cf71003b668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396859, "uuid": "d67b1d05-c12a-40dd-ac6f-36e55f756c6a", "comment": "Malware payload", "value": "268ed0d2fd6ab91d9a8522283f991f24107409b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396859, "uuid": "f4ece8f9-2763-4173-828f-31db96a7eeea", "comment": "Malware payload", "value": "4a12b771341e69c4d92c5fcdfd44c37f132ca13cbc29f9deb634a895aa59a2fc6fbd143ce5ca1a2c951a804749668af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396859, "uuid": "228da049-33d1-4e6e-afda-53b98e6acbaf", "value": "T178E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396859, "uuid": "d73fe455-622c-41f0-bc46-b8b01f09ab4d", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396859, "uuid": "f62509c6-361a-4ac8-9ff6-4a582938f462", "value": "6144:mkajLyaPIvW1TFpvzYNB1MUB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8d6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652396859, "uuid": "beb7b40d-b24d-4f0a-854e-bf0b874b37fc", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652396859, "uuid": "72607424-d5e3-4e2a-95a4-fb0acebd1e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396859, "uuid": "a2e06c7d-c167-4ac1-ad65-d894d59d8cd5", "value": "4fe90cee4837e643a41aaa5596a58f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5676e506-d1a4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652326429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326429, "uuid": "20bfb695-6d19-4327-b0d5-129201008a8e", "comment": "Malware payload", "value": "2946c38b24829906741c56cfeaca99a2", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326429, "uuid": "54ba6475-6d18-4eb5-ad36-59550bd5f4f3", "comment": "Malware payload", "value": "e5ace763172dd755fad17177fe863b27b924324ba95a7d581b927b0846e9ba02", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326429, "uuid": "2c1ee1fd-6741-42ee-b914-be6c88ffc6cc", "comment": "Malware payload", "value": "61f453bd5a869b22288381c30553c27a031cff4d", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652326429, "uuid": "95d35e6e-2402-4d4a-ab8b-173e82c0a76d", "comment": "Malware payload", "value": "144d2f50d063d516a885f4139bc74b67841849fad74c2c7ad1f8a2b11c1ef65cd231755cd6118f42a93d9fe93a329b94", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326429, "uuid": "e5c4aad7-67dd-49d8-b9c1-d45fca626c7d", "value": "T117D56DF94F95284CD837D839A5A7BD7E9B8834535B1EAFD03617E8122276308A42D1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326429, "uuid": "42cfa826-045d-41ee-b3eb-cb56285ec91f", "value": "24576:q/M58zvu/zpEY9wj8F6Jv8tbq/Uooc0jCe+Y9uQlQ46GdFfCYh5upcXx8xUNZUV:sjUWevQBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652326429, "uuid": "78cfdbfd-9d63-4324-80e1-95b17635ed17", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652326429, "uuid": "78d5ca48-10b5-42d0-b121-ebeb92c19434", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652326429, "uuid": "f04260e8-f306-4399-b410-6882fca1e492", "value": "invoice_pdf_99.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b0fe1f-d18b-11ec-8e58-42010a9c0032", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1652315791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652315791, "uuid": "afd90e79-8335-4189-8794-7ef1d03f4715", "comment": "Malware payload (ParallaxRAT)", "value": "c3c006c209d64c48a0d02eb6dca6efbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISL Online Ltd.", "colour": "#1597D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652315791, "uuid": "90d86f96-162a-40bd-ad12-bf593c2998ee", "comment": "Malware payload (ParallaxRAT)", "value": "e5ccc16b7ffa00210ac18b1ef5b8e4b80a764daa37f6d8f505f5c030f6a33b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISL Online Ltd.", "colour": "#1597D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652315791, "uuid": "a205a61c-28ff-4e2c-8019-1c5874f840cb", "comment": "Malware payload (ParallaxRAT)", "value": "4018c44cc05828c724352fc0a231bf2910a7353a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISL Online Ltd.", "colour": "#1597D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652315791, "uuid": "96b0dfc1-f32c-46a9-a51d-74fced8dad27", "comment": "Malware payload (ParallaxRAT)", "value": "189379f6d96431108562d51fea92e44108e8abc57718d76376c070753ef311c65d4f3c9f05dc356029768537586b0f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISL Online Ltd.", "colour": "#1597D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652315791, "uuid": "420f5961-7b36-46f4-b7cf-bd53ef671ed3", "value": "T14CC41210A700D967CD560832711C8A264A76AF5238A5DC53FBFE3D8EF93D2C9E426C97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652315791, "uuid": "54ee9591-d233-4827-baf4-68360da712fc", "value": "3bf7e320aa8a82a5ee7c605130a7e20d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652315791, "uuid": "9d00210d-a96b-496d-a69e-93b5cbae0174", "value": "12288:LgO2dfeAjYlVuEk/qBiTyoCAOuiSAM9loypr3j1iIUbpdXWMm4:UO2JeAjYEEk/q2hvQIl5r9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652315791, "uuid": "7a77c99d-2bd2-43e4-bfac-f22703305c90", "value": 579096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652315791, "uuid": "feee630d-cc4e-4a92-bb0a-8e8c42717889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652315791, "uuid": "216b713f-85e5-489d-b1c8-24ca3c7927b8", "value": "helpdesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a4fa1a-d1f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652361890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361890, "uuid": "b4c9caee-c731-4cc3-8f23-8c9cb6a3e4cb", "comment": "Malware payload (Mirai)", "value": "12590dff0c9708f3686b59dba62cdb55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361890, "uuid": "0a856361-a478-460e-8fc0-651767d07b2f", "comment": "Malware payload (Mirai)", "value": "e62b58866bea6bba4bf5b58ac2265adc6c9b49660d586e161f6f628570f510d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361890, "uuid": "b4ca8c63-3a4e-4538-b73f-30cafeb931fa", "comment": "Malware payload (Mirai)", "value": "e5cac3f2b72b45226fdc2f34836697f815ff99e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652361890, "uuid": "d0f87239-b0b7-424f-a765-710cd20cda9a", "comment": "Malware payload (Mirai)", "value": "425c8d154ba9061443bcccdd1d55183ea0c44aa345982caa852f5b707f626704d5e00af7f4e317b10e61aaefbc0991ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361890, "uuid": "d845b972-1cc1-4e1b-bfa5-c93387b33a27", "value": "T1B1930885B8819E15C6D413BBFA2F008D335297A8E2DEB253CD145F6477CA81F0E7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361890, "uuid": "7e732592-c068-4c73-bbba-f43d7690237c", "value": "1536:019n6ba+ZvOpqHk5QOgyb+YAYQ+yxNcjsuCvw9mrsplDKZUCQBKXAVanVX+F8Jyg:0KbaykeObbDAV+eNOsRo9mrsplDKZUCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652361890, "uuid": "2418fde4-8e55-499c-b827-556b6cf7c885", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652361890, "uuid": "9c45a93f-dacc-4c82-9448-e6f4858c2fbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652361890, "uuid": "42558249-e12f-4f08-8307-6f3272be4a57", "value": "12590dff0c9708f3686b59dba62cdb55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ac3d75-d1bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652338044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338044, "uuid": "f66091e7-1076-40d3-ac97-72bf7343b1e9", "comment": "Malware payload", "value": "2431ed92d66c1fcc0df8166ea10439c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338044, "uuid": "b8a5c4b8-0725-4a4c-9618-cd762f7f1c52", "comment": "Malware payload", "value": "e67d670ce2bd5557a6a89b7039fd64e2314f384d2f9798f6b8cdb9ab8dcd4679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338044, "uuid": "f95dea45-0a6a-42d1-a24b-f0057f71d67a", "comment": "Malware payload", "value": "fb6698831de63925c7a5244afe31964abe042af1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338044, "uuid": "ae255659-b5d6-4170-ad85-d90a02a51d92", "comment": "Malware payload", "value": "11aba536b4d9b771794ccbea9b115e531a8dcef8b200cfa5523812bcf26749667dfdeefaf551297e075ee52045d69527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338044, "uuid": "cf657149-2d10-4f37-9a91-3b2917cb5956", "value": "T105411AC6552AFCB2D80992B540880B69139FA3F8C3DBC30B48B00C1CE3923473D8AA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338044, "uuid": "07b5f50e-03d4-474d-8949-43392184ffdc", "value": "24:eyGSbvQ8ACKA5tz0QadP1Md3yIiHe/WrOeaff1k+pchr+XPzDNYpG/d3x9Qae:TbI8kAnWtMdiJH5NaftkUG+iy3xCae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338044, "uuid": "aa7cb97a-ec21-493a-8119-f7988e575c04", "value": 2249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338044, "uuid": "2f02a49c-c6b3-4c54-ad75-098bd7609da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338044, "uuid": "7fcc729e-c73d-4097-a0d7-881aaf4cbedf", "value": "2431ed92d66c1fcc0df8166ea10439c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6df819-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652340670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340670, "uuid": "1f3ff92b-5f02-404c-84a8-e570ff0a7d83", "comment": "Malware payload (Loki)", "value": "d4ead0c6cc4648902ee0d140e25b4ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340670, "uuid": "7651deae-50c8-49d3-a0c2-0d53099a355d", "comment": "Malware payload (Loki)", "value": "e6a38c1a0a6e2ab77581cb79bb0552486fe9a1f36dd715121b3c845272975f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340670, "uuid": "a190f261-1825-46b1-8e4b-7e5a34f7d64b", "comment": "Malware payload (Loki)", "value": "6bb26d247295ddef5450b0d23cb89b80f949917c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340670, "uuid": "37ca62b0-827e-4aa5-b0ee-06abdf0122a8", "comment": "Malware payload (Loki)", "value": "44cded8a2d74c15573cf3a09023fc28933e13afa885cfe9b419dbb679b50448b5c7ffb5483d7f764b75bd26ce8effdbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340670, "uuid": "94bc689e-62de-457b-a11f-1cfa7034a8d0", "value": "T13FC4020832F8DB22D1FF2F75A47930491FB5B916A832E34E0FC499CD29577924A50BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340670, "uuid": "1cb4816c-8bf6-4dfa-adeb-762b0ff9a94a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340670, "uuid": "7debb853-5c84-4d2c-98f6-6acac4c7d224", "value": "12288:/xpEp5tniE13+N5MsXeUoORKhGhawRBWszixUp:/x2VniE13LUo4K6BWs2xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340670, "uuid": "978113f0-8064-4f12-bafd-46b39a472a25", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340670, "uuid": "42fa4f1c-4603-453b-816d-ee1956d8aa93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340670, "uuid": "97544169-bde1-4011-8e74-8c0929f8513b", "value": "d4ead0c6cc4648902ee0d140e25b4ac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc69d0ad-d226-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652382462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382462, "uuid": "ffb4d8e0-e2fb-4437-9e47-c4476bbef132", "comment": "Malware payload (AgentTesla)", "value": "59e0fbc9e6974498bfe06a6c05a0ad15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382462, "uuid": "63fca244-a110-4e72-8588-20ff0bbf1e83", "comment": "Malware payload (AgentTesla)", "value": "e6bac4aef6b51a87a733f3158d810021668f232cc07c52df76a5363a3a0b965d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382462, "uuid": "e3f21e18-980f-4ae7-bfb8-8df6740abaf2", "comment": "Malware payload (AgentTesla)", "value": "a71e7355e59f3e88bb12cccf9c66adfe289f02b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382462, "uuid": "98eaea77-8e7c-4505-8247-c59cbc243dd3", "comment": "Malware payload (AgentTesla)", "value": "7e647c2285e4c4a07b9dd6a45a3fd878ec24be3a3cce01e3fcfd12cdfdc60e448e50450ec7c8fbeb62507591ed81acef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382462, "uuid": "3e2687db-6614-4550-a7ee-addfc03ca5b7", "value": "T190C41228A777AA22D2664775DCC424CE0371AF539E13CB1B2EA8736D46323D10F91B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382462, "uuid": "0c42d1b8-a340-42c4-bfb3-b081c7aa236d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382462, "uuid": "e3b58d85-80f3-4618-a915-5b2e2efeab7e", "value": "12288:3TDnxEOy2ebuBLxDI3Yxhz+7OtPfS2MKaG+E6L9eoWnzVfHh:Halcn/CqNKLKaGTM91+zVfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382462, "uuid": "0916865e-757e-4d24-99fa-164dfe2954bf", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382462, "uuid": "91b6418b-5a08-415f-838a-e3b89eb1ac75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382462, "uuid": "8e5f3b41-5988-4531-9474-f19e2137f25b", "value": "59e0fbc9e6974498bfe06a6c05a0ad15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb4b11d-d18d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652316694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316694, "uuid": "761dd0ff-8c82-4d7f-83fd-54c308680372", "comment": "Malware payload (RedLineStealer)", "value": "643d285f5849c32a8a50981f2dc2498b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316694, "uuid": "80ea83af-5a77-443e-80b7-d5536509e8e3", "comment": "Malware payload (RedLineStealer)", "value": "e76cd74644fe4b848dfeec03be1ce6c6a1dae6e2ea77e181045291039017e624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316694, "uuid": "3943eac2-e607-4500-8c61-f1ff191b519d", "comment": "Malware payload (RedLineStealer)", "value": "c83ac8419d917c249695ab6466f959a9069a528c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652316694, "uuid": "6a1b4e38-9568-43b2-97be-9d577f069aff", "comment": "Malware payload (RedLineStealer)", "value": "e5b8f3d42275d96a93c012fd842ce203027e305aae850fd6816df96eba223da1b4cb5110d8611ceb8018a2a1951cec77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316694, "uuid": "a041719c-62a2-4ad2-838f-ccd8212cdc97", "value": "T137A35D30679C9F19EAFD1B70B4B2012043F1E48B9091FB4B4EC194E61FA7B466956EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316694, "uuid": "8b19bd6e-255d-4c07-997b-ceea7fcafcf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316694, "uuid": "06371743-d9db-4cde-b78c-9f0eec65ec05", "value": "1536:TqsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2MteulgS6pzY75li:BAMOY3+zi0ZbYe1g0ujyzdEzYzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652316694, "uuid": "8069d782-02cc-4f06-99d2-7a53470539c8", "value": 106896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652316694, "uuid": "382afffa-4196-4c1f-bed1-3eea45c19da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652316694, "uuid": "36f69c05-fab8-4fc7-8d41-ae711f14c786", "value": "E76CD74644FE4B848DFEEC03BE1CE6C6A1DAE6E2EA77E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff3220a-d1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652345772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345772, "uuid": "61700c97-7af8-4b01-b37c-4f6d1ad28cba", "comment": "Malware payload (Heodo)", "value": "5810dad62fa3cecfc29b0059f84fd3f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345772, "uuid": "625a7401-f391-4d76-b754-52db8235d659", "comment": "Malware payload (Heodo)", "value": "e7793f94e665bef4d2e2813d91ada63c25ac86acdec09e71c6f9893db6b092f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345772, "uuid": "37511e9c-b244-4670-8392-5460ee6ce05f", "comment": "Malware payload (Heodo)", "value": "f139eb8df366dd3029f2fb94b4e7f334da302dc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345772, "uuid": "e83d1d9d-98d6-4db9-bd84-ed486a4447a5", "comment": "Malware payload (Heodo)", "value": "b0995e6e2a569e7d910d30a000dddd4b18892847bc5fdb8741d3b9e2346a5b47cad79c6be8eafb9b9fa6caaea1796ec3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw txsCr", "colour": "#FA07CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345772, "uuid": "15589d0a-adc5-4edb-bfef-da74275cf9ce", "value": "T15CF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345772, "uuid": "1af0efa1-6c4e-4113-9de1-4b8634081309", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345772, "uuid": "14f0359d-136f-4727-acb3-f18e2d059ed6", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSKjNwgraKRT61cKGNx:S4DzZKnH4bRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345772, "uuid": "1515a601-d9d8-42bf-b253-fb71b3371d12", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345772, "uuid": "9d0f6ba7-f940-486d-ad2a-139f851b3f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345772, "uuid": "4ffcb87a-030e-4915-8bdf-bd0edd95175a", "value": "NJrRcKGdAjwfU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b79945-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652391557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391557, "uuid": "9787cc63-7242-480e-9250-f41cc50a2043", "comment": "Malware payload", "value": "a515984d64ff3f324a2d60a2d35a1449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391557, "uuid": "58ea01f9-bb17-407b-b85f-1b65efef1371", "comment": "Malware payload", "value": "e796cadbd0c9475e8ebd9e009218c94f03633810bdcff2970eb21a36f3c98e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391557, "uuid": "c6a6c5e3-313c-4090-ab81-f8dc7990e484", "comment": "Malware payload", "value": "d0035031dc54a79e07a286bb70242d6960181963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391557, "uuid": "0a77e691-1514-4856-a8c5-e0715c98af4e", "comment": "Malware payload", "value": "7fae2a0db7e880d3c40d0a58e456668a2afadec8a52e127adac197b257b905a399415f9d56553ed1066c30dbf95d931c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391557, "uuid": "be8b1f40-4357-4e5e-98c6-8cc122e75caf", "value": "T1FFE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391557, "uuid": "ab85b43f-e0d1-4b96-8966-958c3712e1a9", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391557, "uuid": "5e08b8ef-abf9-42f9-af42-105b864ed7d8", "value": "6144:mkajLyaPIvW1TFpvzYNB1MtB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8u6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391557, "uuid": "efed68b9-a158-4396-b540-019816295c3b", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391557, "uuid": "b31c8c62-9b03-419f-a952-b71c2a7fadb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391557, "uuid": "09fa3f0b-9417-4377-a4a3-531412407240", "value": "a515984d64ff3f324a2d60a2d35a1449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c006686-d228-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652382998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382998, "uuid": "b2daf966-31f4-459b-a8d5-07157c721f45", "comment": "Malware payload (AgentTesla)", "value": "8efc146713a24e3e95ba2d9ab29ae725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382998, "uuid": "3d9300a3-cfee-4227-b928-9e4540c876c6", "comment": "Malware payload (AgentTesla)", "value": "e863be958051b85940d50519084e20fb5c3b9d39aca703569e202b6f6d7f922d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382998, "uuid": "23a926db-2efc-4abe-b8d9-2fee75beffe3", "comment": "Malware payload (AgentTesla)", "value": "3c2fcb50d2980c5f302bee122263834e6e653ece", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652382998, "uuid": "cff84f60-b332-453d-9559-f181c312ceed", "comment": "Malware payload (AgentTesla)", "value": "4e546f77d4e0c7bf4936fd3b92f0a6815c10f831b0870f8d3101d1c2121bc88addeb9f995b1689add3b991f6a0876f3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382998, "uuid": "f2d272f3-4389-45b9-b93a-c49f1274ff6f", "value": "T1BCC4126672BBE423C1996B71CDC491CD03709E16ED23E34B68A832DD87323D70AA4767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382998, "uuid": "042a1b80-fc20-4125-a312-db1d09b4e7f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382998, "uuid": "85fcc36b-1d88-4998-85bf-54ae103b1b59", "value": "12288:0v9jKUOtAe470llkgsQzYRd01El1luf/+7s+JlwW8hfSf:01j9k4o4FQzYRdp1lw+7sao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652382998, "uuid": "d79a8494-d226-40fb-8cf6-98b58d32db4f", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652382998, "uuid": "778189d4-2abc-4875-a7bc-87409a619457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652382998, "uuid": "ba809919-4feb-42ef-8fc1-c7aaddd3646a", "value": "8efc146713a24e3e95ba2d9ab29ae725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d174b9c3-d1e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652353264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353264, "uuid": "e17ecf16-83cc-4686-aa3e-7be8712a23e4", "comment": "Malware payload (YellowCockatoo)", "value": "c8cd454ac567accc7eeb51b08301c5e0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353264, "uuid": "a91398e3-8493-427f-899b-d45d7f98cc83", "comment": "Malware payload (YellowCockatoo)", "value": "e864d8d2a93f38d2714ad1f0b5f79cef79d46022cd6b29c3ed8e52c8c79e7ff9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353264, "uuid": "7d41675f-fb0d-4bee-bf39-a2e747bc6e0a", "comment": "Malware payload (YellowCockatoo)", "value": "5d6582f4391a28145cacc0cfad34262261fdab53", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652353264, "uuid": "2ca64484-03c2-4eca-b336-bc1dc61ba150", "comment": "Malware payload (YellowCockatoo)", "value": "a0d156de93d852ef98bc9649a21c91b20299bf5aa05368b23c182276b1cb264140e16c85700342225acb060d919ba770", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Aero IT ApS", "colour": "#5B4CBC", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353264, "uuid": "9f813e95-f1ab-4883-9dda-9cebb2660d69", "value": "T132B6339B895137A4E662C9CB5A4ACD32381325FB2F43AF23529D36C7DF01F81E81715A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353264, "uuid": "146bb365-ea29-4a44-815f-68a6cf46af00", "value": "196608:Ln6lHpZ1QC/8LsQ68LBqjw/jSS4qwKgEsk0uA7ws4gkoXe6vb1NNlR:D6F1x8kSSw/aqwQBoP4gkcecfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652353264, "uuid": "9e03db65-0a91-448c-b6f2-c229352c4e76", "value": 10594098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652353264, "uuid": "63c09a82-e899-4f0c-a89d-71331a2553be", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652353264, "uuid": "2f7314d0-1107-4af4-9bc2-c295e60e0aa4", "value": "ba8bd18660f8d9da758e35d8d777328dfce5166bfd60fa3a62011ac4abd226ab.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c3f09c-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391552, "uuid": "a610ba58-d26c-465e-86e0-ddb0711f89d0", "comment": "Malware payload (Heodo)", "value": "c666b34238f4d5c6875b53ff31573650", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391552, "uuid": "f55fb19f-fac1-4912-8b84-9eabba8bbab4", "comment": "Malware payload (Heodo)", "value": "e951d8fd4e98a363b27fe27e555126cd00dafa81d9da1c62d8a4ed484d1e4778", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391552, "uuid": "1631cc16-a225-433e-9cc6-dc5b3decfdf4", "comment": "Malware payload (Heodo)", "value": "5351ffc12ded674a529537f6256010dcd25db825", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391552, "uuid": "361d8b6e-6d0d-4b1e-9ad1-0a62e1cc2df1", "comment": "Malware payload (Heodo)", "value": "542c5f0789cdfb6b0dc1b53775ae9fd85296caf6cfdce67621717b553e20f2a0883c238f4db3c936edf9856967dd3427", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391552, "uuid": "658798eb-47fd-4c59-9dce-c432d3b7d957", "value": "T11BE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391552, "uuid": "c61b8da4-71b7-43e8-a3ae-9023db54f056", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391552, "uuid": "5a311a3d-7a66-4004-b007-d5a8dd79dc92", "value": "6144:mkajLyaPIvW1TFpvzYNB1MfB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN886nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391552, "uuid": "cf4e6e20-0d2a-4ef1-a763-61beb59efd60", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391552, "uuid": "81607aed-5371-4f20-a8b9-1cabeedb463d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391552, "uuid": "eedc06fd-5b93-4bad-b520-e1a6b18d6fbc", "value": "c666b34238f4d5c6875b53ff31573650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128bf2fc-d1b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652334476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334476, "uuid": "65c69a83-b3d0-4326-99bb-475a84213cb9", "comment": "Malware payload (Loki)", "value": "6911ec32bc2a1c198b1f62360bbced20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334476, "uuid": "51f4b08d-92b5-4459-a94d-db6dc3b5941b", "comment": "Malware payload (Loki)", "value": "e9f5d0b6532e6aa52de8594a452d67b6f9e367874c856e5d5a5cbab17bc8acaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334476, "uuid": "35294adb-3668-48f4-a2d9-f722602cfec9", "comment": "Malware payload (Loki)", "value": "43247388dbf63c56ef9a6e0cd3566af79f69a20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652334476, "uuid": "c61fe599-a058-44a1-92a6-127c5ae6787d", "comment": "Malware payload (Loki)", "value": "6539ca49cf83f6bc4754114fa7c0823e12414db140d6d0997b3a0a5df5a462cc661b3edd1dcfc95ed45f7d5734cbb10f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334476, "uuid": "9b396444-a636-47d2-ad8b-6a434fd9ead0", "value": "T1DA94221413A88B27D8FF07F2DE1564DC93B02D2A2D55E6AF4CA4F1ED42707A04A67B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334476, "uuid": "c390954f-01e7-4b73-b320-51ed78cc9d69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334476, "uuid": "ffd9d100-2728-4dbf-a02b-30e0df19511e", "value": "12288:0VfjgZppkjbj5GdT/g7CrRm047V9Tulce:0VrspuHj5GFMeY0QXulc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652334476, "uuid": "5a1be3ee-a74e-4a48-a689-b08f00b0d9e7", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652334476, "uuid": "e2a10334-9c67-4f80-b0b6-40a8b147f31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652334476, "uuid": "8bb56572-e8e8-4740-b050-a95bfb9f7b27", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf1f746-d1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652363404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363404, "uuid": "ed68116b-8bd7-43be-a4ce-8d93235055ba", "comment": "Malware payload (Mirai)", "value": "b9fe653fd28041112fdea13e6a879910", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363404, "uuid": "d13e1716-79a6-47ff-86a6-67a2a333958e", "comment": "Malware payload (Mirai)", "value": "ea0ddb3269c143283ca0e657ef095ff12e8c899edd96e86e4c04a63730f7e843", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363404, "uuid": "378ce060-7ce3-4cc7-bb66-362fe32eb2db", "comment": "Malware payload (Mirai)", "value": "bd168e906427dde5ffe348268e1be49eccb8dc48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363404, "uuid": "34eccbcf-389f-41b4-a7cb-411f2e83e2b0", "comment": "Malware payload (Mirai)", "value": "7f90119f4e268911a05b4fe2d85099c016db9a9b8415dca579b115e3055d0c16e4be7a251aef5f9db2e0dc59a45d4840", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363404, "uuid": "5919bfb1-99be-43da-8172-7105a49a243a", "value": "T13933F160A6767D7E8F755A3BCCA4EA960271BA1EE7FB3103B230297C87C14ED452D091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363404, "uuid": "3c537702-f9d4-4474-a754-89ca6c27524f", "value": "768:/BdfO3ZWWaQiZIFzubUgRYHQMn7UqNKyV9q3UELMf96PP3b2uWHkar:pRkWWFdFqbL+Ln7UqNKyoLG9MP3ba1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363404, "uuid": "4091af8e-66ae-49f1-ace9-695f07f5dc92", "value": 54256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363404, "uuid": "ef36227f-8517-4195-a1c8-303db67fd429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363404, "uuid": "446132a8-dd07-4507-9c76-c136a0dcdc78", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a95d8d2-d248-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652396847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396847, "uuid": "967412cb-5034-463c-a1cc-ad90d380b7f9", "comment": "Malware payload", "value": "d042950e36c564afdcdc19d22b4632a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396847, "uuid": "d3829777-aa6e-41a4-bf0b-2b59d4bdc0c4", "comment": "Malware payload", "value": "ea1f01dd97697e7dcf9c75f68f2c10f5dd58db0e79e043d87adff571d8b07f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396847, "uuid": "16d7ca13-b52f-43b6-8b54-b453d048f0c4", "comment": "Malware payload", "value": "fd3f3d7c265e1d9df20aae8feac466676a24a6dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652396847, "uuid": "aff10ee9-e8f3-4049-b6cb-6626466e6060", "comment": "Malware payload", "value": "528840860138a678c0a65b78c47643260b35b95522a8d062b8a39148d7cb954693aea425bebb8912a6db52ac3095525d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396847, "uuid": "d72d9b60-28a1-4033-9c49-f29893253217", "value": "T11BE449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396847, "uuid": "9d196f19-d954-4753-a9f3-b3b222d59c85", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396847, "uuid": "7bb1a683-f811-47ec-abed-8a61095ef35a", "value": "6144:mkajLyaPIvW1TFpvzYNB1M9B6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN826nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652396847, "uuid": "62b9595b-b8ad-45ef-94a5-b36101ecef5e", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652396847, "uuid": "cfe35157-37fc-4370-a370-25dbf2121a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652396847, "uuid": "6f96e8e3-74fb-4157-a36b-2d86559422b3", "value": "d042950e36c564afdcdc19d22b4632a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6429ea-d1e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652352608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352608, "uuid": "b27f0cdb-88ab-46ee-94d6-7e03422c384f", "comment": "Malware payload", "value": "820dad979082272307cd180007a698be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352608, "uuid": "0a40f35e-0a31-48e6-80e0-1976da47c117", "comment": "Malware payload", "value": "ea2ab49c0796420dd7b0381f4e30f5b168bab430c30479e844e02f9365e161d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352608, "uuid": "bb2e6f65-2185-47f8-9ebc-75d0b987728c", "comment": "Malware payload", "value": "3ffdb30668173b155fc10b2b57b5feafc6aedd69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652352608, "uuid": "eb417fb2-7dd4-4688-abd5-bcc6c445ab05", "comment": "Malware payload", "value": "50dbe4e96ec90d649c74cc51ae0503dcd8c0cb9bb59f9c1ddad1a158ae6613c3d5717f7970293ee5a26551596475ad55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352608, "uuid": "93a11e6e-b10e-436b-bc9a-8c84e12fabbe", "value": "T16303E0609BC47572C9F81DB2F32F039323B22FF91D4566B65A34921DAAC227C45B5A0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352608, "uuid": "b0bcb8cb-fae7-4a5e-a9ad-b58ea297ec32", "value": "768:ilE1D/5n5nEQxwNQ21VfQCtBY/gC5PuLwc/l6ROmgalJ93Uhoi:YE1DBnpQQ2DfRFmusYNAooi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652352608, "uuid": "61860409-ae10-45ad-9d93-1bf32dda8293", "value": 38412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652352608, "uuid": "011c035a-8257-496a-be3c-db4ba8877a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652352608, "uuid": "65b8d5fe-4c48-48db-a893-d9362418f639", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e8ad36-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652379386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379386, "uuid": "884cbd66-295a-440a-886b-a4cc98fca732", "comment": "Malware payload", "value": "ed1c2ef70d645dc0e3955514796c9929", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379386, "uuid": "d8fa86d5-e7f4-4d89-9d98-f72e8471f60f", "comment": "Malware payload", "value": "ebc7de45a65671ee7ca278256b83211f46243216140d0ff499e05d42ac43ec45", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379386, "uuid": "71873e6d-438e-4194-b0f1-42d556973044", "comment": "Malware payload", "value": "757ca1a0f3a7a42df0630206fdd307bbd96d6785", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379386, "uuid": "01ee3de7-0b9e-4bde-8ca8-930bcfad9a87", "comment": "Malware payload", "value": "de5894989ca50bc262a6e9449c9a6d58563d429754fc02d87b9af0bb2166035b29e3b15a0954fd8f84898b5a6fc888e9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379386, "uuid": "3c586c44-3c4d-4aac-a356-5cb8f14dc27b", "value": "T15204015A76C5638CDF726377087E8F3013E1DEC923798952ACE9B2B60338589947974C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379386, "uuid": "a788b01d-8642-468b-8e2f-7531d64235e8", "value": "3072:HAkCzHavw9Ge/yHdSIoUTO/2iPTox2rxWnUdzIDuwRK6pi0zgyEyL7INUIAepl:gkCzHp9v/yshuMLPT/tSUNgucKIDElyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379386, "uuid": "9da96f3e-9468-4878-9daa-d9e7213453b0", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379386, "uuid": "0d332865-b86a-47ce-901a-479bdd63ef2d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379386, "uuid": "1758023a-0471-4e93-a179-25498e176857", "value": "MT_749048847349.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9880f46e-d1de-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652351451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351451, "uuid": "02929dba-6022-462a-a03a-bc0dd6030f04", "comment": "Malware payload (AgentTesla)", "value": "16cadb678d77eb3231a86c798a56c8d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351451, "uuid": "cb67bfd1-b513-4294-bed9-a3c9c02d23fb", "comment": "Malware payload (AgentTesla)", "value": "ebdbd8487dfdaebc34214de4e2f6fdfc5b5cfb30b9fa98ca9269a4cfae16cb93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351451, "uuid": "58e833ca-5bde-444d-a5fa-f57feca007bc", "comment": "Malware payload (AgentTesla)", "value": "4b5da18fb7712823f566e3f5bf38259f2a7f795b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652351451, "uuid": "daba6d8d-3909-46cb-be4c-56b38181456e", "comment": "Malware payload (AgentTesla)", "value": "fb64466c947d62885d8cb18f4bac9d5fa190003f6b5c3e7aae5f273e419f66d99ac944cfcd0007e08a63a9b57a9dbea8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351451, "uuid": "94bff177-d26e-4caa-9b21-af94edcad652", "value": "T16AC4121975BB9261D14D5B72CCE840CC5372BF86AC13CE4BAEE8328E56337D60985B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351451, "uuid": "44ae6084-885b-4add-9b4f-1f19bbc221ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351451, "uuid": "52ab6fb4-ff8b-4857-a140-5e3f774d9231", "value": "12288:2LzbFEO6jGLTMYeT3YyZusokHjCnymzEjxVKsBbtNPr:UOZGLoYe8VsokDLm23Pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652351451, "uuid": "e06a8f71-e3a8-4b5c-9752-f1ad6e4937f9", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652351451, "uuid": "9eb0808e-9256-46b2-9705-2b40cf2fa730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652351451, "uuid": "e1f993d7-be66-43c2-999e-938fbd0e4b79", "value": "Signed_document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98642f47-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652343720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343720, "uuid": "3c2bbf6d-4f2e-478e-a0e9-cfb1eacf4b06", "comment": "Malware payload (NanoCore)", "value": "ff76da5616699735c9f7c70ba9e66909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343720, "uuid": "866aca42-aa7d-4887-a46a-daf94ab549e5", "comment": "Malware payload (NanoCore)", "value": "ec04ec5840bcab1b86ec8e2a9d5d8fcbbc687a6235df0bc416e3cb6b149faf97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343720, "uuid": "d724671c-1be5-43cb-b175-1fc3fb0f5f7d", "comment": "Malware payload (NanoCore)", "value": "9b0c1bf91bfd6e8e0a1d68f5d0da2f8addad231d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343720, "uuid": "3318d535-379e-4f7a-8d14-d3f3c88f4684", "comment": "Malware payload (NanoCore)", "value": "add61700c1c9611d29185a18c2b52a401be453927c87c73ee7dcfcf86ae211fb1195ff34c0257cf8a9580437152c6262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343720, "uuid": "dfe8689c-fbbb-45a1-befb-2dea231a5aa0", "value": "T151358DE0AB08567FDEB1237AC1B855313EB61D4AA495FF28578E32C84973F8E09D241D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343720, "uuid": "fb277af6-60f0-45c0-a1cd-e2089a053e5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343720, "uuid": "fd0054b4-0d01-4337-bb61-857b6ace0995", "value": "24576:SDR/oGw6CEzu7ycumCcFTJScFcWVMoy+x:SDR9w6CfycuMJ0cA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343720, "uuid": "af29c061-4a7e-4955-bbb7-c7e117ce7533", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343720, "uuid": "c7549b99-ec2a-4bb3-926c-c15868c6a86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343720, "uuid": "60a08464-8a2f-4260-abe1-bd08a95f1de7", "value": "ff76da5616699735c9f7c70ba9e66909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c192ef-d1d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652346824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346824, "uuid": "b39546bc-923b-4105-acfe-5fd17e98aaad", "comment": "Malware payload (Heodo)", "value": "74d7009f3057a504e8103b8a707cadf2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346824, "uuid": "59c90b26-4bac-4c77-8edc-b982dd763c01", "comment": "Malware payload (Heodo)", "value": "ec49e914600c706a5ec79f09fff8b7b7794dc08dd28691ab9719a87283ddde9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346824, "uuid": "d983a25c-5af8-4488-b97b-5a92fd29e04e", "comment": "Malware payload (Heodo)", "value": "a40c2d69aeb64a40755b25b35afb3fa4b6be2049", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346824, "uuid": "e7796679-c741-4fb8-9eac-5f4269d96732", "comment": "Malware payload (Heodo)", "value": "d7c936a326838a46e8c8037f46ad1f4afdf939464f2359d31dcab1b1aef2df818e9f37fe8ccac19fd53a9c264bd59747", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346824, "uuid": "310e2ab7-383f-4ae5-b478-3200d9dae25c", "value": "T140F47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346824, "uuid": "fa851160-1c64-4eb1-bf55-ad4934e298f8", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346824, "uuid": "d2c8371e-d640-4585-8766-f2542fb85c80", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSyjNwgraKRT61cKGNx:S4DzZKnH4LRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346824, "uuid": "d67f5e4e-8357-46f8-a474-5507a846815a", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346824, "uuid": "580a5e17-21bf-46ee-a2d7-26ae7397eda5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346824, "uuid": "5b41f4cd-b576-484a-9495-3810530dc5f2", "value": "74d7009f3057a504e8103b8a707cadf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32dc434-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340731, "uuid": "47318115-b3d4-4f3c-8b5b-1375b4547b58", "comment": "Malware payload (Formbook)", "value": "b116243ed4215cbcb325a827d11cdc68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340731, "uuid": "cb1d18bd-bf04-4a7c-9230-fc98b6e7885a", "comment": "Malware payload (Formbook)", "value": "ecd736b3ee17564a101bfdf8ff757edf53948a983ef1c1dd088cd9f214034990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340731, "uuid": "623ba14c-3b34-43c2-b727-c52d0795b166", "comment": "Malware payload (Formbook)", "value": "c9ef499d8ec2966dda389ce769012b4ad6661cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340731, "uuid": "268b880f-e726-4068-943d-f622709fbe05", "comment": "Malware payload (Formbook)", "value": "4c17553029976420def1631be94f0a1cd136108c7c81ff1312b460555fb475ed4a9e6defdcfbd88f37a60e674284d253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340731, "uuid": "fe0f1a2b-4c50-4265-af7e-899fa47be91d", "value": "T1A43412143B60E073DEF7AA325D7AB6365DDECD360470A6478710BA9ABD32300ED9A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340731, "uuid": "04f5b645-7c92-41bc-ad8d-5655b05c5e14", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340731, "uuid": "1eb28fa0-a0f4-4e78-bad0-5b8dcb2ec054", "value": "3072:LODZGPEounbyg8APK9FYZjCHKKkLBn75c2f+6Ukd8cLempKAuYtO9WNBEFVL7HY/:LOtIOyrAPKzqn7/fvUU88emTFErLs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340731, "uuid": "387440b9-f869-49f8-8d7e-82428ec0834a", "value": 251470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340731, "uuid": "212184c9-4d1a-4c8c-9aac-49aabb56081e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340731, "uuid": "a6c78330-2cb9-4451-8d62-be129d26c346", "value": "b116243ed4215cbcb325a827d11cdc68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03175a95-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652343469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343469, "uuid": "faa3b2fc-73e9-47d0-87a4-a46650a88187", "comment": "Malware payload (RemcosRAT)", "value": "dc0cc06ecead271c40aebc7d9498f744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343469, "uuid": "ff9851ba-d403-41dc-a6ca-26fe332a8b9f", "comment": "Malware payload (RemcosRAT)", "value": "ed343c05faca3291c14a90e67e3235c6827b743ff081596d122484fa651dd4eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343469, "uuid": "4ea5e242-f79f-4a06-872d-e8275577b0b6", "comment": "Malware payload (RemcosRAT)", "value": "e8982e00f772e417db653eaca08787adff9e1569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343469, "uuid": "123ae680-da7d-4357-a461-d3f105a44d83", "comment": "Malware payload (RemcosRAT)", "value": "4636f51e2a456b285ed066391342806de44ce6a9fb09f37b79f0c6fbb35709247458b06c573dfdd42c180b37d442403e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343469, "uuid": "8af1e99c-c68b-42cd-a547-6ef57977b88c", "value": "T17FF41240A625E413DAD63132CF39D57447B81D957C98AA332BE47E8F3BFC1939608B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343469, "uuid": "c85ff99d-865a-4647-9fad-df2e1af4ebf8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343469, "uuid": "c80f5f72-bdd1-4ed4-a4df-38c595995faa", "value": "12288:4OfJTeePU8yGjSvbZKQSwSubuJlmD8kT0uAEP1uQtWpeh71XYp+czyjZl63:4OfpeejAbZxSw3buXm3WEP18pq1XUzqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343469, "uuid": "1ce8527c-1418-49d2-afd2-abc39fbc0ad2", "value": 729638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343469, "uuid": "f872095d-66ff-4f1d-b4d1-8cbb871048ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343469, "uuid": "d64a45c1-a15a-4ef2-9cd7-d3e03caef138", "value": "SOA APRIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8060c771-d213-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652374174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374174, "uuid": "1688cddf-7e5d-451c-a0c3-a9208383d670", "comment": "Malware payload", "value": "2e3e173e8130a72710afac420896d46c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374174, "uuid": "d782e717-469a-4b49-a653-f7666fb2842c", "comment": "Malware payload", "value": "ed447b9b0b445bf65a9c59be636c8ae6649222ab5decf7c32a8ae0c655858863", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374174, "uuid": "a497626b-cb02-4bdd-918b-3af4e8d69169", "comment": "Malware payload", "value": "9402a93b7e2997341fc2eaf2348a885ec0426783", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652374174, "uuid": "7f71799c-3314-4ec1-9453-d05b5cbd9101", "comment": "Malware payload", "value": "4e5261478be6715fbf86e2ca3ed7f69d079cb56711cb25770bd2fb7574d5c8cb4d09a658a9967c32fc40c54c73b74c7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374174, "uuid": "2ef369ac-d4dd-4131-8834-0a6faa20cff5", "value": "T13081E76335D6F463C105563D8951C1F35220FD97FE18C95B7087330ECAF2BCA09A4A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374174, "uuid": "3ffd097c-a0f2-417b-a8eb-8e07d5724b85", "value": "48:rXOUHXtNjkMgTrG8kO9QNJ0bz6Gl6Po8POtvS8mLFVismmiGFg:7OU9tXgTrG8MNKspOULFVfmHSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652374174, "uuid": "d038fc8e-a46e-439f-8d13-231fcd3444f7", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652374174, "uuid": "ae40ce92-ce8f-4130-a725-5d1da56d1e06", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652374174, "uuid": "4caeb082-3069-4d78-9e0e-64c11ede0c0e", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.32479.14595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52e3504-d223-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652381215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381215, "uuid": "6525a2e6-6730-455e-965a-551026ac61f7", "comment": "Malware payload (Loki)", "value": "fcc68e1665842ba187d428fda22fa636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381215, "uuid": "ff305594-d086-4eaf-ba60-25d6aab000dd", "comment": "Malware payload (Loki)", "value": "ed5d538388e254bf5e6df70f0a019432d30450b053d3ac8f1a810b9902b705d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381215, "uuid": "15ad217a-9652-4087-a8e1-28096164278c", "comment": "Malware payload (Loki)", "value": "de4a7dc43d9bab918d207eeddd3009ca03442c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652381215, "uuid": "da34ad68-e104-4897-aac2-9bd9d2115f61", "comment": "Malware payload (Loki)", "value": "592447515e4049293c9e04faaa50bef305dbfb325eee8efbd6b0179baa08ccca0c45009e728d28394a92b37980eb676a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381215, "uuid": "8f22d6b9-2dcc-4369-b7f8-33ada80e98bd", "value": "T12D0402407774C457EAE2973769B76B738FFE88122839174F0740AA5CBD66281A64F2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381215, "uuid": "cd72180f-be40-42ef-b056-7880f5451115", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381215, "uuid": "15704a2b-4f26-40dd-8fc2-cdd1caa21c36", "value": "3072:LODZGPEounbO78/gpVbI/1BH0Oe6Dql61FGvtMIC5eItWhad23z:LOtIOLY3bIzU96DV3GwltT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652381215, "uuid": "ca696039-e5fc-4e15-a90c-b148640c4f52", "value": 182710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652381215, "uuid": "da5e3756-45e9-4620-a3b4-a72299ecb369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652381215, "uuid": "8b6af3e2-3fa0-4c1b-a20e-8be3a65d9e2e", "value": "fcc68e1665842ba187d428fda22fa636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b01bc00-d1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652363696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363696, "uuid": "b601389a-0def-4e49-8a42-7b6fb2394b63", "comment": "Malware payload", "value": "7f016dcb7dd23a255b7d3ea5dffa2803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363696, "uuid": "7851a7ee-d5e4-4de2-9119-f957833e7152", "comment": "Malware payload", "value": "ed610595d31967e78931cfdecceb6507e67f34d8a7d50e37447866af4ea2d478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363696, "uuid": "8363910b-9cfc-44b4-89fb-c700bfa99a07", "comment": "Malware payload", "value": "0782a883fcd9c0f66c72a41e6a7ff116de0ede8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652363696, "uuid": "fbf0c018-a8cc-4637-9000-0523ec7a4111", "comment": "Malware payload", "value": "1e957d31a36c81bc581bdb56116bee0e8db0742dcfc2b9ec0d3c6049d60cdfbdaa806bc2570ec0b1aa9f922dd98c111b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "growtopia", "colour": "#405C7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363696, "uuid": "121460a4-c582-423f-a5e1-68b98840d04f", "value": "T1D2663364B781C37FD092BB7015910AF20A65E620BE7281F735D48B6FDF21DE16E2934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363696, "uuid": "fbd748f6-19a7-419b-8a96-1ff50be09462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363696, "uuid": "71fe7ffb-3003-4fd3-adb4-c5e97f0fa689", "value": "196608:ooNr5tp2Nba8/7oqkb3fA7cRPCE18g5HtssIn5:LNr5b2NGy7Cjkc5CEn5HtNI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652363696, "uuid": "24e3606b-ef40-425a-ba91-c8392077af54", "value": 6807040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652363696, "uuid": "e3609645-3664-43a9-9166-be3fb601e0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652363696, "uuid": "0b38c59c-a8aa-47e7-8ebe-b898f3a9cefb", "value": "ed610595d31967e78931cfdecceb6507e67f34d8a7d50e37447866af4ea2d478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3079be-d20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652370331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370331, "uuid": "bb334f8c-1042-41fa-8638-49468b6956ad", "comment": "Malware payload (BumbleBee)", "value": "eee4c1c443cbd1310ad05724cf1ecb2b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370331, "uuid": "1a3eb7b7-4393-4d0a-bc1e-527fff99a66f", "comment": "Malware payload (BumbleBee)", "value": "edd7f9c0e40d589bd7b321c78c7ddf29710c0ebd2fa7b7c2c1a6a7519a9b139a", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370331, "uuid": "ec8e0af7-f6c8-497f-8042-e7fa2d1fdb56", "comment": "Malware payload (BumbleBee)", "value": "e9b12c87bc265bd26c6873d1cbba4d4c6637c500", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652370331, "uuid": "c49c7992-828f-4cfb-b726-0798bd929b1e", "comment": "Malware payload (BumbleBee)", "value": "e5900bc40d03f5d8a279426ffb29bd48ebd94d9cabab4d954405fb54fe2cfd65cc7c185dcc40bed2c2a9dfc97f4d7d30", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370331, "uuid": "71499d84-664d-41fe-92aa-8be1c9c5e229", "value": "T119E5CFDD534A0DEEDBC0FD76852AF1B4631BA8E3FA1853D620F91468C1A95BE4067F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370331, "uuid": "3dd25909-8d40-4c02-8a0b-b3845300e3f3", "value": "85ef6b5bc2d2a3df0e624157cc2965bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370331, "uuid": "111ef63d-ac9e-417f-9c19-e88e45d29ea6", "value": "49152:LdCV4DWlT45ph9mqfB8Wr0yHJoOSFNZnfK7eGoj/rRPViXzHDeCV3i++HrJ5osuP:xCWzJErXjAHa23UHt+lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652370331, "uuid": "f5f5b2b4-93c1-4081-9dcb-5e6cea343921", "value": 3275264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652370331, "uuid": "409a90ac-4a63-4f12-a629-a9323c105b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652370331, "uuid": "ebe53cf7-a7ca-48c4-861c-73f11e6eb660", "value": "rustam.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bffb5f8-d1f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652359805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359805, "uuid": "235096d3-3112-4c55-81ca-c376cbec4629", "comment": "Malware payload (Mirai)", "value": "01ff32aff677cbb62febfb5425fdaa87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359805, "uuid": "398ea503-cd90-4a26-a8a0-6a543e46f03e", "comment": "Malware payload (Mirai)", "value": "ee8698461ddd5acbbe92145f362ad344fe5611d20fa39488ac07ba62e28d870f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359805, "uuid": "72d21a95-8650-48e7-9922-6d40200ad7d1", "comment": "Malware payload (Mirai)", "value": "8398be116c64dad94920862c984156f46c83f62a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359805, "uuid": "8eb50aaa-8565-4f10-bae9-970066659ed6", "comment": "Malware payload (Mirai)", "value": "d68f814a9ff9b02499370da96c161218f1cc6d183eb60ab80f1dc53b1ac0b41d77032917eea07d86db32a89b5eb3d5a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359805, "uuid": "e0a84069-2c1f-4de7-af04-3de4546870ef", "value": "T19D732BC8A493E8F5DC1406792176BB735E73F13AB139EE9BD3E99563A801B02D00636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359805, "uuid": "3f2afb0c-1cbf-440b-a9e1-b7df863ec8d5", "value": "1536:awOgQ8JS4OZm3/W97kJ2f4ol+QLk+ltLDmSWe/Ky4wJt8o73el6:Z39HJ2f4ol+QLk+ltLiSWe//4m8qul6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652359805, "uuid": "2fb3ef2f-63af-480b-8da7-a226c0fa25a0", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652359805, "uuid": "f71a6d50-87d4-4a16-9ad1-645318afb60d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359805, "uuid": "8d8d5426-5210-4b73-81aa-95f9af97a936", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731790f2-d1be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652337644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337644, "uuid": "6cfe67bc-e38e-42b6-ae7d-e6c50f33a62c", "comment": "Malware payload (Gafgyt)", "value": "d4ad003664e1b0267923ed373b3c003a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337644, "uuid": "a65cc6d4-75bf-469c-98e6-3dcfded76c6b", "comment": "Malware payload (Gafgyt)", "value": "eea09e81a140cbe84851e7e6cd228b2751efcc22be78b55861609e9f6c342efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337644, "uuid": "f73a2216-4573-414f-ba24-693229f3a629", "comment": "Malware payload (Gafgyt)", "value": "7f0936d42afc08007b222fc868b2463a6c341d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652337644, "uuid": "df05f70f-8a1b-4d43-a723-dba4537d4dc5", "comment": "Malware payload (Gafgyt)", "value": "81c02155925854b255f02a4410ccc1910011ad826de52a3fd6ac7c9d4b0c706b1aba4edba41390a8b2e760bcc74266c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337644, "uuid": "2b4cfb47-055b-4f23-acfc-6341633b788f", "value": "T18A930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337644, "uuid": "2d9e4f7d-098f-4cb4-a265-cb6ad0abaf8f", "value": "1536:LBkF9VQPAGZHYyEfgcqpq1innPTxHOxjePczYrmREqQ4b/X7XSee:OQFHYBv1WTCePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652337644, "uuid": "2b028f5c-b874-4db4-9d1c-a6658312bbdf", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652337644, "uuid": "7bf03b13-20ff-4a4b-885b-f7c8a73fcaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652337644, "uuid": "4512d857-b96d-4059-9869-fa0d54aff98b", "value": "d4ad003664e1b0267923ed373b3c003a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ca38e5-d1f2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652359897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359897, "uuid": "5523dde7-fdf9-49ee-a678-be56f3a068b2", "comment": "Malware payload", "value": "cc7317a2d6c4a34ca3e0800be92b641e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359897, "uuid": "472ed64c-f38d-4b3f-825b-ef65d6f33475", "comment": "Malware payload", "value": "f0204cc1387cc2d9d12c8bb04407597f080c16be0c9e7cbfa20667c8e461a8ea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359897, "uuid": "77338682-366d-4681-bce0-2e51caacbb82", "comment": "Malware payload", "value": "843e9f3e08755cd72eff4497860469e54420b218", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652359897, "uuid": "03dfad6b-9d53-4de8-8dd5-72393feac25c", "comment": "Malware payload", "value": "c9e3069f8a34940e82913a9a94951d0f3ecf671a499d1aadc9a3b64a3b36fd1f06fe50e77a73e1525718cd66d3d0a99a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw T31Nh1Ip", "colour": "#5B0E8D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359897, "uuid": "858cc20c-ca6f-44d0-8cb0-ee2d0be1c2e3", "value": "T13862D044A8D5C896A91920F549BC877199FE5D58CEAE5090A8A3EA3408CFA8894071FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359897, "uuid": "e0fbb0a6-4435-4cb9-b76e-f8f4c7ec9d5a", "value": "384:0bHNlH+uD6REBk4pIuJnIuutgc53so4wtLm:05lHJD6sI8nIVtB53sBwt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652359897, "uuid": "73fe64ab-ef45-420e-a8e1-da7ac1c21416", "value": 14924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652359897, "uuid": "456205b7-6468-4340-806b-7a441ad79fe0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652359897, "uuid": "031af967-0694-459f-9a9a-1bad19fd6f27", "value": "UUJ0106845874097292093.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aab5cfc-d1d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652347455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347455, "uuid": "ebfbf3d0-f83b-4f48-bea9-0386d423a86e", "comment": "Malware payload (Heodo)", "value": "76fc26b4cff4c7c034a6a6a11ca4885f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347455, "uuid": "8a69d2a7-6ed3-428d-a031-e078afd85d45", "comment": "Malware payload (Heodo)", "value": "f049f28242b2af4f7a907b9a883412634ed21aaae4c15c349e741243084c7d25", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347455, "uuid": "fa95434f-ae0f-4823-9ec9-8dfa230083cd", "comment": "Malware payload (Heodo)", "value": "42a90ffe2caba1af9f27409fdd7ece37dcb1eaf9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652347455, "uuid": "2e9ce332-e5ec-40d1-b8ac-2983d2d94c09", "comment": "Malware payload (Heodo)", "value": "109c4ffdbed08fb630402f2669438643d80cd20dcc0e9df155e12873b7e2e5b9d077fc9715d63bb9a9535f4abd525185", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347455, "uuid": "57205201-1692-4410-8a1e-e9eea6a8c9f8", "value": "T15CF47C5A72E3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347455, "uuid": "2f75f234-c178-4fd6-9c6e-915ad05ef6a0", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347455, "uuid": "f1587703-6050-4ff5-8832-c1c72659a231", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSZjNwgraKRT61cKGNx:S4DzZKnH4oRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652347455, "uuid": "0277dfc9-6421-4f39-bfd2-ba850c017889", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652347455, "uuid": "bbe03bf2-dafa-443d-85af-682e2c94c4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652347455, "uuid": "99561b9f-dac1-4754-8cd7-de1dc4f6a831", "value": "76fc26b4cff4c7c034a6a6a11ca4885f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f68181-d212-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652373648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373648, "uuid": "144467fb-8db0-4445-ba30-83c926791d48", "comment": "Malware payload (Mirai)", "value": "7e4da722714a642e168250225774e7ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373648, "uuid": "1e8ab7a3-3b1c-4b14-a74c-e8f8f5b02ca0", "comment": "Malware payload (Mirai)", "value": "f0951b5018236ae173fd0bfc84956fd19f04d6435a4cb5a1e850f8f431a2bb82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373648, "uuid": "b9ada434-034d-40e7-92ec-2a449e2cf719", "comment": "Malware payload (Mirai)", "value": "24d247da8e8731b47063055722d5b63dc9a6c8d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652373648, "uuid": "cd011219-43cb-4642-8731-7e47444565b4", "comment": "Malware payload (Mirai)", "value": "d4838db029eb2f01d9794b6a8ec8c54b285b0a2db508f0c4653c8fef1381e171583f8197b228db3240c006c4dd05f718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373648, "uuid": "2f6109ca-b516-4e83-bfe4-d104e4beb56c", "value": "T16AD2F1A062F2CCF1CF317877FAB1164D6D1917B8E49ABD244A24CA209CD0986B7F6243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373648, "uuid": "3ccd10a8-79f4-4170-bf00-422ec0f642ef", "value": "768:Ph9XbjWynx0k9CqFvX81L6ckOO9q3UELlF:PbuyNfATzLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652373648, "uuid": "53f054d7-a3c2-44b0-b1c7-143e67698228", "value": 29468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652373648, "uuid": "93880210-c6b8-4435-bd90-ac6666a18310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652373648, "uuid": "08479df4-9d74-49b6-9a7a-bdfdf4f3545f", "value": "7e4da722714a642e168250225774e7ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ea2440-d21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652379532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379532, "uuid": "98fd719c-3329-4120-a35b-c0953638e08b", "comment": "Malware payload (Formbook)", "value": "9d5bfa23857f350ce14dd21f0a42bd29", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379532, "uuid": "967a28d8-09a9-47eb-9a4f-2bf4852091e7", "comment": "Malware payload (Formbook)", "value": "f0c572c44f221308ba93f1301f995c5e8056be18e5a06c0470f383f1362aa692", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379532, "uuid": "a2f804da-648d-4be1-986d-93a8de1b3403", "comment": "Malware payload (Formbook)", "value": "bbf0a34b5e758b99c49f3b7e14cfe9a50c436400", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379532, "uuid": "45657032-a9b0-47d7-9ae6-9a0dceb23182", "comment": "Malware payload (Formbook)", "value": "24fcb82e8a173eebe65da4bcd3cc13966429b4cfc3739825b02d965ab982b9afae857a937526b6f6a6fff57f7f3c47a8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379532, "uuid": "e6fd2e66-59b3-4600-8da8-d52db3d937b1", "value": "T1FF4412A25360FA63ECD3AB305D368B274EE7D96758F1B20F5340385A7E212814E2F612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379532, "uuid": "1b33ce7b-c61b-4e3e-9255-e9405e9a6781", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379532, "uuid": "4e9310b7-4017-4c9e-9d96-14555e8949aa", "value": "6144:LOtIO6RQzs1C8gUfXfUVtkn1JSoS27/BgmaQEHQyeP:LOL6GzsvJEVux7/evgyeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379532, "uuid": "c768c0b6-0f25-416e-ac49-60d08edbb7e4", "value": 274017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379532, "uuid": "20e95996-2295-4a7d-b064-66e958ebff6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379532, "uuid": "b8247cd2-d910-4c0b-bcfa-308d6723f0a3", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8eb6e4-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340744, "uuid": "710a4659-9e37-4236-92e6-a75b0b0e2583", "comment": "Malware payload (Formbook)", "value": "a1e007787cbe3d27a07fbeb2cb0956ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340744, "uuid": "649bd7b9-8583-4bba-b1e0-01c78c50a512", "comment": "Malware payload (Formbook)", "value": "f12b517eabc8adbbbed4d0117f70bd42e00e59b3a02c8dab3d4ab95d6e1ada0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340744, "uuid": "d394feeb-e064-4426-9787-9788851b5c65", "comment": "Malware payload (Formbook)", "value": "3dd9d1fb5b8f79479553f1fd92d3f40d8b8f3286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340744, "uuid": "312b49b3-4d92-46e7-bed1-36d950328f7e", "comment": "Malware payload (Formbook)", "value": "5bb22221908a2fb8778ab8c60eea4703eaea9445ce8a933f05590cb2bf83c9a15c5ee868c1e1961fda8533c68ec16e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340744, "uuid": "61711870-1fc8-4fda-98bc-221eb5123277", "value": "T1C9341255B381F697D17352B30E2B5B2A0FFE5C603898511747902B6D7A312C2BE3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340744, "uuid": "a48cab08-6509-4726-9790-c7c2435d1ddd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340744, "uuid": "9c8b6c2d-0005-4205-80e1-ed845e24488a", "value": "6144:LOtIOFqh4B2XM2eMn+1GhsjYPsMxlR/NCwGZPkW1i7Rbmg1:LOLbB2cnM+K+YPD1CnkR7RC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340744, "uuid": "9e846e21-d414-4f57-9c4b-d4924d549bcb", "value": 251480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652340744, "uuid": "5a261624-8d8e-4bd5-b126-0b91dc6cc426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340744, "uuid": "95653378-0d36-4618-a182-8ef41fc706a0", "value": "a1e007787cbe3d27a07fbeb2cb0956ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafadb8f-d23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652391532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391532, "uuid": "2dba187c-5dfe-41d2-953f-4aae9208ee45", "comment": "Malware payload (Heodo)", "value": "1e54577325effcd32f100b5bf3b641a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391532, "uuid": "eddec4e6-a0c8-41ea-9b71-9f3138396f7d", "comment": "Malware payload (Heodo)", "value": "f1916b796800b887555f5ab4259674cd830db9faa73b2cae0b31e4473b2edd85", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391532, "uuid": "eecfe31b-3be6-480d-b383-4094a0b373ee", "comment": "Malware payload (Heodo)", "value": "bd3bc54e51fe4f0d853afcfcaf6a30ea002e2f18", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652391532, "uuid": "d29b8a0f-822a-4f09-9aa1-83e2dfbafa8c", "comment": "Malware payload (Heodo)", "value": "e02e46909219ace4fe93cab0596ed150209d27fdbc2ee060dc403f0d4946cd97f7a4c4f08f98cc86460a8bf5d0d39438", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391532, "uuid": "e921896c-df05-4429-bee5-dc3ad9db5f3a", "value": "T164E449022250CCBAEB654330C91ADAF1A9617D27E75097CFA3E47D367E37292D837219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391532, "uuid": "0ffadac2-8601-41ca-9488-d7048fc69b3c", "value": "e8d4871e5b3e8b61e21cf4b7ceafb1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391532, "uuid": "b68a825c-92fc-4d5b-93d7-b80632571468", "value": "6144:mkajLyaPIvW1TFpvzYNB1MyB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN8j6nnKg6vxaEHubqLjpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652391532, "uuid": "ae935715-9366-431b-9870-a9365a76a656", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652391532, "uuid": "912a7290-9f1d-406b-8f92-d8a2b355af6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652391532, "uuid": "48ae1421-7054-4696-9e0a-ac41be049f5f", "value": "1e54577325effcd32f100b5bf3b641a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ce1ae7-d1fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652365079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365079, "uuid": "b0d6cb92-91fa-43a2-b29e-f3b42eeb62f3", "comment": "Malware payload (Mirai)", "value": "6cfee955ccd6a03efe24949d410df69d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365079, "uuid": "d6766894-9916-4ac1-adac-3e64a38a6aa4", "comment": "Malware payload (Mirai)", "value": "f208c8d3c22d4bc9345d59f13ed7766116df074e710976e688649190d6fe536b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365079, "uuid": "eedc66f1-8a79-42cd-a447-f23613c04850", "comment": "Malware payload (Mirai)", "value": "676dbfae92080748e2ecd6497cf55cfed0f22416", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652365079, "uuid": "0aa3f6ec-b667-4cc6-a10f-f671cb1d13a0", "comment": "Malware payload (Mirai)", "value": "cbd5809f18c6c197fa1fa51ca8dc25a9d582e78cb5b2eb8bcdd40889b4280ba55fa94696eb40d2c60c18d7cb89f44252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365079, "uuid": "5a9a3b50-195e-4fd6-9382-401391260a3b", "value": "T13773AF75C56CEDE8C6258638F15199399B13A00DA5A33EFADAC2C656504BBFCF0087F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365079, "uuid": "4720d8ac-5090-47fe-9499-72916c76f333", "value": "1536:nau/qMmbMJ/wtcD9VGpt9FJ4rsS2yiaHBfs3YCQTD5N6CEsr:nrCMN5Z9VGptnJ62yiaf+585N6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652365079, "uuid": "36072b41-936a-4cc4-8bea-2ed935c0b106", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652365079, "uuid": "a901d797-5f90-4c23-87cf-9ad5a5d514db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652365079, "uuid": "6899e5cb-4137-4fc3-bb1f-92faaafe3cc9", "value": "6cfee955ccd6a03efe24949d410df69d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f974f002-d1c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652338729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338729, "uuid": "815fee6f-db6c-41ca-b21f-4fee166177d9", "comment": "Malware payload (Formbook)", "value": "d26f1459b11978567bfc7a92d68e14a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338729, "uuid": "878c99f5-4dd0-4ec4-a34a-b8b574e1c166", "comment": "Malware payload (Formbook)", "value": "f20c7ee00b5f1c9f67d373efd7ea26ca2193f47b3d015d44297ed82e02364133", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338729, "uuid": "e61071b5-5674-4cc2-81ff-d54dfc0e795e", "comment": "Malware payload (Formbook)", "value": "17d88ddf889f12ed7afa5148e06860abf953c433", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652338729, "uuid": "f0ff3567-c09b-4816-a3ae-717eac9a5809", "comment": "Malware payload (Formbook)", "value": "4117abe2f0365052cb35d780ed0917879469eb51980279c9fa951a3774b81240299a25a0c9b89d462ded8017e8a27c43", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338729, "uuid": "c658b26e-acb7-4945-af9c-8834edf35a2a", "value": "T1B504121EFD81938ADFE235B403DE09BF46F2ACE45B219093A3517F9A643A650B581C37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338729, "uuid": "5160e723-8a18-4319-a0aa-bf5b9bf52f80", "value": "3072:HWkwU+V3kebV2OkA5OetRMxGB6Td6Vvtq0TQx8SDzB2tRTwzJVAZWQjhPxYYHsnG:0U+ke5OeXMxo6Td6vtqeYDzBMR0zJGZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652338729, "uuid": "78ce207f-61e5-4ae3-959f-1dde9eb5275b", "value": 188264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652338729, "uuid": "e6d5afda-8c70-425d-8c64-345ae6d9f5a3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652338729, "uuid": "3795bdec-8b3a-4406-9d50-f4c06db6f80a", "value": "SOA_PI9010.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963bcb2b-d1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652345005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345005, "uuid": "73bb8f13-3cd5-4f8a-a82c-fd1ccd9e83ea", "comment": "Malware payload (Formbook)", "value": "7a1858d6293261284137e57455d7b1f0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345005, "uuid": "0310f27d-2763-4c1e-8f85-ce26cdd9e747", "comment": "Malware payload (Formbook)", "value": "f26f0db8201c532b6c272e091727e471e2ef621700f905ecb408aa952348c744", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345005, "uuid": "2c9389d9-a6c7-48ad-89da-b31e7e7f1aa6", "comment": "Malware payload (Formbook)", "value": "9a0cbb648ca89ccf10851fdb34f45e477b237751", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652345005, "uuid": "c8c7abab-9609-4a5d-aea5-3618943865ba", "comment": "Malware payload (Formbook)", "value": "5179c3b662d1d4d9b654bf98bcfcbe11d09e26887cbf2b0f9a78d941b7b3a36998a8de0b5ca4dc0fc7b7252de5471b67", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345005, "uuid": "6001f094-4e5d-4fdd-9017-0c41bb7b5faa", "value": "T15FA4231DB8EED917B3EE928710FB4A0DC807D97384CA0944162E6A7393EDD0B7269573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345005, "uuid": "9c7abc0d-33b1-4542-9647-1989613656f6", "value": "12288:Grq79ImD9o8OmdSjBumxwH4gni6Cm4XfES:qq7uM9o8jSjMmC4gi6B48S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652345005, "uuid": "200018b3-5503-4f3b-a7b7-7ab48679bd00", "value": 484368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652345005, "uuid": "230d925b-959f-4a1b-bd78-4f1d560d11dc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652345005, "uuid": "6a1e4231-b18d-4daf-98de-d47a2de95d03", "value": "DHL Shipment doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce1fb69-d1d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652346358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346358, "uuid": "0f7231ad-aed9-4e6d-9159-8a5394eb94d9", "comment": "Malware payload", "value": "721166cf77ccb062fc7ab650327a28a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346358, "uuid": "145e224c-9970-4dee-b07d-e2b7b139532b", "comment": "Malware payload", "value": "f29dea448fe69ae5d7b874be225db808abca82a878ddcd69b6a0e4fd134d31a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346358, "uuid": "b4f7d293-b6eb-4900-939e-740ab30c1fcf", "comment": "Malware payload", "value": "2006408cfd6561a1944b71b4a3a13f910d5791fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652346358, "uuid": "9ed6da11-a78a-4a20-81c7-941f2b14758b", "comment": "Malware payload", "value": "71419907a0e787f57e54d7d3865f8726ae80d5caba314e1738c28b227044f58dc1a17fc1b4f7ee2517b4a450e1fb74fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346358, "uuid": "38444d32-e516-4446-84da-eee2e60e5518", "value": "T10A13618C769075DFC8A7C976CEA41C64AA60747B430BD343A45322ED9A4CA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346358, "uuid": "37962e58-c8c4-4a3f-8296-6a1cd03cd38d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346358, "uuid": "de6919a9-6ab8-4d21-beb1-8b3fb2d70aae", "value": "768:Dzr0jqv+TEpoSWY30KU4ySQpkUTeKqM+kK1w2:DzYob3vdy5pkUTehjJa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652346358, "uuid": "ad9a63bf-8643-45a3-9df7-845dde95e6f0", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652346358, "uuid": "acfa76f2-58b3-4e19-8427-07690e095292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652346358, "uuid": "b06aae9a-21b8-45c1-8c1d-b9cac2476aa7", "value": "H1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6bde11-d21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652377442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377442, "uuid": "c0525572-ddf8-4dbf-95ad-97b6a66dfb78", "comment": "Malware payload (Mirai)", "value": "9d26e69bc4d878d54c0f5d026733ffda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377442, "uuid": "9ee947b6-e125-43a6-9a0e-2e953bedf27b", "comment": "Malware payload (Mirai)", "value": "f3175c83c968a85da568b99fa0b822a8c14fe521e7a8caa37804e9937bacd93e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377442, "uuid": "17442c08-c2e9-40ac-b947-142f765f6b7a", "comment": "Malware payload (Mirai)", "value": "98c025c75b56f24093f16bc3e0276245d8af3b37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652377442, "uuid": "9554d108-1de7-4ff3-ae6f-1a8307323d0f", "comment": "Malware payload (Mirai)", "value": "cc83cc99a6d29fddc287cc094fafbbb937d10ab960afbb364e4b8f6e1552ee713b78e1ebabdf99421313aa04371ee233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377442, "uuid": "beb34880-28d9-4c89-8b20-d988cd5cc972", "value": "T17F933B47A8619FB7C0866AB125EA9D300B23A8D11F4F1A59702D97F4434F9DDB80FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377442, "uuid": "be15f00e-4439-4dee-a24a-fc04d11565a7", "value": "1536:fRh9eyATfE66zlz4W7a5KnXx2tmksiCC5CumUMVqOEsIfze6:fLFATfEdzlz4AnXSsit5nmUMVqO3Ifzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652377442, "uuid": "8f3a25bc-e11e-4ebc-8bec-b67a0d10b5ea", "value": 94787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652377442, "uuid": "df60353f-34c9-47d1-8b4b-c20ad7b0f4cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652377442, "uuid": "9945709f-0561-4969-af55-d0ea739b7ac2", "value": "9d26e69bc4d878d54c0f5d026733ffda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dddfa5-d1ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652330800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330800, "uuid": "fd0d39ec-21a0-492b-8895-b0558e5390a4", "comment": "Malware payload (AsyncRAT)", "value": "b6661ed6282f2f5aca7f9df8030195ed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330800, "uuid": "f0ba8b07-6a1c-477c-a6de-464fdd951fc3", "comment": "Malware payload (AsyncRAT)", "value": "f3400425aa7df4ae3d6272e7d100d322f7a090928e849a8672cf104c969a641f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330800, "uuid": "73ee0383-3936-45a7-a65a-d858a544127d", "comment": "Malware payload (AsyncRAT)", "value": "8d187e73398929fb409756f7b77b831822cc526e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652330800, "uuid": "b56d4f5f-2552-4475-a92a-da41dbfdbca4", "comment": "Malware payload (AsyncRAT)", "value": "6ed80fd36c6486a1db731fdff6d7345047eb597016331a11b38a5c159efec2308096c44496e827f935251a210ebf20e8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330800, "uuid": "c0fffa11-adcb-44fc-b9c7-a7b6fbab93d7", "value": "T122C5010BBB449B25C5583637C5EB246467B490DA1A63D3076ECCABEC2D33396EC0B56C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330800, "uuid": "2bf724e4-d20a-4bbb-a9c1-37a16eaf54b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330800, "uuid": "e6ec6971-02e9-4783-85e1-c4e929ff2d83", "value": "49152:Uq9wiHFH4FN5SgxRCIZlKF+bX+A5Egi4vtkybQo2metFF9uQRq4irxI2P:UqWNHxRCWlljXu0nkvtBniV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652330800, "uuid": "1322195b-2bba-4884-a05b-963bbab7804d", "value": 2701312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652330800, "uuid": "9cf89564-f0e7-433f-8248-3766ba620314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652330800, "uuid": "f2b028b9-d1f1-4226-8e08-5a5c9c2450ee", "value": "F3400425AA7DF4AE3D6272E7D100D322F7A090928E849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f953aa4-d202-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652366737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366737, "uuid": "a107b7ee-5707-4aa3-88eb-1cc036933390", "comment": "Malware payload", "value": "177f645a4dc89250a5493c581523979c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366737, "uuid": "f54763c6-d897-47af-96e1-4e25900ab1f2", "comment": "Malware payload", "value": "f3b4b41b812bbbc46b0b9ca8788fec6dd8f043a4a8ced87c51365ee74b4621df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366737, "uuid": "b92f9c1d-ee86-4515-bcf1-21a051392981", "comment": "Malware payload", "value": "d38c8885cd913a997952408fcc39ee2befb3b629", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652366737, "uuid": "110af4fe-dfb0-4208-b0dc-20b4bdf331b5", "comment": "Malware payload", "value": "f0eac2a63968862cd7a8a4b59f1411cb0fdbdeff3c8b9d5bbc91101e5fe26433f84430c2da4a666668037ef13c8621c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366737, "uuid": "75a13102-96b7-480a-878b-6b51981c1562", "value": "T1F1C4121A33A46F22D6BA8BFC26B0301503F923273462FBAA9DC551CB19D5F044B45E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366737, "uuid": "d27a7fe8-80ca-4c38-980a-28dc8e584f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366737, "uuid": "7117db91-a09e-4f49-9db7-f18cf6a503cb", "value": "12288:1iFkKaZcjSZoeJyY6CW8TchmQYXVYPhqEPOeLqy+yQKzIkT9WO:okKase4Yk84U7ZEtLq7yQKzb9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652366737, "uuid": "05f04ea1-df61-47d1-9264-842504a96865", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652366737, "uuid": "02e0abf7-4de3-43c1-b511-9e3aebc1055d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652366737, "uuid": "a769d80b-32dd-4418-b86e-7de75dd873a5", "value": "177f645a4dc89250a5493c581523979c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9658e81-d22a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652384148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384148, "uuid": "5f5f07ad-8ba8-4485-a494-07cc19eccb95", "comment": "Malware payload", "value": "d4dea4d4639e4161da1237e5a58e83a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384148, "uuid": "1b085fa0-02d3-4732-aaa3-a59cb3ea7e47", "comment": "Malware payload", "value": "f4545a7a1fbf2a6300b9342723bf4128cabd16a09a98d00ec5cdb1582d11a5f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384148, "uuid": "b37f1162-efae-431e-b96a-f91f6a17205e", "comment": "Malware payload", "value": "dbe0018b1a7b0c3ecb21df98a42397233358eed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652384148, "uuid": "3867c8b3-2a7c-433e-97a1-2056a04c8f88", "comment": "Malware payload", "value": "78cb58c27ddaadfc67d3fbe5ccafff59923fa7681ad8c9e4df1cc29297464e99c1567e46b6d34b978d4f93dbbe49dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384148, "uuid": "8668dc90-55ff-43dd-919f-26676614924b", "value": "T16C04D892F192C19DDDA40B71EC7AC8D801937D5DFD70A90E7892B39E2A732A2035ED47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384148, "uuid": "6d65eb92-ae68-4da5-a01f-3f8fcd83cfcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384148, "uuid": "080dacb8-233a-4e23-ab07-bb6d3ae66a1e", "value": "1536:u5L3brDY3pXsM6xpeJnKdvAamzw8dDtAaG9ijHx:QL3brYUNvpeAn9i7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652384148, "uuid": "47b39b9d-bc4a-4d0b-a155-31ac50dcf8b1", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652384148, "uuid": "c6a4e27f-7803-4166-8814-a869482af84d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652384148, "uuid": "5381db2b-aaf9-451b-b5df-4482b2d26bc8", "value": "grace.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198c08f1-d1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652364123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364123, "uuid": "5b93b92a-eb74-4e91-93f5-d0ff4e93e608", "comment": "Malware payload (RedLineStealer)", "value": "1b8160fd2b8dec9ef5fcab44e49325d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364123, "uuid": "dd4a04a9-9cbf-440a-9ea1-1c31042b8792", "comment": "Malware payload (RedLineStealer)", "value": "f4dd9147ff7ae18589e20cb2b244918520f8025e15c73d0cdf6d1195ccfbab86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364123, "uuid": "b090db44-624b-4e02-9e2d-cb6ecac38e21", "comment": "Malware payload (RedLineStealer)", "value": "7ed418261fab51eb3d643574297155eb22d0acef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652364123, "uuid": "3fd197bd-041d-44be-a025-bb1a08312fc5", "comment": "Malware payload (RedLineStealer)", "value": "d9c629d8dfd2730e1f5994ce0539a0670f9280317eaca0e3bf5f65987c568d0615fde05320f78b8e77c298302814687c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364123, "uuid": "17f39537-840e-40f2-9d5e-1a41145fda6a", "value": "T1D7556ABFAB01E52FE213F030D15D9625682227312A2F789767165AACD72F1C0DE25F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364123, "uuid": "5cd1fa49-76b3-4fb7-93a4-dc14d2462fd0", "value": "6db5fd36871bf7ca78879be44b315cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364123, "uuid": "a8185e45-569d-4f2e-a2e6-440660a9665a", "value": "24576:JyhfGU0N4zzoe86PqLEW5pvAUxWvM1opdujCY8ajkfXNQUYfkoPyu9gG864olB3E:Yh+URzzJt3WTva4FljJJDxlBFNNMoPin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652364123, "uuid": "bf501ac0-8291-49b3-aed5-daebf057225e", "value": 1385464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652364123, "uuid": "78a22687-87ce-400f-8f5e-819f6ab13c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652364123, "uuid": "f4b296d7-113e-4054-b7cf-783393982d63", "value": "1b8160fd2b8dec9ef5fcab44e49325d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7010d87-d23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652393271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393271, "uuid": "dd0c4c9b-4bd0-443d-b294-72ffbee3a459", "comment": "Malware payload (Formbook)", "value": "c52ea876f58edb9e098c468246cb3c45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393271, "uuid": "2c5232c4-67b5-45b8-8ffc-261ac2cb784d", "comment": "Malware payload (Formbook)", "value": "f5111a8cb2ad774437f4c7e49e57f936188943f9819741754ae3ccc5fe02fc50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393271, "uuid": "3e691055-ce18-48b4-bd77-0102989e3b3b", "comment": "Malware payload (Formbook)", "value": "321ea4228f13cf39458031650a113b8304728b24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652393271, "uuid": "9e7a24ab-03c1-424f-87c6-468641e42417", "comment": "Malware payload (Formbook)", "value": "9a8dce63fee6f0e047a4439291c4dc22811a791589d8cab76b6af03261f41463b03b5ebb3397116a6a5fad6729ce9fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393271, "uuid": "b16bc3fe-d59a-4c84-b0f7-9e343949be07", "value": "T16FE4BE53B119DA04C578BAF652205D9042A26E8E90B2D2F95CB037B925F73C3FE507EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393271, "uuid": "578ab89e-a976-48a8-89a0-3221874a39f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393271, "uuid": "3dcda16f-bc05-444e-aad4-71de1af9d7ce", "value": "12288:fpMgHlCsDN+a1BTGSzFFZ6hCH3xGPAs1f+6YDl6BZCLJGvT6cOwRhk8lPVR6/LkC:fpM+U6cOwRPlPm2COaECPU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652393271, "uuid": "ad587e51-b393-4607-a039-dc14dc2e8585", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652393271, "uuid": "d2c70c65-60ce-4332-9ff3-cbdbc9f3ded9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652393271, "uuid": "d63c8423-ef48-4f34-bb60-6836fd2b088b", "value": "Barisan baharu 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea99b620-d220-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652379935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379935, "uuid": "7e9919ad-ece0-4963-a2dd-608d37f8c89e", "comment": "Malware payload (Vjw0rm)", "value": "6b9b98ab790280f0ae64ac2b30ee8220", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379935, "uuid": "60d604eb-5619-4007-999a-cb949065a3a5", "comment": "Malware payload (Vjw0rm)", "value": "f51f03f44d58094228377eb49e0b28d3b4d41da39eb7fac11ad878888d452284", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379935, "uuid": "028be5db-e6d9-4bc6-8af9-78b03e67fc95", "comment": "Malware payload (Vjw0rm)", "value": "00323d7c0c9a743f9c8bfcbefce71f4cd9114206", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652379935, "uuid": "bf6b1f3d-34f4-42d7-82de-77623e812b2a", "comment": "Malware payload (Vjw0rm)", "value": "5ac91c01ca2754120a7cc85987b2a6c637112d848cd81c75809e359503f127661fb290bb6d940be0c8257fec6152cdc6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379935, "uuid": "15c6ea05-d1b3-4e42-9378-bf3aa18fe7f3", "value": "T1EF93848B7CD8F8F1DB0FE9C14060BF9695119236AEF969CDC04607A48D6F79394A9C23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379935, "uuid": "2ee9cd87-7b7b-4723-b29d-9bc07bc6a6c6", "value": "192:GxOipO2sheUI6Bg3mGOou5MkvPM5vKMreh4Mv509Jeh4Mv59U9PMqkSrjM+59OoF:GxtLsA16W3ng8uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652379935, "uuid": "68162c70-f71d-4636-a1a1-64c12ff63238", "value": 92930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652379935, "uuid": "6686b3c8-eeca-4a2b-966b-3e32e60a4c73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652379935, "uuid": "ca21eaf0-d1b5-4c99-8dee-9aa2a3c1d845", "value": "InfoReleveID0012551586503.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15529061-d1cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652343500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343500, "uuid": "a0163637-bc75-41e2-b215-6123caece1d7", "comment": "Malware payload (AveMariaRAT)", "value": "01822d48ca51eaea6dc483db18f7c0a3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343500, "uuid": "8f74e048-1e54-4ab2-836f-7281fc67ef10", "comment": "Malware payload (AveMariaRAT)", "value": "f5f15c0824e07bfb0838592f6d542c1d3b236c158b23df1392b7562fb94ef1d4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343500, "uuid": "77cae4a3-adb7-4724-bcfb-8b123f881bcb", "comment": "Malware payload (AveMariaRAT)", "value": "b81864307e53294fe8c13e2be899aee0704b2092", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652343500, "uuid": "d6076309-24e3-43be-af3b-9265b0e68f36", "comment": "Malware payload (AveMariaRAT)", "value": "0bc9d8af5941f567ea01e6dcbaa4be7e82cb549d7ab76edb4bc224ccc7d672e2fe8220ac2b40fac767df35b45487be2f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343500, "uuid": "35211a20-42a9-494e-a2f1-964d302e4546", "value": "T131A4BF5472A86F13FA7E93F45421505067F36CAF6AB1E6441EC330EB31B2BC285A4E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343500, "uuid": "ba5061b0-e942-4704-a68a-193a503b6260", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343500, "uuid": "b3b28196-6016-4a9f-9d7c-25abcfd628fb", "value": "6144:AKYG+H3QY9lSSxmJpQs8wC+KvCl3YrGA+Ykzjxc5SsdTkDpUBKm+vuahzwUPXo:AKYGjqSSSCs0vCl3Y6A+YIxc5PeUwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652343500, "uuid": "9fdbf6ca-ea4a-40e1-a873-37da335b851c", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652343500, "uuid": "6efc23bb-61f6-4a8e-be6c-fb7e9aad8842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652343500, "uuid": "ee138230-98f3-4174-96f6-0916348eac7c", "value": "SKMBT_77122012816310TD01_20220128_163956 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c4a173-d1b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652333216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333216, "uuid": "875fd45e-c729-448b-96ae-51430bd6386e", "comment": "Malware payload (SnakeKeylogger)", "value": "c59fc968f6d7b4d39d65de29b5685603", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333216, "uuid": "fbe81ab3-f21d-42eb-8e97-4b62a1565bab", "comment": "Malware payload (SnakeKeylogger)", "value": "f656604538654dd3243b458789440e5a31b6a404cce9521ce9a4706039295012", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333216, "uuid": "97002483-2d0e-418e-bd07-fb65de0ae343", "comment": "Malware payload (SnakeKeylogger)", "value": "118b27b97dcc044af0cd7c07540c034e207298c2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652333216, "uuid": "c1e117e8-db83-47c4-a9b7-cd0ddee97f60", "comment": "Malware payload (SnakeKeylogger)", "value": "0f3bd2f61dd4f65dc56d88bdfee3a271c12fa877ca0885eb1927fec5963e713e4ae64f7efda305fc630867368b0251ca", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333216, "uuid": "b07c099c-0bca-49c8-bc8d-b2a8156dbbbc", "value": "T1A5B42393EF94E9627FB188022767B7950DE7C590D5C2B900ECB8C22253C1B4EEB78B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333216, "uuid": "06fac4ba-e6d5-4d10-a585-1b4b319a284b", "value": "12288:lP6sPwSjyj0fKKFsoMABCtH5iMCZMYKJNu6NppiM4SIm:lisPpuj0f9FsoroIMCWNuV3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652333216, "uuid": "0fef8743-4e32-46cc-a99d-ee51ab60d70a", "value": 517293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652333216, "uuid": "185b9d1d-8fc6-4604-a0c2-131ec266375f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652333216, "uuid": "46974aa0-5c99-4edd-aabd-1faf36257a0b", "value": "DHL DOC 7465389.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903ad18f-d1c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652340700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340700, "uuid": "4c8493c3-fbad-453d-94c2-2f5f022f63a5", "comment": "Malware payload (Formbook)", "value": "4b3f9676a23f567af9124add417bf63a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340700, "uuid": "ef65c455-5a83-4f7e-917b-5c8c69a51a4a", "comment": "Malware payload (Formbook)", "value": "f6a2613affedbfd5199e4af2482bebc7efde53678d3fe091b36a82cd678e6259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340700, "uuid": "a068b57b-e084-4296-b966-88a8653e57c2", "comment": "Malware payload (Formbook)", "value": "3f07a6cf82ada14ee7e42de9bfcc5de8b5f72e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652340700, "uuid": "af309318-b6a8-4422-9448-c2bbe70d3dbb", "comment": "Malware payload (Formbook)", "value": "742a7b8fc27c02234f20f43a7d920e7554038e98f098252d2837046d34c57f02cae513029cc6478d8f89896087d0c140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340700, "uuid": "08ee655b-01dc-422c-aa8b-41200f7dd0a7", "value": "T1AF15E252C826952FE55789B0C6370DB611B7B87221B24472176C30EEDB2A10BEFE476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340700, "uuid": "1798b9bd-7cb5-4588-bda3-bc07934735cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652340700, "uuid": "a2f1dc89-3d21-40c7-9dfb-51a9db30e87e", "value": "12288:+aNeIq7Zae8k6bQP9Fl+XlXtBDO8wfjogw7iSn79A850ooI8y1YXbL7nA:VHq1P8kII9FOfeooy7HuoorLL3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652340700, "uuid": "c057017b-f027-4813-964d-96c1d70ab930", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false,