{ "Event": { "published": true, "date": "2022-10-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-10-28", "timestamp": 1667001781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "36a93511-ba6a-4a4b-aa2d-4c07ff2321b1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b330bdfa-56d2-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666969846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969846, "uuid": "e227f798-ee56-45cd-a498-5c7019d93925", "comment": "Malware payload (RedLineStealer)", "value": "df522956fe65ac9ab68db0bf7f300ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969846, "uuid": "60651217-97fc-475d-91b0-fc6bd9d88f72", "comment": "Malware payload (RedLineStealer)", "value": "00563bbaaff83385e72e4eb4e4cc18636cb248b4c89bdcb662e85104789bd886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969846, "uuid": "de6105bb-0c9c-484d-a2ad-71275e8241a2", "comment": "Malware payload (RedLineStealer)", "value": "225a915812c0fbf62d6381df54e7abb6e1c760bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969846, "uuid": "eea534ab-0983-4550-8b9b-a282e26410b3", "comment": "Malware payload (RedLineStealer)", "value": "f212635c506380dafcef9336d32398191c0c989a9ca03f1b6cc37f6b6058cf0ea53532c6f807757755f8bb346768dc29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969846, "uuid": "1e7ca8a6-9196-4979-8b9a-6c0ab233693b", "value": "T16844CF317693C4F1F4852170442ACFA16AFEB8311AA04A47F7A4275EAEB13D1967E31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969846, "uuid": "0e765b6b-449d-4e4c-9eb4-9464ea0e1baa", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969846, "uuid": "14e25fe2-8ac6-44f6-8339-cfba70f61035", "value": "3072:UXOZHgELwQAg0fDGomj5t5bc3Djjl6iPncVkjko7eJ6jfOxhIhmmOrmVM/h3m:QSHBLwnfKoEczjJckt7eETGimdyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666969846, "uuid": "05633c22-9a9c-4ff9-9c64-1bb77741dae6", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666969846, "uuid": "82a47a86-de0b-4757-9e63-4d72ef32c661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969846, "uuid": "057008f6-61f5-433e-9c92-8abb26b067ec", "value": "df522956fe65ac9ab68db0bf7f300ab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e794790b-56ed-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666981531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981531, "uuid": "5e827e74-d461-4507-aa2d-cd7691131fc6", "comment": "Malware payload (RedLineStealer)", "value": "f8defac3203ce8ddf5ccc0476dccc3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981531, "uuid": "0244da01-339f-4c70-9482-1709bb379a61", "comment": "Malware payload (RedLineStealer)", "value": "00aebdf97b2a0b1950b26118271d0cc23cc673752c1bf80d02877a844c00049d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981531, "uuid": "30a14322-9e6c-4a83-b12f-c9ee7257476c", "comment": "Malware payload (RedLineStealer)", "value": "d60bdafe5d21e74f2f3a7758171cefd762a62bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981531, "uuid": "66839a6e-4265-4146-91fc-4b5b8961c397", "comment": "Malware payload (RedLineStealer)", "value": "46f246b7ab2ea11fce69f3090ba991829ddef287be643f5ac552f61a05afafcf4b374ba618663c6b9664b57a7ccf3073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981531, "uuid": "1aa08f11-8697-4dda-b257-0538bb6a9513", "value": "T14744CFF17692C472F08621308426CFA05ABEBC312A684A477794276EAFB43D1957733F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981531, "uuid": "bc7ba978-71ef-4cf4-8d85-70b8a1dbbf81", "value": "c77dd599a098ccbfc3230384663cf2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981531, "uuid": "b92b5df2-29c7-4ecf-97bf-386414e95abf", "value": "3072:HXOhB7PZTFPLBXyzpI7n5BInx4i3/TV1CQE93hexA0ysuW7txt58QA8tZ5M/h3R:3s7PFFPL8IN0/TnTbuGCQv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666981531, "uuid": "d831c53a-9a45-45b0-a9f4-8235c43ede7c", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666981531, "uuid": "9ce86401-ddca-45ac-90ad-331e41035646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981531, "uuid": "b3ea0e64-11a8-4eb0-95fa-649f9409dd0e", "value": "f8defac3203ce8ddf5ccc0476dccc3f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06777960-56b8-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666958390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958390, "uuid": "ffccbd9a-b121-4b8a-8e32-4fdca5c41592", "comment": "Malware payload (CoinMiner)", "value": "73d88fb71b0e41fe4d8f9c7bc3bfe367", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958390, "uuid": "23e664ac-7097-47ab-baa6-5fa365f03b9a", "comment": "Malware payload (CoinMiner)", "value": "00bcc5052d156daf42ba3e51bbbc4ac642b24395b6b2a26fe0a95ecacf64aa64", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958390, "uuid": "e7308ccd-9d57-49b4-b80d-410ed53ebe97", "comment": "Malware payload (CoinMiner)", "value": "f274d78c60f8e16bacb6a54046bf4dd04cce3398", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958390, "uuid": "c2f4f786-86b0-41de-ba3d-f399b475756a", "comment": "Malware payload (CoinMiner)", "value": "41ae760c24af25b5152022164d8edcb679c1c5c93b09dcb5880f9d8a85511111fd91c1390e56392418bc1cfa5c239663", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958390, "uuid": "68d9cbca-00c4-4fa7-b019-4d5463d0b9ed", "value": "T17C44D03176A2C4B1C48E22344029DFA1297FBC311A718A7737A4276EAFB17D15E6631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958390, "uuid": "76d68fff-63d6-4ac5-8d48-62d993d26b61", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958390, "uuid": "c49de73b-c04f-4b1d-9c5a-8087786273d1", "value": "3072:x7XOzHJKL53YAgD7dGqDN4D5LnLX5pWhfKhmnExUlzQcHXS3M5c5yuwM/h3E:xTsHIL53o7EqDN6IygE2Qc3S85c5ylT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958390, "uuid": "45ef3ccc-11eb-4f66-9ebc-835ba32c5933", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958390, "uuid": "4b0aeeaa-5b6d-4c2d-b31d-86e414665c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958390, "uuid": "b04b1c58-e705-437d-8962-816038d2219b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfa5a22-5699-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666945274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945274, "uuid": "b6d3b263-d48c-4e83-afaf-bfeab1e9b095", "comment": "Malware payload", "value": "da1e5b337d9076933073f2c0bc8ac64b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945274, "uuid": "c490fb48-ef99-4f3a-8362-121cefc43be4", "comment": "Malware payload", "value": "011dd6214e00e8bc0dcc578446668fdbfca370bc8daa41de49d41f90ff806273", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945274, "uuid": "90398b30-ff45-4605-ac2d-44f7bee5a925", "comment": "Malware payload", "value": "cfac42c3592a75a824fd2755003e4d09e1cc61f9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945274, "uuid": "b48d9a19-1ec5-4f1c-836b-f76b5c1356df", "comment": "Malware payload", "value": "0dabd50b317e26cf06c405cb4f5a199f49653da7c8510cf6d98ad26465bdc2f4a718c62a1716c4277b04c5968cce4af9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945274, "uuid": "78755328-7806-4b2e-b051-63df63949572", "value": "T109853344FE045B97C76C4534920B893CA7A3BE5D530EC8F23AFD3A963639BB1158760A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945274, "uuid": "55d291dd-ed84-496e-850d-070b96f5410f", "value": "24576:2pG9kpKsw01Dnuxi6DUtqf1++yV5QCde3NmzeLMu/lUHGguNaUgjg+NkTgThiNkx:6G9OKsNhlef1JLCdOAy1Kmg6RsOEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945274, "uuid": "36f36aed-f7c5-451d-b619-e187d853360f", "value": 1726976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945274, "uuid": "0bd4cdcb-d10d-4e09-b627-be200d7d66d2", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945274, "uuid": "27bd6e5b-fd28-4563-954a-30df8c851c37", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.6676.20973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccd7d3b-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666971070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971070, "uuid": "a7742aab-4c6b-409d-8cf3-08688c207e40", "comment": "Malware payload (GCleaner)", "value": "f4f36c10d736ae9ec5fbbc88fa54396c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971070, "uuid": "0bea72ed-f51a-4722-923e-84a69dfea622", "comment": "Malware payload (GCleaner)", "value": "013c19bccd1f56362bc2ae521d50f97c1f8d31fa790dd56e309842d1f1fac13f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971070, "uuid": "f75c4948-3421-4b27-bb8b-f4c327035646", "comment": "Malware payload (GCleaner)", "value": "67ce5b0848f757a698f5d9ccd966ba0886d5a9f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971070, "uuid": "b0a17421-44ee-4608-9c4d-e672a9005b18", "comment": "Malware payload (GCleaner)", "value": "618eabc3a22292295e8bf6b39dff294984c85d51342f84b0039fa802a9e656051ee35947e261ebf5b54e3a9d61777837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971070, "uuid": "2eb9f022-fbcc-478f-8f5b-eba8d8fc0c52", "value": "T1ABC533688AE18BB3E9D1CAB48F6F6560477B361762ADC98533DCD2EC4F722D68D14310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971070, "uuid": "3dea4837-65f0-4566-960d-6cd32fd7e8db", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971070, "uuid": "c316357b-3c29-4fb1-a661-630fbd743d4a", "value": "49152:Z2ik7FmAjdUiAYcKWnYhwpAg+Jt8lQ5Ricqp46rA5hq:MlxmAjdUiAMCYzJ95RiH46cDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666971070, "uuid": "f274f288-1632-4232-81b3-321a48af0171", "value": 2594133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666971070, "uuid": "be1eab69-76ad-48ed-ab8f-7f8db04d6882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971070, "uuid": "3dfc7946-fe23-44bb-9714-275aa5831d31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2af5913-56ec-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666981066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981066, "uuid": "167196c5-f517-4c32-b639-d7450ba00dce", "comment": "Malware payload", "value": "894fecff0debb35017b846b249e30bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981066, "uuid": "f00954c3-597e-4626-b7e7-1f599c702609", "comment": "Malware payload", "value": "01402a21670aff5459a82853d36167e0226dec7fac8f1ccc5cb94ac2fe421957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981066, "uuid": "57e79e97-d8e1-459c-bf8b-4488a4b4beb0", "comment": "Malware payload", "value": "b882201e88e5caa040165c17a7f8bb92e2a42ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981066, "uuid": "bbca3281-d6ad-4f04-99d4-31e33ae75e61", "comment": "Malware payload", "value": "cdc8e6881fa40c43bd5671eb0dfcbdbd3b3424201e9be471c5d0b0faab62566a1357d1b5de9fe5044a6f6b54ed74e5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981066, "uuid": "aaa0540b-7c23-4628-8d2f-5dbe13024c0d", "value": "T1E014126266F09427EA978972077AB3BEF27FF714182088DF1B607FB50D36267990504B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981066, "uuid": "43e84aee-94d3-44e6-a5d0-9db106b9d0b4", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981066, "uuid": "777e6d24-330d-42fe-a254-74f6574b78c4", "value": "6144:RDSoIKJU3p8FQF4tVvhPuXaWL1kOitZs2:PJUZf4tVsqDtZs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666981066, "uuid": "b75eda55-71fe-407e-8dd0-da34716b1ed7", "value": 204032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666981066, "uuid": "dedb7daf-2fd6-49b3-b890-a200d8450ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981066, "uuid": "a2329ff9-bc50-4c44-8a96-e1973f94ee8d", "value": "0500_20191029131605_001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa09e98-5712-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666997113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997113, "uuid": "9273e43a-422a-4af6-8712-ca2bc5897fb8", "comment": "Malware payload", "value": "f8c4917cf2bb84202bbf26bba421f119", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997113, "uuid": "37f4c073-6bd7-4fe6-85a9-9e7e8cbf3199", "comment": "Malware payload", "value": "02003a4dcbeae31cee14ee3096aa1fee5064c892cc41663cff501d31d791004b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997113, "uuid": "174bcc17-65e3-4303-bab5-eab42d59dc2a", "comment": "Malware payload", "value": "afdc15c60d45c5f9164a5fd645864259f3d92fbe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997113, "uuid": "5db43609-d532-4b13-86dd-0298ad764299", "comment": "Malware payload", "value": "887bbff4b8cb83fc7ec5528cc1e7fedc7925d737d244f260b2a3dc32aaafb9e00b3c841c871ec93b6e8dcb5840a236df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997113, "uuid": "8a473d80-fb57-4e5e-8ceb-4e346436620c", "value": "T130868C07A640493AE8DD973919BF93203B3059859B43D3131112EABF7C726D9AFE918F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997113, "uuid": "7f3f3943-e998-4db6-93a1-130d6b497423", "value": "98304:OCXXioVHuf61QXLHjUQw7AzbqNZmK62V6GXtnMfnsSf:hDuf61QXLHj7w7AzbyhtMP5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666997113, "uuid": "6aff7cf1-db48-481a-aa8c-4b5fc2ea093e", "value": 8453324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666997113, "uuid": "911b71fa-90d8-4473-a6a2-2b4f02ec589c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997113, "uuid": "5f89f4bc-5b76-415a-96b5-d734f9e695ff", "value": "02003a4dcbeae31cee14ee3096aa1fee5064c892cc41663cff501d31d791004b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51636a49-56a6-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666950784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950784, "uuid": "288ef8dd-b62d-4f20-8622-f56a01029e02", "comment": "Malware payload (AgentTesla)", "value": "bb45525cc4714a9a04da7be048c9aa19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950784, "uuid": "8522ed2f-a4e9-49bb-b54e-f1f922eff42e", "comment": "Malware payload (AgentTesla)", "value": "02b20ab77ead537c36aa32229805c78c30491f397d8473bd427bda7f77739a97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950784, "uuid": "67fe1d6d-11e7-4d7a-ad62-5bca8f50a76d", "comment": "Malware payload (AgentTesla)", "value": "fb0b0bbbdc3d862f0668c188d6b1addc65c3f361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950784, "uuid": "35c26326-ce3f-403b-93e2-60accaad6058", "comment": "Malware payload (AgentTesla)", "value": "865fee99deef21b911c34819cd2d68b6bc31e2bd6f7e5d804ca6b0706475c808630bcf34284210acd1de4e6474962b3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950784, "uuid": "413730a3-06fb-4aee-b857-a4124fae3a93", "value": "T1EBC42350FA37F233C5AF23749CAD03C4677289A4B3E1CA2169CE765218F7D9F104A966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950784, "uuid": "d847d4b6-2c03-441f-868d-1ce5268ea663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950784, "uuid": "f93b71a4-af7c-4986-b8ab-d2a7d38561af", "value": "12288:hh7b8dt3ptRzP51nx4Y8rPjBaOrsuJofu3pEVVUOWlcOhR+Md8EyL:Hqvt1x497jBaOXIaSpYaQ8EyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666950784, "uuid": "3c1c99e6-2f72-4070-8a16-c774f0e14efd", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666950784, "uuid": "f761da67-3862-422e-aa76-f011476bf935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950784, "uuid": "3bd7948e-ea92-49ab-9584-1896d2415221", "value": "Remittance slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5ea4db-56f6-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666985245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666985245, "uuid": "e7ef150a-e434-4310-a789-646ab524d234", "comment": "Malware payload (CoinMiner)", "value": "ef7e4a69cb1f773ee7b5ac597f06418a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666985245, "uuid": "891ecc5b-e221-4c4a-80e4-4b2c01aa2cbc", "comment": "Malware payload (CoinMiner)", "value": "02b4c3dcc4673e8e5b5209e2cbad26584be30b40b082d0bf906ae4d60e9487a2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666985245, "uuid": "ca55cedf-68d9-4e1c-93b6-a8cf03322c0a", "comment": "Malware payload (CoinMiner)", "value": "7c09ac3d21a7e7866f8a74c6e39f496a75e005ee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666985245, "uuid": "fe579360-4b79-4ca3-8792-232c1d5ed82c", "comment": "Malware payload (CoinMiner)", "value": "ad30191036c7400459c4e1004632442075f6bdccdd3634331ce8e1b39e31009314aac2e3056d223c76da3f264a904141", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666985245, "uuid": "a5556a0c-53fe-4a36-a2da-cf20de637d96", "value": "T17944BF3039D0C432F79655304835CFA0EA7DFC229969864376A43B5AAE733F1676621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666985245, "uuid": "dd628194-568c-434d-82bd-4944557a40cc", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666985245, "uuid": "38fb6902-9de2-426c-a3f4-ef0d0f75cb10", "value": "3072:LuJFB8IkKLXHxuvz5q3jzQctU7cw0e7hwiXJl8T4DKFbJOxjw0L9l5M/h3:+FBFTLXx9zQctze7yiX4kMOxjw0xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666985245, "uuid": "aba952ea-2f25-4294-a9e7-3087685851dd", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666985245, "uuid": "f2bf856d-5be8-4081-a35f-fb988e4c8120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666985245, "uuid": "b28ebe4d-e7c8-40b8-bbed-eb016cf4885f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50fed76-569f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666947945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947945, "uuid": "b09d42ba-f3fe-4070-a46b-67afe1b60cd6", "comment": "Malware payload (ArkeiStealer)", "value": "d7106b9afd942b624b01cec40dae5482", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947945, "uuid": "7a66737a-6f6a-4cce-be86-529f8e9c7b0c", "comment": "Malware payload (ArkeiStealer)", "value": "02f44f1826304f79afc04b8e3271530d799d8d805ea0501620152d7a1c70a502", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947945, "uuid": "4c5560f5-5c1c-457d-8f6a-60c181581138", "comment": "Malware payload (ArkeiStealer)", "value": "a2dad0ac29cbfebe08cf4c597b77a9d3660ede41", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947945, "uuid": "8abdccfa-bd0a-4466-8fcf-78a49b0c922f", "comment": "Malware payload (ArkeiStealer)", "value": "56079f550858315ddde85c9b19f0d930b65e7b8aaef2a5271a702d49728378a61c40faf3af90034683c491858228e3f3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947945, "uuid": "4f56652c-fe4b-495d-81b3-4704a64117fe", "value": "T15174F1317951C4B1C4462035882ADFF01ABEBC311A658A4B37A4276EEFB03D1A6B775F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947945, "uuid": "06d785a2-f7c7-43fe-9478-641c1b2384a2", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947945, "uuid": "f021df37-3c1b-4038-8059-b686779e2461", "value": "6144:6+NrHSL2qd5LXdVxj5+CXiJbLngnx0TEHG+AcmJ:6+NrHSSs5Ddv4ZbhTEHWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666947945, "uuid": "35a2f550-b32a-40e6-9e39-c9966bd27a08", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666947945, "uuid": "80d0e64a-0987-432d-98bb-92977661032d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947945, "uuid": "fd872037-4581-44c5-accb-21b8c61fde14", "value": "d7106b9afd942b624b01cec40dae5482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd17eb0e-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943717, "uuid": "372c6b32-e256-4df6-99c0-9d582e345b21", "comment": "Malware payload (RedLineStealer)", "value": "a5cc58a5680ce0a935c0e8dde8b0e95b", "object_relation": "md5", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943717, "uuid": "572eaac8-6c1d-405a-b2a8-61a73087fc5e", "comment": "Malware payload (RedLineStealer)", "value": "039c7deb147774e9f48a601c75c9345b23b435058cbe5ced19a79990a3796885", "object_relation": "sha256", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943717, "uuid": "db1d7cd8-a0ed-4346-ad9e-e475a4a4c907", "comment": "Malware payload (RedLineStealer)", "value": "f3e4be68f4412b358b95eb41fe0b823c2ecbd6df", "object_relation": "sha1", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943717, "uuid": "a84ece09-b2c7-48e5-84c9-b90442339982", "comment": "Malware payload (RedLineStealer)", "value": "7388113c0cc5c3fa027b2efe0f6ea3a7e2de71248a51825b271761db864e84e885965f6f6b3a8956b25b2f3dc73432ee", "object_relation": "sha3-384", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943717, "uuid": "9b1eaab5-a676-432f-8179-3b0e7b81a988", "value": "T14ED5DE25F4523271E80DC9F404F01EA403E16D75226B63C82376756FA6B7FBE8A68D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943717, "uuid": "f9ed200c-7197-4a58-ac56-5cc1c54036cc", "value": "49152:+Lr3iQ1IlvarS3w1TIPpxStLBFen7PYBuxCxweui:orIlyIesPU7enzPdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943717, "uuid": "0dfe1ced-b080-4592-8374-e6d0aadbc888", "value": 2945767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943717, "uuid": "36949071-034b-4dbd-b0f4-70c43bd1a942", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943717, "uuid": "eb6dba77-f57e-49da-9912-f59368dd4bd0", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96dd014-5691-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666941993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941993, "uuid": "f14c6ed4-7a61-4bcb-bce9-3d6470c474ec", "comment": "Malware payload (AgentTesla)", "value": "8d588fa79c055c2405afe56e44a3aaf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941993, "uuid": "5242e868-56d0-41ce-b1ac-d57024cacdf4", "comment": "Malware payload (AgentTesla)", "value": "039f939f9f2d80d8d2af167236920a2f1a5edac1bc99bb168846d9abd55174f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941993, "uuid": "cac38370-e8fa-4f85-890a-99bed808cfe3", "comment": "Malware payload (AgentTesla)", "value": "5f88bc0ad6da9b1bbc4af6e5ea38254321f2c5ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941993, "uuid": "c97cd80b-92f2-45dd-8d5d-69f67f2c3f68", "comment": "Malware payload (AgentTesla)", "value": "e4b70051d3cb79928632ad937ae1914b96a3f97f9713965e9904db4f6aed95ecc843e83bf6265d21889432f0ea11f054", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941993, "uuid": "4bbbf859-7869-4d9d-b305-f3b9ca3f2a71", "value": "T1AD42BFF13272E0612591F3B086DC53339239F0FD9DBA23589CAD452E46B642664B9BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941993, "uuid": "73f0b5e8-0f29-40cd-92d7-657f3d43ef6b", "value": "192:IG0szrHw5tuemUidzyfSeBxjhX59viAMaxaKq1T3PHXZPd4FFtFQfYFcQeAKbK2b:R0CrHwtbviRyfSAHqRRd4FFbiScQ6HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941993, "uuid": "b208e954-ff57-4f00-a0d3-a5a33d458b79", "value": 12360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941993, "uuid": "ea6c32db-3cf9-4114-89cf-2b71b6ab41aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941993, "uuid": "630e367a-ab2f-4773-9634-e6d54ff09737", "value": "Ordine di acquisto inviato per approvazione PO-00091 27102022.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94d9daf-56c5-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666964380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964380, "uuid": "281ffc30-e0fb-4c6c-900e-faa47f1df775", "comment": "Malware payload (RedLineStealer)", "value": "68ca19658ecb91bc74bbac7be58d8ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964380, "uuid": "9641f1c3-ae8b-4d03-a888-477981b4a0fc", "comment": "Malware payload (RedLineStealer)", "value": "0509f900a6cba4c85fc365e5c3282641e3154f1e4d0a477fc46635a7506bffa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964380, "uuid": "cdcc6a2d-1a8f-4442-b7bb-7a853e72591b", "comment": "Malware payload (RedLineStealer)", "value": "e6faaed399449cac362c09a2ebd9ad7c6dd69a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964380, "uuid": "f8078647-0e14-4d18-b220-58539889d678", "comment": "Malware payload (RedLineStealer)", "value": "29059ba4a1ed13622b42813992980d43e74b548ec8e7cf49e899f2bb875c7c6a78874e098d8b5c4048ce3e6a24c540ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964380, "uuid": "f0f65305-fba3-4320-87ef-5d21957767c2", "value": "T153C5B03AE70614B5D76352B1C29EFE7BDB18B63480229E3FFF46E90CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964380, "uuid": "2d59a8a2-af89-4308-90c6-ea3fd807b218", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964380, "uuid": "4756fa8d-e748-4821-acc0-224bcdafe438", "value": "49152:tK9a5UKl7dQ6WlyuC9CTHf42rT6EDbd2+Rbr0EPkdqtNAhg9:tK9a5UKlZQ6WlvC9EnHdoiEEBtNAC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666964380, "uuid": "f613c397-5214-4b5b-a3a2-8068da229b83", "value": 2525184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666964380, "uuid": "51aff953-2bf7-47f6-a028-24193c03f409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964380, "uuid": "53e7d8c9-e2d9-407d-9d34-e54485e3ed98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de488b1-5679-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666931424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931424, "uuid": "d34eb6f9-4b70-4d7b-b97d-3fb663735fd6", "comment": "Malware payload (GCleaner)", "value": "074c160899dc52e6e2611a1e2358cfd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931424, "uuid": "f8c1fed0-33ee-47b6-9a41-da968418c912", "comment": "Malware payload (GCleaner)", "value": "052cc22dd058135b129d177f1b8935ff40935b727c235c269b080288f4aa3310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931424, "uuid": "ce72e8b5-62fc-4ccf-8b54-3d538ef9e268", "comment": "Malware payload (GCleaner)", "value": "907c47cd69edae7b6c4300cd830eebae51a69e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931424, "uuid": "cd855696-558f-48a1-a539-16b61142991b", "comment": "Malware payload (GCleaner)", "value": "388246e59e7a5e64c6e082c4019439005ba5b33783200ffbdb2fab06855e5eb774f39094b226fefe3890ebf53bbbfaa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931424, "uuid": "7ffed2bb-f4b9-4d3e-a319-308493f4966c", "value": "T1E2C533229EA9DE72D052B5F58C97BCF28F723A9518B40C28F58CD84E1F96380D85C7B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931424, "uuid": "0cf873bb-1434-4f03-b5d4-0b3154b328cd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931424, "uuid": "a2523311-d4cc-4197-a96c-817fc4d758ac", "value": "49152:Z26a+bn72DIIM4tseNcfEoLNb3Nns7kIN93xhr4YtdiLCcKA5hq:Mk/2DhtefRLNxXCxhr4YuCaDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666931424, "uuid": "536be2d5-a16c-4088-a443-e8b1c0c6fa03", "value": 2630154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666931424, "uuid": "b1e69a61-1c43-44be-a5ca-99b99f8d276e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931424, "uuid": "b1f8dd60-5317-4add-bd3f-ab9adf6fc012", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65914897-565c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666919035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919035, "uuid": "d6e4d808-730a-4f11-89bc-a0665e15a5e9", "comment": "Malware payload (RedLineStealer)", "value": "7b4b27b80bca9601c2bffa2c8e358a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919035, "uuid": "644415c0-6c5c-4bb0-91f5-8fd00e855bf9", "comment": "Malware payload (RedLineStealer)", "value": "06b59b05e97f01426a9f21f91a9e30d6c034583034748b30f37a68769f537798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919035, "uuid": "26f8af6e-13d8-4240-bd6e-a0362a52a8db", "comment": "Malware payload (RedLineStealer)", "value": "dc6217600c3435dd040d18eb63ac1d47275c49af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919035, "uuid": "2e9c8936-f76c-4668-ae7c-844b4db503be", "comment": "Malware payload (RedLineStealer)", "value": "f3863d5f3743e128c4888029eb1fb39e52697c171f2de33916ea063161cf9206ebb2d3d85cc6ad4edf801ca96ecdfbef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919035, "uuid": "f64c6ab5-4617-4fab-a5dd-6e890374a95e", "value": "T13DB5B036E70614B4D76352B1C29EFE7BDB58B6348021AE3FFF46DA0CA4734126C89256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919035, "uuid": "3f4d4ed3-a80e-462c-877e-9794ae49bf3c", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919035, "uuid": "db3cea3b-4012-4d0d-958c-8577329b4fb4", "value": "49152:McyZRi/S6AJ9fcSPiVCT2QoQ59Ok+AcO1h0Rq/lyMY:McyZRi/S6AJ9fcGiVELE5AcO1P/lvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666919035, "uuid": "12d76cf8-3957-44fe-a92e-d4e50faa2fc0", "value": 2468864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666919035, "uuid": "c52d378a-f369-4380-89c6-ed72a1138c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919035, "uuid": "4945473e-1ef9-4d96-9685-fec3c1c6671d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b843af0d-56d9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666972861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972861, "uuid": "d250eb7c-3445-4142-a6f9-4a88e3c04c14", "comment": "Malware payload (RedLineStealer)", "value": "43ee7212f333ebaf5387b4a88b33f38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972861, "uuid": "b8828fbc-3ff4-41a2-9ded-4235c6ba3794", "comment": "Malware payload (RedLineStealer)", "value": "07c6514e6b5ec6e2b9777aa411aed5a162d3395cf6f8ea52a27985d0c55fe864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972861, "uuid": "5e6f29cd-a8ae-4c10-9655-2493ebe14f92", "comment": "Malware payload (RedLineStealer)", "value": "cacfd08e2f275e2f9d352c977134771d25979bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972861, "uuid": "2c8a8d1c-bed6-4c2e-82b3-69f5f010c87b", "comment": "Malware payload (RedLineStealer)", "value": "90aa47ab6ba15231dbca64aad95cef8053c697551fcdb2726946ab452a2dc24ae59a1aacc5a9ecb8d0ea15d567a0f435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972861, "uuid": "04f71cae-7a9a-400b-9ea2-94b3de6b6d05", "value": "T1848401327592C0B2C4556130482ADFB129BFF83216B5894777A437AEAB723D076B631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972861, "uuid": "21a3203e-66d4-43bc-9c49-5422a3d53892", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972861, "uuid": "3d62ddf8-9db7-48c5-b7e0-d7854c62df6b", "value": "6144:+vHILtpU64ebKnB1IDwy+/+OaJuWshYd5RmF1sPvYLdsQcBpi:+vHILUN9B1IcBlaJunhQ/m/snYLdQBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666972861, "uuid": "30263682-c762-4c19-8479-049efd8b84ad", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666972861, "uuid": "f7bb4fe7-cde3-45c4-8f9e-3cc5bf62f215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972861, "uuid": "43e66a05-1885-4122-9a92-4ea4fa79a16d", "value": "43ee7212f333ebaf5387b4a88b33f38c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710f7cff-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666958998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958998, "uuid": "6de0ff9f-6be4-42cc-ab2b-7d59f421ddae", "comment": "Malware payload (GootLoader)", "value": "d1ea508106087303c79481fc526a43d2", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958998, "uuid": "e0fe7127-ef1d-4021-9925-2d0e28f800e6", "comment": "Malware payload (GootLoader)", "value": "07dea834065de36c1496c0133c6ded268892974798fbd2f58928b1c73f2ece8a", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958998, "uuid": "d452f8da-d31f-4424-8685-393387d4b1c0", "comment": "Malware payload (GootLoader)", "value": "1defec5604412b30acc2677d00156799847a967b", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958998, "uuid": "5720950d-3f93-4c87-8a57-d529f81efff5", "comment": "Malware payload (GootLoader)", "value": "d85168682a7140002250f537f56e1949dad07fb9f7f311ab2aa73bea6e22e1272598c00d46e7fc29de197602e874d413", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958998, "uuid": "5bf1f767-c918-4620-a2a0-f74ad83f8f48", "value": "T165A2D17A7721C5A0CF389C5D4D7F80C8B251EB011ADD394EA8B62F90B94A1D31A358AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958998, "uuid": "ded8402e-2a8d-445d-bd77-1f31974736a2", "value": "384:BxQLy926xXO1gD3SAHtB0GhObDCR9rcalTYNWqCAa0DPZZ1iR8H3FhaFrj:J2e3SANBNmgjTil5a0zZZ1iR81U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958998, "uuid": "b75b3036-d1a7-4ef8-a33b-8293836afb55", "value": 22249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958998, "uuid": "0de32988-7a85-41f3-b66a-8a73068c61a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958998, "uuid": "b89e85d4-9b8c-4680-b078-26888b34b12d", "value": "Which sentence has proper subject-verb agreement (43684).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff66a1bb-56f2-11ed-9266-42010a9c0072", "comment": "Malware payload (CMSBrute)", "timestamp": 1666983718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983718, "uuid": "4ff2e40a-b2be-45a2-b037-c6f72d13f202", "comment": "Malware payload (CMSBrute)", "value": "0b559ca054356534e07322d4cd00a351", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983718, "uuid": "d694cca9-0d59-412b-9db6-02785a1f8b7d", "comment": "Malware payload (CMSBrute)", "value": "08089429ee4231d39dd0f2c970dca60e09a72e6c003f480f2dad76b032fdc1cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983718, "uuid": "ed94e44d-8075-4d54-abd3-b08359d88acd", "comment": "Malware payload (CMSBrute)", "value": "e5be9a86c3da0a25a15bad5b06390cae4f71610a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983718, "uuid": "1bd7e1fa-709d-4c37-adb5-39b4f6761546", "comment": "Malware payload (CMSBrute)", "value": "a74966b929353d8980ebe2cc0d751ac245c24082fec75b32fc74abe8f890124102b0f36f9c00c23e0d610e304cf8361b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983718, "uuid": "dc227265-a92a-4a25-b590-6890f831ca62", "value": "T1429523317881C875F5ADD331D42EDFE112BDA831A6611AAB337801ADAE323C5616E35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983718, "uuid": "679977c7-1b5e-4194-9e10-240178405f82", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983718, "uuid": "7f185974-2cdf-457f-8e05-3af915b62be8", "value": "49152:POwglWgEBHGKCSbMCAvxDM82UCYaLb+NLytJD8W4EfzaFb:POTlWHtAvO82U0LKNeEuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983718, "uuid": "48bda01c-5c39-4f14-8c69-29d971cfdfe2", "value": 1980928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983718, "uuid": "122c7945-60c4-4da7-8801-c39836a9b281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983718, "uuid": "0fa53c95-edc0-4115-9a50-bd50df87d20a", "value": "0b559ca054356534e07322d4cd00a351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b68aaf-5695-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943599, "uuid": "93061b41-fb25-41ae-8919-424c1996d899", "comment": "Malware payload", "value": "7d67c2cf1fe784c6db205dc85ae3acb2", "object_relation": "md5", "Tag": [ { "name": "soft-free-space", "colour": "#A4EF93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943599, "uuid": "2105dcbb-3499-4c7c-9dda-319c6d9d5bca", "comment": "Malware payload", "value": "0819fa0d5a479b366b9a9c5bdacea003d1294f6be6b21df12e561a0b42a6048e", "object_relation": "sha256", "Tag": [ { "name": "soft-free-space", "colour": "#A4EF93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943599, "uuid": "0546b56d-33e5-441b-ac75-6ec8f0ceec22", "comment": "Malware payload", "value": "b937e01a034ae7404addf9b1b3810d13aba00cbc", "object_relation": "sha1", "Tag": [ { "name": "soft-free-space", "colour": "#A4EF93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943599, "uuid": "59c844bd-34aa-4419-a5e7-6db5a988893a", "comment": "Malware payload", "value": "1bfc93668c4a41701f55abbc37a59f387d691b36a53ae00a522f4fd83b3986d51d1e9bf8d3b2e22ff3b19a43ac2a3d31", "object_relation": "sha3-384", "Tag": [ { "name": "soft-free-space", "colour": "#A4EF93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943599, "uuid": "a5cb2e87-1dff-4438-abfe-6044ab9380dc", "value": "T15A7611AC78B5B91BF9D4437BC6852CB6DB2CA440E7DD3D9B8E2041167C8310F6F6A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943599, "uuid": "08cea5e3-b849-479d-baf7-6fd8d639a8b4", "value": "196608:ETKfmNMZTXXa8lS766N7wQipU9n0hv9tblqLRnVTM:HfmNMZW7766NIOeFtcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943599, "uuid": "b7f7aa6d-b5f2-4faa-89a5-ba6bc42c96b8", "value": 7256560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943599, "uuid": "3957ee36-6f0b-4bf3-91ff-8d671de3db82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943599, "uuid": "3a4f97d6-7108-4ee3-8ca9-7ace9b916d90", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078d8890-56fb-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666987168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987168, "uuid": "849fce9d-ffb9-4dec-9758-13b3d84f7d5d", "comment": "Malware payload (CoinMiner)", "value": "a756a6650ea8fa4b3a92dfabd26ce9d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987168, "uuid": "15cf828b-b84f-454d-b789-bf46fc6a0faf", "comment": "Malware payload (CoinMiner)", "value": "08aa65bd118615baed512fdea22688a967be711b1d73941dec02b7d870234766", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987168, "uuid": "a0e4f126-234c-4773-a723-b5efc78e6a7b", "comment": "Malware payload (CoinMiner)", "value": "cc4a05e6c1aa9ee48e79643f39102a9a91f3e065", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987168, "uuid": "f3e86083-be1a-4afc-a8a8-c945c04607b6", "comment": "Malware payload (CoinMiner)", "value": "acf7edf9bad32d225a2d0433017ff3e04db03277736a38711d5211c59554d46902eb5f8fbd35710b77820ffb83868de6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987168, "uuid": "e14d9779-9922-46b9-abfe-87fa3a682c42", "value": "T18544AE3175D1C432C48665308925CFA1667EBC326B7D8A83F6943B6E7E3338166E621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987168, "uuid": "f430a929-6295-45ca-a4f1-978d029e7168", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987168, "uuid": "c290eca4-5e15-4af5-b70a-e0f60300b8ff", "value": "3072:3diTBBdZwLFYLvsz5RbpzM2Ug8iBYz5hRQKlINo+dcUOC3FM/h3:oTB7aLGLClo2zYz5PQi2/cUOC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666987168, "uuid": "95a6776a-9736-42d1-971b-7161dd3b9363", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666987168, "uuid": "c799376e-9940-460f-bb3e-5873b7c62d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987168, "uuid": "4a8c98d8-9978-4a38-a2f6-f9c4b74206ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fb3dc4-56fb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666987519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987519, "uuid": "3618ef36-9e60-4075-8ea0-dad3c9282ff3", "comment": "Malware payload (RedLineStealer)", "value": "724f79be37404cf56e1fa73cab6aa121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987519, "uuid": "75bd24d8-41a3-4b71-9eb8-05a7e6eeca4c", "comment": "Malware payload (RedLineStealer)", "value": "08bbf1d9d4392e56b7b6da72baba11512033cf6afccf265daf5f29efd969101d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987519, "uuid": "ebcdb8e6-7eb3-4c0f-928e-5b20b215fcff", "comment": "Malware payload (RedLineStealer)", "value": "a2fec90e1f1a46791462a4d6bd94e9768b685854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987519, "uuid": "ab4377e6-4fa2-433a-8799-8a0ad8045bba", "comment": "Malware payload (RedLineStealer)", "value": "e63e942d880084a6e8c522c1d21e069288ae1130b9cada10f8a5a35dff20e0abb6bd640951b4600bafa486eb20205b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987519, "uuid": "04a557db-205b-4aa0-823d-01460f903633", "value": "T1AB84F17179D0C033C48759304526CEA0A57EFC625AA94A4337D4376EBE723827AB636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987519, "uuid": "3a9b2629-c69e-46b4-98e8-c1b8ceb226bd", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987519, "uuid": "c1939575-187a-44c8-9c28-27f7f9250152", "value": "6144:twBVGL7cXK0vEzQxUqZjb1AXPURYJOwM6sqzl4SZgKq7500Pq:yBkvcX//UqZmURYAwsC2Stwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666987519, "uuid": "ac851891-86c5-455e-916c-028c22f422fe", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666987519, "uuid": "06ae6a5c-cdd5-4a20-92f4-302f7c89a55a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987519, "uuid": "b841722e-ac91-4e19-8e2c-e25b3c796d79", "value": "724f79be37404cf56e1fa73cab6aa121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081c9a14-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938635, "uuid": "0ea01542-0e6e-4328-9c4e-6127fb978956", "comment": "Malware payload (Amadey)", "value": "82897b115fb9ed32b9498d9ab2642cca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938635, "uuid": "59703077-f01a-4ba2-ac52-2582b4ec9c01", "comment": "Malware payload (Amadey)", "value": "0a431c74536788713335c814c5185d433a61ab2add7a1e6afa2c9adfcafdc268", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938635, "uuid": "9e18ae93-deb0-42e5-a548-3cbbf848f240", "comment": "Malware payload (Amadey)", "value": "cd47fe6f26eef6eefe08e22bbb7bb5cf9fb8f59e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938635, "uuid": "aafba7b3-f895-4504-94ea-9b5fa28b3b60", "comment": "Malware payload (Amadey)", "value": "f25454a2db099fc8954d94be0c19c5397bfb116a8d18aea88de05036054c22a6c91813831c5faf52d9b668e6fb401bd0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938635, "uuid": "2fd95098-1ff8-4309-b0c1-9c97a9356ba0", "value": "T15044BE327591F471C48D113C442ADFA3297EE8315960CA8377A43B6EAA71391AFB631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938635, "uuid": "a1d9a7ad-5543-42c3-88c6-d9f54e52efda", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938635, "uuid": "6c450ae9-a24c-4bc2-a758-66137a8d8d85", "value": "3072:kmPXORHDKLwMIzA8mtQGVfmlk5iw/et9LhRy8SRBEam8Ge46XHZLZM/h3gU7:Z/GH+LwM/tTVucM9LhnamzGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938635, "uuid": "beb4391a-b705-4ae8-9c5a-6411e6e9c5ce", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938635, "uuid": "e05172ef-d338-4608-802c-9ec37111c261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938635, "uuid": "54a97923-8a3f-4460-86fd-e7fce722befb", "value": "82897b115fb9ed32b9498d9ab2642cca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484b3faf-56fd-11ed-9266-42010a9c0072", "comment": "Malware payload (Heodo)", "timestamp": 1666988135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988135, "uuid": "e2cfb870-2ff3-4df3-84a7-8e3a43e492a8", "comment": "Malware payload (Heodo)", "value": "806530fc7a90c4f7f4bb0418187d93ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988135, "uuid": "26e9858a-224a-4a52-805c-9756d9847d57", "comment": "Malware payload (Heodo)", "value": "0a5cc2b92b228a835529cc7fa4fe679ebabedd3166e10b19c80c5f4d6795f4f1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988135, "uuid": "b3d84aa5-cd8e-4759-989f-8c18bc16cdf0", "comment": "Malware payload (Heodo)", "value": "15f0b43dcf176610f451650986ad042483034ebc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988135, "uuid": "4aaeef15-f6b8-4c52-996a-0a627f13deb0", "comment": "Malware payload (Heodo)", "value": "fbb9826d3e530254de7294cea01db5d4b69e68abec76edc7083d986dc1635aafd2bf4b89635ed296ba9d64791f796da4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988135, "uuid": "2ce6b7c0-52cb-4d28-b531-ea207351ec3a", "value": "T18C23CF5FE5AA6D57C2A6DF3C7F448CB8A70D268E958235D90894AF0E3F046631E4F02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988135, "uuid": "779122a3-c1cc-4bb1-94d3-1fe225ab2158", "value": "768:smBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:tBlntTEvDLmXi3JvG6YzATOJnXYSXRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988135, "uuid": "ba87914f-3bfd-467f-b11c-a222fdfcd98f", "value": 47738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988135, "uuid": "1a861954-ecbf-4051-b14d-d726a940127c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988135, "uuid": "fa4d8a3a-adc4-476c-a853-fd86ba19426b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1ca601-56a0-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666948175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948175, "uuid": "74e176f6-68ba-4045-8c14-657c1db840c7", "comment": "Malware payload (GootLoader)", "value": "f4c1322346d31e76611ee4f05b08b35a", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948175, "uuid": "0a74fb6c-188a-4294-8cb4-a40161b73663", "comment": "Malware payload (GootLoader)", "value": "0be17e799a41472188d560e75e50aca065e4d1816f1caf88803c3dcb730cdd02", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948175, "uuid": "ddb64bde-a847-45e9-ac36-4a76b8190abc", "comment": "Malware payload (GootLoader)", "value": "e179f0550026fbf705456149859f5800324e2e5c", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948175, "uuid": "11c4d7e2-cded-490e-8e8f-554d41841660", "comment": "Malware payload (GootLoader)", "value": "e27c2595a6550138aeafd790c8e3a0dec83523780e0772d22bc586551a0d88550425c8a0df17995d596a78316e5824da", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948175, "uuid": "f4791c37-a886-4a17-8379-8b816c78a9ee", "value": "T186A2F181B9FF9835022308E3E6940E7621D0BD7C0DFDD8682458B17C5F199084AAA6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948175, "uuid": "edd4adc4-3b8b-42f7-8385-6fac8fe05850", "value": "384:IWlnu0NQwXA7Albsi3sKY8aI5Ue+4eghAXHm4lqgfSf0R/OFLZIr:IWI85A7Al38K3HelXGyfea/Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948175, "uuid": "32265aa8-b606-42d2-8971-a025b17887a1", "value": 22259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948175, "uuid": "d5fc44e2-d77e-4ea2-a561-9cb33d0c8571", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948175, "uuid": "5eb285c4-d55d-491e-870c-4889b49b2e39", "value": "Which sentence has proper subject-verb agreement (13076).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe86a57e-5659-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666918004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918004, "uuid": "be30aa6e-83ef-4e70-a3c4-960ab4e98aa3", "comment": "Malware payload (RedLineStealer)", "value": "1b197c8c541b2a6f062e65ddfa1028b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918004, "uuid": "5bce3249-6379-45a5-8993-932521deca6b", "comment": "Malware payload (RedLineStealer)", "value": "0c08eda6ef81c438b1e505c170ddd9e3c8588101ee10d4b1a1c4d7f707d7b819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918004, "uuid": "84a78877-bf17-425a-9642-acdfe75d5c90", "comment": "Malware payload (RedLineStealer)", "value": "72d67e64405261dc1d214b7417b0aff20eda10a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918004, "uuid": "f9597ed2-5682-42c0-8ad5-fa1e6858b61e", "comment": "Malware payload (RedLineStealer)", "value": "c87bf39f307d7c73991e87138dd01696bf499d6853bb49ff716254832cc87ef2279b5f64f37613722e53713b9edab962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918004, "uuid": "265fe1f8-f18d-428f-bfad-5fe73e78d8f2", "value": "T133C5BF3AE70614B5D76352B1C29EFE7BDB18B63480229E3FFF46DA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918004, "uuid": "f230dc12-b4ce-4d37-b70a-fc0f30bb560c", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918004, "uuid": "37a36b5a-43d5-4155-8753-d96fc343ae91", "value": "49152:iKIRi/S6AJ9f8yuC+CTHg476CLqnVhHaQsvEcvVbh/Pp2imTJiOu:iKIRi/S6AJ9f8vC+EPqnPEvE+VbhnpQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666918004, "uuid": "a0ab5866-2d94-4222-9acc-662700139df7", "value": 2543616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666918004, "uuid": "056eb0b5-1a71-49ce-8df9-5077a1d25351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918004, "uuid": "0b810fa3-6858-4984-bbfa-376f010508d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e03b37f-570a-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666993675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993675, "uuid": "e839ae68-9ac2-4568-8948-2bc45273016c", "comment": "Malware payload (CoinMiner)", "value": "95428718873190850ff6102c6f669d7f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993675, "uuid": "8a27555e-d158-41eb-9658-4fd06c438151", "comment": "Malware payload (CoinMiner)", "value": "0c3db61f82c5ff9e965865ac484e3f324698b9af639634961bcbbab70e86246e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993675, "uuid": "8617490d-161e-40f4-a490-d5c3c02fb621", "comment": "Malware payload (CoinMiner)", "value": "bc6431ebeb347bc3c5a4259c60eac5bc66bfdb66", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993675, "uuid": "6226e930-e7de-429d-b4ef-35e89449f556", "comment": "Malware payload (CoinMiner)", "value": "2ae5c090248b862052683cc699370f954d25713c1ab870540aca50c95f74c2ec9b5c0e84a62205c704df656ec1d6066a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993675, "uuid": "bb2a6406-c8be-495b-9d54-6ef84ab74e27", "value": "T13A44BE3279D0C073C48615308865CFA16A7EFC325AA99A4377943F5ABE323C167B625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993675, "uuid": "6d122270-ac86-4676-979a-5474ce61f50f", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993675, "uuid": "755f40b7-9f0a-46ca-9815-6a0fdc634204", "value": "3072:YlJFB8IkKLXHxuvz5ZEXQbc+el95I53iz+vjiEiT34v4nr7rk8oQgEKM/h3:8FBFTLXxSZbe/EtvjiEij4c7ArQgEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666993675, "uuid": "aad46a6e-77ed-4e59-bdff-1737d0620737", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666993675, "uuid": "62c271f9-faaf-4bea-ad0e-96a9717ab2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993675, "uuid": "550b962a-c1e6-4754-b47f-6770d911be19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf2f736-5660-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666920818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920818, "uuid": "7f0c6a81-33cf-4032-a1e7-65a8da0c60ed", "comment": "Malware payload (GCleaner)", "value": "6a3507d53a56cab63079413b76ffd02f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920818, "uuid": "595845b0-eef0-4ea8-a9a4-c9b1b547e2d0", "comment": "Malware payload (GCleaner)", "value": "0c6975dea0de2b8b79362fb4587e66da89ec62c709249354bf5dde8c31f54d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920818, "uuid": "3c7cd5dd-febf-4aad-bc36-e7d49aaf642e", "comment": "Malware payload (GCleaner)", "value": "2a08009c8449fdcbcffa154367da8afdfc095dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920818, "uuid": "2054459a-1134-4824-bdce-614f17403c3b", "comment": "Malware payload (GCleaner)", "value": "9869368d6c0fe42065b2e80325831d859c9c616406dba1c0b638642803ebd00a5c936c0c806291f4e9049cbf5008b2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920818, "uuid": "20aa8206-40ce-4197-b429-335c781869db", "value": "T157B533A6AB964E30F237E974DD2C0BD46577B8A259BD7D0071CD899E2B3F2A10C187D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920818, "uuid": "7801c939-54c0-4bf6-beec-5242dc251a51", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920818, "uuid": "13dfc0d7-7363-47d2-a3e7-c4530e1d1e42", "value": "49152:Z2zBL7ohiyssfUzEuV6ra3AZ8zRAsU3iGsVQG7gA5hq:MNyPUXFQADUIQG7fDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666920818, "uuid": "4af12aab-4efd-4cf2-906a-a1dc319c0a68", "value": 2446747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666920818, "uuid": "c2fd1b7f-0e84-4353-b3fb-b71ad0bdb34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920818, "uuid": "662fbd31-fc74-4298-8007-cd668b9e6298", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec298fb-56d1-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666969544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969544, "uuid": "53f6b3c8-188f-430f-9474-9e3c03e5fd77", "comment": "Malware payload (RedLineStealer)", "value": "52774733148118c4899fb5315b46f73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969544, "uuid": "37f1bf98-c079-46e5-8f95-361ecac5601e", "comment": "Malware payload (RedLineStealer)", "value": "0c6af87fead3c0ac4bdca0c21bd5ac7e6e6b7cac8ed77a62aef0dcb824e8bc77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969544, "uuid": "fb513b46-8a83-400b-b74a-ec1e97564349", "comment": "Malware payload (RedLineStealer)", "value": "73dcc63c762980a62347822fdaed1d999e72e057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969544, "uuid": "71d82821-6786-4bb6-99c4-39358aea0956", "comment": "Malware payload (RedLineStealer)", "value": "884619d74b3c1cff4074634ca2194d5c681a22beddd2c9b7b2d2416b6b1372a4851ed9aef68e5f795542cd510da8cfda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969544, "uuid": "d5ef0e37-5da5-420c-ad0f-bf201a1cc592", "value": "T111C5BF3AE70614B4D76356B1C28EFE7BDB14B6348025AD3FFF46EA0CA4734126C89256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969544, "uuid": "c801877c-0cb8-4a38-aa9f-5e43f4bbf434", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969544, "uuid": "333cbdd2-646c-44ac-92bb-9ce45039e5d7", "value": "49152:GykRi/S6AJ9fcSPi/CTROo4JG9axATqebk35HzNQ++V1E:GykRi/S6AJ9fcGi/EcJG9EU/spnuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666969544, "uuid": "e2471498-a776-4315-b21d-f2060885249b", "value": 2528256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666969544, "uuid": "5bacb0ca-5b61-46f8-805c-7ccdc006e40a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969544, "uuid": "4a550da6-120d-47f2-a0a7-2423c4c6ec31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d629ccea-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937263, "uuid": "89a587ad-3518-48ba-b26b-2a6873400120", "comment": "Malware payload (SnakeKeylogger)", "value": "6b24bcb2940a695798229b195600dede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937263, "uuid": "2338d345-6793-4814-964b-aa84271b9cef", "comment": "Malware payload (SnakeKeylogger)", "value": "0d5e9b9b21a13e3d18f7f63c62e45174ff65aaa6fcefc638dd5717cb4302f9b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937263, "uuid": "68902486-2df3-45bf-8eb7-d66f3749be65", "comment": "Malware payload (SnakeKeylogger)", "value": "2df95bbb89d38fccd11d3cdea440bc06bb783dff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937263, "uuid": "39dae575-d7ae-44ac-bc9f-cb3be57ea014", "comment": "Malware payload (SnakeKeylogger)", "value": "be95bd3e31e91e97fe2bd4b5654da8c56627e5b18d2a0effb0d82dca6590c58e02eb1d935247c2822b930a7333585c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937263, "uuid": "cf8065c6-fc9c-42e0-8288-21dcd56bb227", "value": "T1D6E4BF3429EA522DF277DF701FD478EE8AEEF2332706E469149107C64B12E41DE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937263, "uuid": "5daca845-4a11-4d5e-86c4-a9273a897845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937263, "uuid": "e3907f00-587a-4a1f-9fa0-83cda3422ba5", "value": "12288:gZAgHtDg5xE1nMdVorLb355w3z5LErqPm9bNxKeol9TipScQTXMz2:gH4QGorX3g39/mNjKl9YKjMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937263, "uuid": "7103b34a-b63b-4dfe-98b0-a2b21861453b", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937263, "uuid": "3c296783-8210-4fa4-9adc-029d16e9c535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937263, "uuid": "6cc69c0c-520a-4c9a-bedf-34f35f1606e0", "value": "RFQ_2010202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bcc43f-569c-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666946760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946760, "uuid": "8c2fe63c-0ec0-45cb-94dd-5a6b6ab609ed", "comment": "Malware payload (GCleaner)", "value": "1d0548eb594a6312a7a5c50c2f47cba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946760, "uuid": "538af845-af0a-4528-8611-e77153d10ee5", "comment": "Malware payload (GCleaner)", "value": "0d7cb1c59ab3401336f26a011b64bbdd6eaaae4804e3c33eed7cc70e274478ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946760, "uuid": "d6b7652a-c2de-4560-9253-1fabda77f775", "comment": "Malware payload (GCleaner)", "value": "caccaa36bc220a4d7e927b155e4e646c23d4bf73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946760, "uuid": "27321317-481f-450b-a93d-ccb2b16909e2", "comment": "Malware payload (GCleaner)", "value": "864f6462852475ea33140e9ce719b2e0d58d43e2a8f98ab574d81a8d26c961f5aa77104f1000e2cc2d323148c0c80c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946760, "uuid": "536816b6-5d31-4610-978d-ed98f6d4c4c0", "value": "T174C5336013219CF3D159C9B49C068B9D8734397E00BB612B71EC87BD9F6DAE78818BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946760, "uuid": "5ac726bd-f686-4565-99d2-a33cb2a6e5d7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946760, "uuid": "dad9d858-06d0-4d1f-9fed-d5235baac950", "value": "49152:Z22m7R9eQsuNrTOguKZOZQ/GVVYR0RV5ozo+nDmvwr0BI5wKT2UA5hq:M2ml9fJegTOqOVeR0X5ornDm8tv6Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666946760, "uuid": "559a9a06-9b34-471e-8867-bc67f4fb18a5", "value": 2584635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666946760, "uuid": "a627ff22-55c9-4a7a-9693-9a1e563f942b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946760, "uuid": "079e842a-8914-477c-814c-d450f9802b0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6125c6c7-56d1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666969279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969279, "uuid": "a0ec5ded-1fca-4e57-9066-03f509cbb690", "comment": "Malware payload (GCleaner)", "value": "7cb977503474d4aca4adf2d2a32435c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969279, "uuid": "1eef1096-495a-43d3-83e9-bb7b4d81382b", "comment": "Malware payload (GCleaner)", "value": "0da2576782d551dd8304d70aef5f04b044c20917eddbb24ccf70fdf781529248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969279, "uuid": "0af64da7-a4c7-4cbc-811b-a51081222455", "comment": "Malware payload (GCleaner)", "value": "0a468535bf8e97b60d4115d612b08719655848a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969279, "uuid": "e9cb09f0-9804-459c-976a-d9753c99df75", "comment": "Malware payload (GCleaner)", "value": "e327b2c2f167638ed5c5e7068d403298f9846410ad27122b656766a3fdf16dff1bf1c6e4edb2d4d07018b8006dc268b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969279, "uuid": "06482080-1d39-416d-98ba-f335eed965c1", "value": "T1DBC5335B5F9588B2C091D9F37D7A835609F139B1A82E783037E8044BAE76BD590C8FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969279, "uuid": "ebb96dc5-4289-476c-b3b1-2aa6c5c062ee", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969279, "uuid": "13f271d8-62bf-498b-87b8-21972709a612", "value": "49152:Z2Ti0qRPHlREe4/Fkgbx95d/B1+VgrAXGIRToOzwpOA5hq:MTi0qbREeGFkqHdf+VqAXGI2qatDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666969279, "uuid": "8161a10e-7620-4ad2-8c90-83fcb6fb4eb7", "value": 2609233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666969279, "uuid": "4be03e03-3de5-4d22-9579-1f776a41b52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969279, "uuid": "a45c6a88-4b4b-4d2d-8846-6912da968fa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f22fbc-56f5-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666984674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984674, "uuid": "1256b321-dda0-43b9-aacb-52ec2c052ebb", "comment": "Malware payload (AgentTesla)", "value": "f0c566f1c2750026e0c200eacd0474ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984674, "uuid": "d1327d48-5d29-48a6-944b-1c7a3146cba3", "comment": "Malware payload (AgentTesla)", "value": "0e927f55a7c2a42a6658580dacd710852f9ffd82eb55a128c1c9e32d0fb102d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984674, "uuid": "b824f47d-ba40-4b86-9627-311f8c7abfc8", "comment": "Malware payload (AgentTesla)", "value": "81864390eeb391db6298445ec87ee2e7284386a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984674, "uuid": "acdf103f-ca86-411a-9af9-a12b753b70ed", "comment": "Malware payload (AgentTesla)", "value": "6722f38067a3c15a751701f504e423e55e7261736532578df7d2e6a52c09699aee947f5a619162d07c8c4a6cad8ac7d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984674, "uuid": "aa29e83b-9ad1-423a-851c-a7cd894b8b45", "value": "T16712D601D3D40132CABB42B73CB78782C736A7AB59869BF9748C555E7F3219283532E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984674, "uuid": "44127090-3d69-4cba-8725-65ff64dfb08b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984674, "uuid": "f756461e-7293-4b2f-882e-4e88769a35ae", "value": "96:p10+ShH6dKR1tmz+vmjjiCo4ym3WNtW1jYcFoNVcz1W4oKYMsLYUa:T0h3tmzEWjiphm8stYcFmVc03KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666984674, "uuid": "6eae018d-4bca-4876-b1ec-472640a08e72", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666984674, "uuid": "f7c7bfe1-e42f-4e8e-8a2f-f0ac1ba8c967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984674, "uuid": "f88b36af-067e-401b-a003-7e7d4157717b", "value": "PO-35136475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8516c4-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666949484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949484, "uuid": "8f52d98a-ae74-4907-8a87-213671c437f3", "comment": "Malware payload (DanaBot)", "value": "043835ebedfab7d8c9424845a4fc6095", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949484, "uuid": "3bd41c6a-5e9d-4d2c-83a9-0d440936831b", "comment": "Malware payload (DanaBot)", "value": "0f295d377540773127f73cf21c555c0358b8e28d8e74307535dd41839bf78f2b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949484, "uuid": "ca84d91e-6fda-4edd-9409-f2c49264c468", "comment": "Malware payload (DanaBot)", "value": "dc91c237153aaab8731463d097da924f91f5e941", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949484, "uuid": "ca0f7347-bc53-4679-893b-48249f9795f1", "comment": "Malware payload (DanaBot)", "value": "9daea6a2558a2ce308d01e646dbaee5147f242cc0c5d277e64eddcdb408edd4b27bcbcf94851d9dd071a34e659527923", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949484, "uuid": "f2407880-99fe-4079-9b23-a2ff8d1c6050", "value": "T18D563300B175E132E7D53535EE1953AAD5FABBB8123838439A50367E38B1BC0726EDC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949484, "uuid": "5d3c0a73-9c44-44c1-9577-66157d3215f2", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949484, "uuid": "594f601a-40ab-4a68-8be6-e820123f2da0", "value": "196608:N4x1eVpIitTMHCmGJUf86xszkNFzugpehepUy:NNpIiYCmBfRxszm9fpeYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949484, "uuid": "1cc0fe2b-fde1-4ba9-acd2-a02184631f94", "value": 6378496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949484, "uuid": "a3a1f8f6-353c-4988-8322-5070391d1e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949484, "uuid": "746ad07c-f762-430d-917b-daa62635f177", "value": "043835ebedfab7d8c9424845a4fc6095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ab6b76-56a9-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666952263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952263, "uuid": "acf62d77-24bc-4687-9271-613b1308a825", "comment": "Malware payload (AgentTesla)", "value": "91c54acc5290fd7a35542ec79feac5de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952263, "uuid": "3e1338a1-e1a5-4ce8-92fe-8b7798659cf1", "comment": "Malware payload (AgentTesla)", "value": "102a51b4bed8a205c1483ed547261405e892b44b7fee7debb3d95b96c0d5a50a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952263, "uuid": "3c18563c-2b69-478e-a262-4ba44c3ccecb", "comment": "Malware payload (AgentTesla)", "value": "974a17b9fbeecf7c5cf95e5a7035e30700b72734", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952263, "uuid": "4558f7e9-f447-43cf-a9ea-eda8b73f3fde", "comment": "Malware payload (AgentTesla)", "value": "94f4d4563608dae99c0365a8a20a56b1ba5c6d04c51fb03aa59980c8eaf4aa60fdadc387d18c1a2dc2c66267ae68468a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952263, "uuid": "038c7861-3597-4e02-9a31-02c895ec37ed", "value": "T11BE4222BB632C1BACEEB77711987475067BE1217E902CB10AB6F247162E7210661F7CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952263, "uuid": "e0f66e58-895a-414f-bfa6-1a18d477c655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952263, "uuid": "a4af7b4d-2549-41dc-bd89-f3aa7728f61c", "value": "12288:ZLUh7mBeBwf/dLGnDExAmoLUYYmHO5623paWHQfjBKDEpfsAIHn:fBLXcDExZt7mHOJ3paWH1EpfsAkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952263, "uuid": "3ce26c21-4b0c-4a18-89ad-606fe34d1be0", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952263, "uuid": "46ffa84f-81d1-4ff9-b4e1-31c6b6dc0815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952263, "uuid": "2bb0e764-4ed0-410e-9442-35b26d0cd072", "value": "Fiyat Teklifi716-1140 427134001447_Amerika \u015eirketi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c34362b-56ad-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666953675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953675, "uuid": "b17e2ff6-8250-4c30-9f61-debca0bc998e", "comment": "Malware payload (RedLineStealer)", "value": "54d3e951cc3031df54c2f1d935cc6a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953675, "uuid": "9670a8c2-b867-4216-ae97-d6176d96eb5a", "comment": "Malware payload (RedLineStealer)", "value": "11165cc19fe8a06b86ef467a5fa36e6db600d76029ab99cac69f16ebf68043da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953675, "uuid": "6c11840f-d64d-479c-a03a-51a08732bcbd", "comment": "Malware payload (RedLineStealer)", "value": "c229b98b73a3c504d7436b0c70f46df4460718af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953675, "uuid": "a2bc87bc-b07d-4bf7-9596-bb6d0e916fed", "comment": "Malware payload (RedLineStealer)", "value": "ee7b349908ea50e24c12536c37abff2b95172cec05a47c8efc20839d23b35606d7124d29393d3e0abfe5cf7b62ce6806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953675, "uuid": "680b7312-04c7-4e61-bf05-58cc22114c5b", "value": "T17684F13671A3C4B2C48661790419CFA42EBFF8311566464737A83B7E9E313C296BA71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953675, "uuid": "15c99ec8-8678-4b9d-9cef-d2652c024a17", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953675, "uuid": "1c2182c7-4f4e-4e9a-a23d-4a6f8e410b93", "value": "6144:cZmH0LtMJgbnDNYaklk2OjrRhjeekzIoEKo9jdnezSsWTweVdT:cZmH0RWgbBTklwvmz+d9dezSsWTxVdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666953675, "uuid": "f4c2cf2d-b0f4-4933-913b-1faf4b4466ab", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666953675, "uuid": "74371e4d-aace-4bc0-9697-9f624dd4c89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953675, "uuid": "1bf7a125-41dc-4199-856d-d6e84046b0e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6198136b-56f2-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666983453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983453, "uuid": "f836fd2c-a77b-40e4-8a14-056446be2496", "comment": "Malware payload (RemcosRAT)", "value": "aaa417b91a2c24bdf448d9056b6ba263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983453, "uuid": "b74cbb8d-d3fe-41df-a686-251317fcf3ec", "comment": "Malware payload (RemcosRAT)", "value": "12050271ba333bbc55aca8540cb433b317c8b043fcc4f49e2013706f03834851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983453, "uuid": "400a0e99-dbe3-47a9-9928-3fc7b39e34c8", "comment": "Malware payload (RemcosRAT)", "value": "666a686e5d51b2f11078270d9424da6fa8ce0bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983453, "uuid": "7f14ace2-c69b-423a-9917-f7892eee63f0", "comment": "Malware payload (RemcosRAT)", "value": "5d3ffeb2512ed555a592e0c23d1dd6a4f864e3e3c23ba48016eb8f36679588cecbffe133717b9030d8a6d622308aa34b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983453, "uuid": "f438c626-c9f2-46b8-b727-18a206b73a1d", "value": "T1440523422FA20002EDBB83B32D3B4714D33F6A65E419E66D5B8572893DB37981C46F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983453, "uuid": "cafed0a8-3003-47ec-ab6f-692dec7073d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983453, "uuid": "0cd2b212-d3de-4ff0-8aff-357f315735f2", "value": "12288:Rpuh7jmbFvZ9XoyMiQ6agDLh/DeQMKL1aahk8rC9qgKqmkyb9kp4VLfEYQI:7bFFMi4ghD/pxjrsqgKqmkyeiLchI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983453, "uuid": "a64ac5c9-d82a-43ff-9a46-d7f825ca3cc3", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983453, "uuid": "875892a6-bef4-4ea6-97c9-d9425c43c4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983453, "uuid": "1a982252-f213-461a-b263-499301158283", "value": "TRMSBEN00237 HK acil F\u0130YAT TEKL\u0130F\u0130 PO10939202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4d900a-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666949518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949518, "uuid": "0ce23943-2272-439c-8099-ca61dde77798", "comment": "Malware payload (DanaBot)", "value": "44aeba6feeb5f794968bdb6294785249", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949518, "uuid": "85d0c990-285b-4db8-a2dd-a849ee4d42cf", "comment": "Malware payload (DanaBot)", "value": "1206052fbaa8552d703b6913ca35eb4f9653ea935048476b2ea7e92a439163e1", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949518, "uuid": "789e8857-07d8-45a7-94f3-0bff488d1320", "comment": "Malware payload (DanaBot)", "value": "fecaa5123b621d36abaf69233202df0214752015", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949518, "uuid": "ec7a4cef-ea4e-4717-bf10-e6bed6ac38a6", "comment": "Malware payload (DanaBot)", "value": "223f11d6a3e83ecc09572347315cb41d3c10bfa1ab1195f1bb11963d1caedb9a5822fc1f5963f829fa3099cdda3281e7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949518, "uuid": "240019dd-e83d-4425-9940-ef2597d4455f", "value": "T10E563325FD14C962C1A08FF55513E6F4F05EF8328A1D354B2392AFD92DBA079892F788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949518, "uuid": "9fca861b-6924-4fb0-a24c-a29ecd854415", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949518, "uuid": "9f222144-74bc-4f14-bd90-30b5a30285e8", "value": "196608:zSqiILJeK6UbLEJISP5X7HQkFc5DtUmf:zZvelU/EXhQFRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949518, "uuid": "85c98152-053e-467c-87d4-02bb55268265", "value": 6377984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949518, "uuid": "f30c6ca2-ab0a-411c-928e-c2601c3d20f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949518, "uuid": "93e48cc5-fc2e-4e47-a95c-d277639debd4", "value": "44aeba6feeb5f794968bdb6294785249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03c9800-567d-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666933388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933388, "uuid": "48831052-618a-4cbc-ba4d-1f0a6da1127a", "comment": "Malware payload (GCleaner)", "value": "a515ac8972efbd8dc1b29827967c8854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933388, "uuid": "7416f02c-cdf4-4d2f-b7e8-0e24f7eeaabe", "comment": "Malware payload (GCleaner)", "value": "124bef95fab478fee58599246a82d880d8b99a02a2cc9163d1f9cd46a16147f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933388, "uuid": "d445c3f2-a551-456b-8854-897a485373d1", "comment": "Malware payload (GCleaner)", "value": "76a1d32e931c9e5cc70802116bcf98424fac2b5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933388, "uuid": "9c1d6393-0945-4efa-ab3e-e43cc9c56b06", "comment": "Malware payload (GCleaner)", "value": "0c44e1aeed31f33a22dec310813e5cde84e9ce9c4e0b4a9a6ab6808b119c9cd0c38a5c37f96b376a718ca787a561b09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933388, "uuid": "0b0555eb-26c3-474c-9793-c28717719e2b", "value": "T1A4C5330B874AD675C151B4B42FE843ACC1B771666429F04CBE0D0E9D47A78D2F42ABFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933388, "uuid": "bd015976-71a0-4713-a883-f8e2736142fa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933388, "uuid": "5e10d223-af5b-453c-9491-49a629fe64ed", "value": "49152:Z2LMGRp2agEZurCy2PhthD1Veez/Jx3UKjqApGEIsFwulN3lVhA5hq:MIGunEZo2PfQetxkOesa6N3lVaDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666933388, "uuid": "c738fe71-c796-4fc4-88f5-ca6a5cf0400e", "value": 2560703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666933388, "uuid": "a89309fb-f494-47f8-9dcb-2aa5c63a92c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933388, "uuid": "2d31c256-9dea-4781-8aa1-8653737d9e08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6525b489-5663-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666922041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922041, "uuid": "bc70970e-f4cf-4308-84c2-7e0c194ae983", "comment": "Malware payload (GuLoader)", "value": "d7e54b46ffd6ed4a2e55374ccda8373d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922041, "uuid": "d06be940-ba12-4fea-9171-52d35eafd43d", "comment": "Malware payload (GuLoader)", "value": "126fbec3a1a6df1ee6f0e8f713424af675169f2b5e670df5456b4609dc69c1ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922041, "uuid": "6a316654-e241-441e-b804-4bc6d056da0d", "comment": "Malware payload (GuLoader)", "value": "314f48600144d0846c9700cbdaeaa68f0a489d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922041, "uuid": "b1114f37-66da-473b-b09c-9478d1ae7d85", "comment": "Malware payload (GuLoader)", "value": "d61d64ac0b5d71dbb231bf461fb0469edc878fc3b0211cbd7c7acdc2fbf37742fb7e45c1a7d12db6beb34d7f0f010af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922041, "uuid": "59f131a7-6e85-4ac4-84d7-40418f62662e", "value": "T1C764CF53B314D05FC8699233E82A87F9452AEC66D4B0C16F2744BE6B7CF32025617F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922041, "uuid": "1e75da35-fd86-4f7c-ab0f-13fc9b01a195", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922041, "uuid": "9aaed6fe-f1de-4351-a6e3-7ddaeb7e94ed", "value": "6144:63yzthR5bro+4Xah+ORTOkGzOidcpl89sjDxHkTJMp+o:63kLvmXuYk/+9I1E4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666922041, "uuid": "249b36de-0174-46dd-8c7d-73c0780b4b57", "value": 325216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666922041, "uuid": "20c4564d-8c83-4aae-828c-8619c408a7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922041, "uuid": "d4dbed56-5cb7-420f-8680-8c7a6244bbdf", "value": "008s06523610054407b6011375030062022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1719ea60-566e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666926635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926635, "uuid": "53e4cec8-2d57-48c9-9493-2efb3b8a04d5", "comment": "Malware payload (RedLineStealer)", "value": "05a5f0c75f72f0125827ab83d62ab179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926635, "uuid": "a2e15805-3d6c-4621-b99a-4e66a848ca9d", "comment": "Malware payload (RedLineStealer)", "value": "128fa9c5e91c61f07f41747506930f91dc37de7fca0948f1f1d00e03233d673f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926635, "uuid": "5eadad0d-43d2-492c-a788-047c2c627484", "comment": "Malware payload (RedLineStealer)", "value": "fa7521f87169f862d797e09f4e1c5e13f5fc1c2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926635, "uuid": "30f204df-d3fb-482a-83e4-3bc38e20f839", "comment": "Malware payload (RedLineStealer)", "value": "1e96bf73e6dc413bc3c841123502318b202edcda8a2c1b4df47b55bd94573ad11a96fb6a2764de0f28e51487165fc16e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926635, "uuid": "44e17f6d-5b64-4734-9daa-9bba011f5401", "value": "T197C550ED671995D9DAA409304FCACE3042016E63BB65CACFB8EA7F4722343D459F244B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926635, "uuid": "9be6951f-4db3-4efb-aed5-b403b90756cd", "value": "cda23ed6a96ffe8c9ba5d7bae4aa8499", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926635, "uuid": "34d8aed7-8258-435e-a222-1cd8886af05f", "value": "49152:g2EPSZlTwhH8M2PBVTwhH8M2PBVTwhH8M2PBVTwhH8M2PBc:PGcTwhH8M2PBVTwhH8M2PBVTwhH8M2PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666926635, "uuid": "18f6df8a-1acb-401f-b194-f6c4c614d508", "value": 2565560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666926635, "uuid": "ff6d05a7-6e0b-4642-b755-7eb9ad1a53de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926635, "uuid": "e32d0f93-9a58-40f2-a2a7-852b08e255e1", "value": "05a5f0c75f72f0125827ab83d62ab179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60440449-56ba-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666959399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959399, "uuid": "50320f27-a59b-4b2a-b8b6-39dbdf256dd8", "comment": "Malware payload (GCleaner)", "value": "751621c915a45e227a53383127424fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959399, "uuid": "cda4a6f6-bd34-4cbf-ab34-7d575a0d2691", "comment": "Malware payload (GCleaner)", "value": "12cdb4529dfae93ad811fcaececf2456db8e2c973717da9aef5d634dac5b38d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959399, "uuid": "cfbe88fd-cc6e-48a4-9b2e-303f06dd53cc", "comment": "Malware payload (GCleaner)", "value": "3f71f2dc9f8f0fed03b8a6e52d97a5f048aed89e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959399, "uuid": "8f76348f-49f9-491b-8760-5f4aff5212b3", "comment": "Malware payload (GCleaner)", "value": "3e49437bbbd10cbc71bcc1ee135ba90df8af13b040a484d775d26ab2a7e940122cfe7ff59bb774d224c548bca4ddd26c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959399, "uuid": "dc9ad38e-5344-4b60-b7be-cffa036909a8", "value": "T1A2C53366DA7D18F0E062CD7C6534D22555A23C426934FAA1B5CE98CE9F632C3D08F37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959399, "uuid": "eea62bbb-91d4-414e-a054-0f8ad574ffc4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959399, "uuid": "15b1c2ce-56fe-4fcd-9baa-ea10a7e11e77", "value": "49152:Z2vOPxBJ8LeZz2+Fzeax9j+LfTB+voIXeY7eIXao6bOYcEpT+/DppI6ZA5hq:MvUDJv2qSaxwTBnIXesb6bRTpT+/I6CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959399, "uuid": "c23e02e2-f080-4543-865f-3955c2288493", "value": 2593591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959399, "uuid": "0c433d13-ba6e-4f71-9685-de21362a8dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959399, "uuid": "6afa8771-7869-4f7d-91cd-f043fa53d84e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c5c2f1-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666943411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943411, "uuid": "5efd05cc-5206-4a35-87d5-55a4d6371faf", "comment": "Malware payload (Tofsee)", "value": "b00a565f1b264217552039c887d44a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943411, "uuid": "0b1a8de6-1725-4ea6-a614-74feacd392ba", "comment": "Malware payload (Tofsee)", "value": "1376479315432aa08e6a8a514c2d03eae999e9f7efebbf5aec4258f22da62020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943411, "uuid": "e55af4a3-109e-4098-8bb2-03d4fdf82dc8", "comment": "Malware payload (Tofsee)", "value": "fe77c8d018acd1f0ff7ed77e2c6b1cab2e34a939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943411, "uuid": "0c9657e1-dce3-4263-9aa0-3e9990d0dd97", "comment": "Malware payload (Tofsee)", "value": "d60c4753b3d90275f3e0f4c6add6858c20a17a89e93a834ddbc5808226c46d9ba29984d4bc3e02fa8c546bc1502ba2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943411, "uuid": "68679054-15c4-494b-aaf2-1d0006377ea4", "value": "T11944CF327692C871C0861230482AFFE42ABEFC3119654587B7A4375EEE753D169B632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943411, "uuid": "f6b2f58e-780b-4438-9045-50537c11a593", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943411, "uuid": "685ec01f-d696-4166-adf9-bbef1817ff1f", "value": "3072:Zm0XOSHOfLSmPAUYrMGOfmlk5q5WdJFHQ0nF9zG9KQ/fyvIzZO/BRM/h3gU7:wwZHULSmirHOuIPHQ0nLzG9Kq6OZOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943411, "uuid": "149bbd6a-4bbc-4dbc-b032-54f3fe06e307", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943411, "uuid": "45ef4750-471d-487f-9620-17615d337eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943411, "uuid": "0abc3ff1-29bf-4ea0-b583-671d07b4f20e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f7803e-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666938660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938660, "uuid": "dcaa0f81-828a-4b9d-9b64-1979ff8367d9", "comment": "Malware payload (GCleaner)", "value": "07cc35307a7ea38702ce4368531054e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938660, "uuid": "0e321d6c-fb58-407e-9316-4dda71f23a16", "comment": "Malware payload (GCleaner)", "value": "137887f075c8e3b79ff4827de00fbdd6208ffcc46d866809b42d67efb958d8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938660, "uuid": "b5733f82-d418-4207-9c75-079bedd9f718", "comment": "Malware payload (GCleaner)", "value": "71b91bc787f48cf2e9974668b933f8eb1576d838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938660, "uuid": "41aee67c-3d7d-461b-9dff-82db5072872c", "comment": "Malware payload (GCleaner)", "value": "354e7f936172197e6ae3bfd8b0795c500bb9a005ac36afd18ee8864717ed7da27f0b7a285d19029d9915416c9b36f301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938660, "uuid": "74277955-f82d-46ca-baea-2a07269c6775", "value": "T16AC53306B7897438C963C87A1F799B527AE739220536892BB3DCC2DEDE747E0D41A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938660, "uuid": "c4ccc84a-eaab-467c-8e69-ad306cb23920", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938660, "uuid": "9bdec558-6ad7-4731-b56b-3d37624eaf24", "value": "49152:Z2LU/6+cM7SgddxoO0HmHmy9O98hCL4pR6AYR47S0HndIJr2cKNA5hq:MLt+57rdfoOYr8hCL4D6AYC7/HdhcKeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938660, "uuid": "070a369b-397c-472c-afb4-fdb1f8c5ae67", "value": 2593150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938660, "uuid": "d6cd6665-c670-45ea-b8ac-09b2562242bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938660, "uuid": "c2d26167-04e4-49d3-b67e-cb856ca6df5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1ce06e-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937270, "uuid": "e608624a-a30d-453f-9e40-d421c8509ffc", "comment": "Malware payload (SnakeKeylogger)", "value": "17e3024f0bcb62c44275933d2f438692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937270, "uuid": "937a0887-a0aa-428b-8a23-d16e2ec6e40a", "comment": "Malware payload (SnakeKeylogger)", "value": "13a2240414f042ce86fe4940579756560dd19f9245ed04282b597f75de90ac59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937270, "uuid": "595739ce-6134-4bac-b402-a95b85a44123", "comment": "Malware payload (SnakeKeylogger)", "value": "582af25e6a441e5c5a3956c0b27237202a4eb1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937270, "uuid": "6cb2778b-cc52-4802-baa0-d95072634f59", "comment": "Malware payload (SnakeKeylogger)", "value": "8555ea68b5ea326078f4d1a52db6148955d6ea7ff0b2434f13a7482cb0ace1db98a67c17664936718416c901d8551ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937270, "uuid": "4e507a75-cc3f-4446-9cd2-a39719722d31", "value": "T152C49DAC329076DFC81BCD728A682C60AA2174B7571BD207905715ADAE0DBDBCF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937270, "uuid": "5e3cd7d1-77f1-42fc-8e78-d485d4c022ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937270, "uuid": "0729d9bb-87f7-463b-b554-630077d6ce3e", "value": "12288:O/QDElMvZ8fa3djyVz2eAeFwwlUSXtJDelw8yb+Iq:O/Q7vZ2+jyVTAeFwEIIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937270, "uuid": "34fdb3da-19e8-45f8-b8f9-2863a557c3a3", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937270, "uuid": "685e4af7-c9da-46a0-a19a-531973c24233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937270, "uuid": "9989c631-e251-43eb-989b-4b639d622936", "value": "17e3024f0bcb62c44275933d2f438692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb20ae7a-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666939446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939446, "uuid": "06fea334-7afb-499c-992f-40060c92e383", "comment": "Malware payload (GuLoader)", "value": "101290402fc4f16441980e6eb0ec78a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939446, "uuid": "acce3848-e91d-4dc4-a343-d15f7059399e", "comment": "Malware payload (GuLoader)", "value": "13c7efc07da5177178e3ed9b89e4db5726c2839eccd316e504ab090bdbb1b4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939446, "uuid": "da9cf0ac-8900-43d9-a4f2-2f710f9e4434", "comment": "Malware payload (GuLoader)", "value": "32d9c959c8627215ed1c77e50604205e0d2a7eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939446, "uuid": "02ff5193-b9c9-494f-a45f-e58b8812f3bb", "comment": "Malware payload (GuLoader)", "value": "3b7128bd93c2b1cce25c6fde32673b5f713c91b5c38d9e6f342ce8e70221a285b7cb913e2d8ea74118c4ed3c317ec973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939446, "uuid": "fcdebe5c-a7d4-447d-badf-0652de2eadf5", "value": "T12E04015892B5C0E3E9E5057044366B1FFBB97B0591653B0BEBF06A677D32250A83F08B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939446, "uuid": "93da845a-1957-4769-a248-0c20f41bc8aa", "value": "e871f39e81b4aa977737b07cee050825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939446, "uuid": "4ea53dd3-2f42-4f2f-84fd-3673afd5f838", "value": "3072:tk62PBHHXx4jxiXb0+UZeRzq2TF5h6rlLeigIeL+DWAUUMHtIMjBEyuIf+r:tk62PBH4u0feRzdB5h6rlLeihs+DaUUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939446, "uuid": "1bb65427-9db4-4400-be8c-e486d910a0ac", "value": 179000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939446, "uuid": "0e7b1fe3-2344-4c57-a375-7de153eb8486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939446, "uuid": "2d0dd59a-314f-4a6b-913f-ab03cb4ddc16", "value": "Arccos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71d0ff6-56cd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666967732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967732, "uuid": "3677c17d-75c6-4ddf-b922-48bfc89ed829", "comment": "Malware payload (Amadey)", "value": "1bb3cedd2a97483d8bfca35aac598a2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967732, "uuid": "147540ff-76e4-4fa9-8825-98f30608c70e", "comment": "Malware payload (Amadey)", "value": "159aa7367f72adafead52cbde6726ad2d0c455af0693e6377e27681621c5c90c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967732, "uuid": "bf5ccafd-bdbb-4301-850b-1ab62bc56ff2", "comment": "Malware payload (Amadey)", "value": "ccf298cfebb23f321c8407daaf8a55fc86a876ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967732, "uuid": "03002f30-d52e-467b-b4ba-d3ef08a90ce8", "comment": "Malware payload (Amadey)", "value": "fd0766b3dcdea967c702c52b573026a01bc4fd7a56aef4eb3ae93cc0982275d9ae881eddb1f2e3f16d0119fcb5443ebe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967732, "uuid": "088a4d28-a642-4483-a808-bf6214ecfe75", "value": "T11C54E0327A82C472C4951634182ACFE10EBEEC3126A44A4777A4375E6F713D0AA76F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967732, "uuid": "66bf9ee0-aefc-42c6-aabb-7a14c6a25521", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967732, "uuid": "2b0a790d-a1d5-4490-ac48-dc019a3e3cd4", "value": "6144:JqHUL8zx/DkroRIrA8haIB6qq2Brv9AJL:JqHUgxr9OrA8haIAqrv9AB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666967732, "uuid": "722e9245-4184-4d74-bcad-6a72afa50809", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666967732, "uuid": "66762d47-cf4a-441f-a0ef-51b98c051655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967732, "uuid": "da25cd0f-ccbf-4865-aa37-8c612689afd8", "value": "159aa7367f72adafead52cbde6726ad2d0c455af0693e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aaf3aa-56d1-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666969334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969334, "uuid": "95790046-4391-4126-828b-d98f50e11c35", "comment": "Malware payload (GootLoader)", "value": "0bc99bef2c416a4b1a1809d0ed063c23", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969334, "uuid": "84707f8e-1a1c-40ac-89cf-49b7b8cc30fd", "comment": "Malware payload (GootLoader)", "value": "15a66c4a364c943a7c592e3315379ad3f7dbb4fc06d1b86052509039bb2de190", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969334, "uuid": "01648d3c-9b38-4420-b3f0-9927ce992558", "comment": "Malware payload (GootLoader)", "value": "782784a922d329076b65be55f946588e19b117ee", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969334, "uuid": "b975852b-98f7-4787-be13-200eadd8229b", "comment": "Malware payload (GootLoader)", "value": "0ce5ef9863b98ebd943bad60559d8b1bcf939209a9a09ee378454c8d48b1439e13fbee7ab040bc98f4f3ebe598697680", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969334, "uuid": "0759053b-148a-4a38-9183-0b40defe5601", "value": "T1A3A2D1489D4DE3662EAAEDB951291B872FD4EBEF901104E370CE7E84965AD42E2C4C1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969334, "uuid": "f38f3d61-e435-4961-8cf7-0fe5510b8564", "value": "384:Xi5gVdLnZPkx32qzMXUVD7lREjS2wEFeF2jRg75d8T+z2vk9zbX:XiqLZ8x7MO7TEjS2wr2tg75d8yb9zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666969334, "uuid": "704f9a52-eb8a-418c-a478-2044fe15bd32", "value": 22285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666969334, "uuid": "68383422-992e-43fc-a084-e1e60d86cb0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969334, "uuid": "428183b6-67cb-45ab-9dde-e243a75f3bfb", "value": "Which sentence has proper subject-verb agreement (64291).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61a275f-56ea-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666980159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980159, "uuid": "666bee72-031c-42df-b505-5b84f694f085", "comment": "Malware payload (SnakeKeylogger)", "value": "03aa087c3631c938a4016d594f2bcf6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980159, "uuid": "76f555f6-95b6-49d6-98c3-d77f07ba2bde", "comment": "Malware payload (SnakeKeylogger)", "value": "15e607b94fb0b5d7cd1b5380d2f7f91634d5772218fdbadefb41e5b20ccead5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980159, "uuid": "b87bf0f8-d9e3-4b0e-8efd-85e458c2fcac", "comment": "Malware payload (SnakeKeylogger)", "value": "e15ca6ee43322b2b92f6fd4561475a93da8253ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980159, "uuid": "05400893-f3fa-4f72-8ac0-69d94cf73914", "comment": "Malware payload (SnakeKeylogger)", "value": "b441403ed8a88f0475514adba671c8adc92be783267055a9f04186808d21f9285f8402551d42380285a7cfe51b93ed9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980159, "uuid": "dbce3786-a44d-46c8-8d37-100608f3c4c2", "value": "T1CF448A11E89A445DFA336172C4174D21A45FABCA13AF8BCB0B54D7A148B37DE4A373CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980159, "uuid": "e79e11c1-5a3c-46ce-acb6-88612e9d903d", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980159, "uuid": "7313e8e7-155b-459a-9d71-7deb0ff21bc3", "value": "6144:MweEbWBcFKAOnnuJvWpIN/cS9Rj89NvpOVHvBq:vWBc6nnuJW89RIbvpOVHvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980159, "uuid": "e86c9615-23c1-43d6-b5ba-8b69fe8e2308", "value": 275280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980159, "uuid": "af792d1a-b2d9-4a8a-b925-3348d895fe7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980159, "uuid": "fc7008a5-8503-47ea-8a02-9a68e258197b", "value": "PO#001260930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a7850c-56cf-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666968419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968419, "uuid": "08d16600-b924-4749-b584-a94e5661da09", "comment": "Malware payload (Formbook)", "value": "031281aa0667cba260ddad6f77c89ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968419, "uuid": "f9081492-9d66-48c0-8ca5-ec6fb82419db", "comment": "Malware payload (Formbook)", "value": "16346ed15b2d60e072d99cd110e29c8bef43483b9f8a5f9246123750bc0073d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968419, "uuid": "00184fe5-4681-42ff-bda9-5f5994f1ce9b", "comment": "Malware payload (Formbook)", "value": "17b747e3e1de9296f862d522a9664046d2d3469e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968419, "uuid": "4147929b-c0f1-4bdf-9791-50a16e20b194", "comment": "Malware payload (Formbook)", "value": "0b1b5dfdecaa5586f9d466995fb422bca311dfad9ca1ca77a0eebfaf5a5fd2c40817ae7546e32ef632ef267975da87f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968419, "uuid": "49977bf5-c27c-4b14-9ea2-3559749eb19e", "value": "T189D423A93791D57BEF5799B4CF23D2A3C635805102C1E02B8FA2AF9E4C3D4D20D9A1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968419, "uuid": "6f631217-e074-489a-a698-201346590e19", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968419, "uuid": "580c7947-dc46-4611-8f38-e5559c60c4d1", "value": "12288:bItKcNGvH3x+D0NDO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHS:bItK9H3xbJZlT+lQTD/O3BArRCHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666968419, "uuid": "62f53e5e-5c9e-4458-b38d-ef410356fc6c", "value": 641815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666968419, "uuid": "1a047f24-8171-4b17-abee-46bc6bd5d691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968419, "uuid": "daa8d382-c0e6-49a9-bd5b-d8fe660996e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e5ca5e-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666971198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971198, "uuid": "df5871c5-c40d-41c1-adf8-df8c64c33e22", "comment": "Malware payload (AgentTesla)", "value": "80b66a792f1a813b22841fae6301c3ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971198, "uuid": "da1c02a5-b50b-46d2-8dad-16dfa01a16d6", "comment": "Malware payload (AgentTesla)", "value": "16a425aad17a7444c55b6109c2c07fb65587fc95cd08a0cb0596045c58f6e3b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971198, "uuid": "39e8d0a3-87f5-459f-bd9c-63bb3494bccf", "comment": "Malware payload (AgentTesla)", "value": "12f6b940f8d25e3d6ab7b3ebbe92e04042d67924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971198, "uuid": "c4b7dd58-a940-44f3-a1c7-ef5efef1f58d", "comment": "Malware payload (AgentTesla)", "value": "9ef5de8ce9f2b2905a800ae69103d8aa8ea493020d672587a0ebeb703932fc74ce3efb4d146ee0ef3f138d784d3cd4c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971198, "uuid": "7d462df8-7496-4bd5-9c9c-f2696300d3d1", "value": "T1D804A27352FD31F7E5A80B38140B1B2A1F207F766A33990E6A7A79F46375F910466E80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971198, "uuid": "7b5fe14b-a065-409e-9502-4ed03209fcc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971198, "uuid": "dd4b0953-d0b9-4b05-b75a-ce17010fdc95", "value": "384:doXbLvJnJZDhAleWWWDrZLQPptYcFmVc03K:dovRhAleWWWDdchtYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666971198, "uuid": "5c24e788-c5db-4f0b-b1a4-459a31455a53", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666971198, "uuid": "58392819-ce11-4ef9-a028-c7027609ef92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971198, "uuid": "1e3c86be-576e-4d40-a71b-a8174119032e", "value": "Order_Ref 68904-2 HFWSPHFWSP.FID1993445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56188e86-56f3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666983863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983863, "uuid": "b517ad4a-3407-4d7f-8df0-e4e824000ca9", "comment": "Malware payload", "value": "63d124bce833b61fd4ccb2a8cd6c2aa5", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983863, "uuid": "86da43bd-c846-4b0f-95d6-e4888f3a2014", "comment": "Malware payload", "value": "17383201441a9e87a4258f8f2ae9d817f239dd993aa01713858682282308a490", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983863, "uuid": "dd3f6a12-5067-4da1-8f12-ac0f91fc3f48", "comment": "Malware payload", "value": "92d942baffdbd8f0cd09f85acd712e61f12b1657", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983863, "uuid": "2ee14551-10b5-4f92-b748-471743d97109", "comment": "Malware payload", "value": "29411a5305c24f3fd5342900dcd4090bcde554b6c445b9228a676b077949272e09e82d36426abbfe455110ed831a03ee", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983863, "uuid": "dcb2db22-c1df-4079-86ff-c02856354fa2", "value": "T1D9A2E0582C4BE81D786386F1C14CE4846BB0179A6CD9326B32EC685630F71D63BE367D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983863, "uuid": "6444a484-c0ab-4ff9-a0c5-a8cb5085458a", "value": "384:CY1zW9xBDHtfEbVgybuINl2jD3rJZWYXPU3DP/RoRHQqn5lmPFXWpZwtRwwM/HJm:C4gLDHEgybuIqjDbJ7XPUbAwt9XWpIwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983863, "uuid": "b8de6bf7-75ab-441d-8960-e9f12e3abacc", "value": 22335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983863, "uuid": "2ff7be0c-5f9f-4e0c-85f0-62f70b5a6fec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983863, "uuid": "32847bc0-7cb7-4583-b8d6-193a19902fb9", "value": "Which sentence has proper subject-verb agreement (72354).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd5762c-566a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666924953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924953, "uuid": "bcc44e4a-17c9-45cf-bb4f-3cf2f8975ac2", "comment": "Malware payload (RedLineStealer)", "value": "bbe48e8cd9410a99f5050c2384320c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924953, "uuid": "56a6909e-d7ea-42bd-8cf4-602c20455311", "comment": "Malware payload (RedLineStealer)", "value": "18126576630f8017fe12609bd7796745ff43dace52ee2ff24030bbb58ba290ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924953, "uuid": "1047ad26-78c6-4fdb-a632-014f636a8f91", "comment": "Malware payload (RedLineStealer)", "value": "00acb7850627536bfad9bbb2483741a9122091b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924953, "uuid": "d3d67f90-d502-4a05-8357-2ab56a27c77f", "comment": "Malware payload (RedLineStealer)", "value": "2f5622d3936f030d11e0428ff3063490810d7638d0c173c60e72f0bd6b29e8566c81e364eb127ba57055eaa2714f48e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924953, "uuid": "ba22057a-3d31-45f7-b5bf-b6bdc875c2cb", "value": "T14C94F131B941C872C0C46134086AEFE129BEEDB416354A437B653BDEAE743C2697762F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924953, "uuid": "4123b7e1-f2e7-410e-9b1f-a9a41a990795", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924953, "uuid": "3236e161-1622-4372-9212-71e7c7fabd16", "value": "6144:vRqTfos5D1M0CewE+1SVP+Gg7L8Ot2uEt6T3s2B5R:vRqTZRwE+gPDg7sR81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666924953, "uuid": "a0868854-679d-4d25-a3c6-68f94360ee21", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666924953, "uuid": "79108573-04c7-4233-b1b8-41136b833ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924953, "uuid": "848fdd35-1b8b-43ef-a4b4-d0462ce73de9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1345c238-56e2-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666976450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976450, "uuid": "9e3fe15e-8d95-425f-96b1-48e285ef42d7", "comment": "Malware payload (GCleaner)", "value": "4c667495131960701def3cf0b804412f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976450, "uuid": "14509713-bb92-4ab0-acdd-739017396043", "comment": "Malware payload (GCleaner)", "value": "186dafa957a25b486602165fa1fb66c334e9b589332f2f191dd7a51924639708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976450, "uuid": "3f5f9ff4-0590-41ce-87ad-850c560a94e9", "comment": "Malware payload (GCleaner)", "value": "767388a6403d5c7a82e076ce9411033771d734da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976450, "uuid": "6970cfef-51c3-42b5-8d4a-dbe87e712b49", "comment": "Malware payload (GCleaner)", "value": "c91ae1ac4d3ac2302e465156106e39e81efbaed9454639f2aafd7a6365ad0b9661107219343a38c93b346a57ddb8c641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976450, "uuid": "672fd896-7227-43d1-a50d-c0eb56f8d445", "value": "T16BC5333559E94573C8908AF26D7C4F2CE2B2B10BB46A0604A24CBC455B7AFDA9C077DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976450, "uuid": "f55cbddb-eb0b-4540-b4b5-6ff1ff3c7357", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976450, "uuid": "63eb7158-0c19-4f63-8a52-06743c923e9c", "value": "49152:Z2RvYgcaDys8gZPFBBhXXdhA3vPbDT+mq5rgR4jR8slDrK4o4A5hq:MRA8CgZDrE3vXcrwSWODm4oHDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666976450, "uuid": "b033387b-d491-4309-8825-7d08aef92254", "value": 2638369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666976450, "uuid": "37a149ba-eeb0-4b80-96b0-adc1641b39bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976450, "uuid": "0e5c997c-965c-4227-98ff-e1b39ddd1877", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50394b24-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666939186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939186, "uuid": "c93dda2e-9966-48ae-9901-a2e099192e8c", "comment": "Malware payload (Smoke Loader)", "value": "d44bdd736596f2d1f3a00e479a7489a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939186, "uuid": "cde59902-1125-4ce4-b6b0-d0a253b89df4", "comment": "Malware payload (Smoke Loader)", "value": "18810cb4bb607a329a6336f69dde756b084e5b6f95bec52519f70221b24cb94e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939186, "uuid": "5160473e-630d-476c-95f4-7676df527471", "comment": "Malware payload (Smoke Loader)", "value": "551c52187812184d8c44eb747db0abd1995e3d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939186, "uuid": "0d358ee4-db80-420d-8c49-9cb77fb9b80d", "comment": "Malware payload (Smoke Loader)", "value": "494aa1d4c256bcdb459deb6e68404c65d9134b449c7a036d35d447ff90e4d0b12bb26f04823119c4d8948f858a930c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939186, "uuid": "1436af62-a33a-41fa-9e05-468b012598b3", "value": "T1E844D0317952D471C0412130483ACFE12ABEFC7205B94A877BA43B6EAEB17D1667636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939186, "uuid": "50d51b88-d6b1-4fc7-9e3f-50a560c0105d", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939186, "uuid": "0af2580e-b0de-4f0a-9567-47550ab5af73", "value": "3072:dVmuXO0HusLyG9AUTL9Gufmlk50lVRWAHekqbkEB+ve9whgfrexGnnZYp3M/h3gi:S27HHLyG3Lkuu/nWAH1lUwyre6nZGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939186, "uuid": "c7a7e58e-5633-41d4-a3b5-460838bd0cbf", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939186, "uuid": "edc65f7a-ed86-4cf4-9038-50dfea56c919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939186, "uuid": "39399601-5126-410e-b2d8-8f2cdbdd5fce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fa86fa-5715-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666998496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998496, "uuid": "2ba148e5-b143-4f04-a08a-f7330613d004", "comment": "Malware payload", "value": "d78df6838711d1ce8bd374defe03b96f", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998496, "uuid": "1ab340ba-979c-464b-803d-29401be7e6a5", "comment": "Malware payload", "value": "1910e336bff62ceb335b2d39911a1fd4c25af31aef7a1c0512d21821a54fec63", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998496, "uuid": "3c1bbf9c-f713-4df3-b010-1867372af955", "comment": "Malware payload", "value": "d6695fa9493e8cb5b93ee0800391989a31d35883", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998496, "uuid": "e37e752a-308b-4ffa-b916-aff58cd396bd", "comment": "Malware payload", "value": "5bcebbe30df40a217c3a3255c3a57fd0e927f56ffbbfedf56e23acca278a01a9b238a59de846419d144b0558e265b7b0", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998496, "uuid": "f7c17ea7-334d-454d-9753-d9983022c6ae", "value": "T1D4A2E1840E537D0A9A9FAE52D2FC9F91314590134CE74436B886FF1D5D37083265AD7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998496, "uuid": "36970215-7e9d-4c77-b4ad-56b4de172060", "value": "384:zCMhoqDDPi+g/vySwo6GcWSh6/7pyDWuS7qlTs01f8Pgv6KhV2AujJTQ/2JhA9u:2LqHi3/mo6GcWShWJmlt1f8PgCCdujJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666998496, "uuid": "5dd7409e-4d5b-438c-b9c5-91ad5a276e41", "value": 22252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666998496, "uuid": "543b86f0-f977-4bb5-8e48-25bd80da425e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998496, "uuid": "deaf0a20-2917-4103-926e-aa86d74be960", "value": "Which sentence has proper subject-verb agreement (15440).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e614dd3b-56c1-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666962630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962630, "uuid": "e8e21eae-fd49-4251-965c-2f083cec86d9", "comment": "Malware payload (SnakeKeylogger)", "value": "71b7466fc79f50333678e0c18e844837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962630, "uuid": "03663a91-bc82-4ce6-b0ed-b6f88c22dbd9", "comment": "Malware payload (SnakeKeylogger)", "value": "192f96f6c56a10285eaf34115dd3dd73bb2d826ef87a736a45aaf86f6a788322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962630, "uuid": "2330f39a-c475-41f4-ac12-a15154fac09c", "comment": "Malware payload (SnakeKeylogger)", "value": "bf725f59a4e1521e45b92b4c0edc0f3299b71723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962630, "uuid": "75a01856-7e89-4c49-a2df-1d8b3ce84245", "comment": "Malware payload (SnakeKeylogger)", "value": "aad4e732207aba183f94488fcf6dbde271bef07354afd5b7d0198c68f4c64ea64cd2d0c60146df07c7c98980fa383842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962630, "uuid": "e836f8ea-9b98-4e90-b1fd-109088139a20", "value": "T125A42372D721F167C77723329D29487067FB094496F2A9DDA90B1AEC1BF390E202B4D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962630, "uuid": "d29374ac-9c53-4e19-9156-d238b1609805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962630, "uuid": "ba7f620b-ebfd-4bea-9d83-cb0a85d099cb", "value": "12288:7h71hlXdA02NtUhxPNeAgYQcILuBgqqBEyL:/hlXOv4hTeArjuEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962630, "uuid": "3138d99d-3f9d-4e64-8e0f-7b735f23f2e1", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962630, "uuid": "4db147f3-8301-4e22-b2f2-eac657a8a58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962630, "uuid": "f0f9440d-a3c2-4b63-9c1c-32bf91777b1e", "value": "LEOFI2209212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ead17bc-5659-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666917762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917762, "uuid": "e5d9b240-a8ca-4792-be96-095bcd4d8c02", "comment": "Malware payload (Tofsee)", "value": "bd4300bec75aea4594b63753347b7aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917762, "uuid": "0e70596b-39be-4c47-a0fa-91007fdfcc7c", "comment": "Malware payload (Tofsee)", "value": "1945f9dea955bb66635d6347193ef154d6ed9c8af3cc288cb55a994e09f364c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917762, "uuid": "451cdf89-99f1-4fdd-9428-53cd6d51adc8", "comment": "Malware payload (Tofsee)", "value": "5fda7e72dee2ccbfb0ffbb79b05be4e8316abd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917762, "uuid": "b2421e0c-ccc7-496f-9f93-f5a4eb228945", "comment": "Malware payload (Tofsee)", "value": "4b54a181ff30c44f5170e3bd8db6fffef2cdc001b0e0137d8cb9d28433cdc78aec48375e563913ee468cbe7ce636b8b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917762, "uuid": "85dd24b6-a536-44f9-9f29-ddd5536f9e96", "value": "T13B44CF31B592C4B2C04512304529DFB029BFECF1D96C4AD377A43BAEAA713D1A57622F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917762, "uuid": "de1f206b-9766-47e9-8cb0-fd056b99d43d", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917762, "uuid": "987ce991-e8cb-4ed8-91e2-c2e506943eea", "value": "3072:VZXOObq42TxtUmX1534yGTng+Ad7coZuwStJ5JT8gREi6nkY3VM/h31:LxbqTLKg+AlJSN7yiCkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666917762, "uuid": "948f0fc0-a54f-46ee-bdbd-f7cb8c807a85", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666917762, "uuid": "f7583713-f7f2-4444-b9c9-53bd1ad39604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917762, "uuid": "b841d1c7-b8d0-475d-adf8-5818ebf11dbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c30e9d1-56de-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666974881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974881, "uuid": "f5a1029a-ae69-4a7f-b921-94f2633b473c", "comment": "Malware payload (Tofsee)", "value": "47ecbf382dbfa5267a4f838646620fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974881, "uuid": "e6584077-2d45-49b8-a835-1577f03190f8", "comment": "Malware payload (Tofsee)", "value": "195c0030eb7f05164272fc42b0af2a2c7322ee522e26b8b3d70e9bb87062779b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974881, "uuid": "2fc34968-dcaf-44d9-8b39-0e17f8756bfb", "comment": "Malware payload (Tofsee)", "value": "41cfb2a14cbe97584379a1e179fc45614451bfd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974881, "uuid": "5da64048-99ee-4c99-8b22-d47e98fda35a", "comment": "Malware payload (Tofsee)", "value": "9353cdf7089eb17b4c9c78b1948b7368f8ec9c39236a4fcf741c104b91686b0006148e4e5885bae91586592656f16659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974881, "uuid": "0a28bed0-02b9-4495-b1cb-613cabf725f2", "value": "T14244CF317A92C471C0862630442AFFA11ABEF8311667CE4777A4276EAF713D19A7670F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974881, "uuid": "e99f796a-e2e0-4b6a-94e1-4912007693e6", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974881, "uuid": "29a6da98-673a-41a1-8ca2-f630126402a2", "value": "3072:WXOhHeeLPPAc+8XGNmj5Zi2vJ6pn0vY0gMXY1CguINpVmByHLUaM/h3i:+2H9LPM8WNkNJ6reX+CG0WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666974881, "uuid": "4414bc14-da02-485f-b023-383d15e9f2db", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666974881, "uuid": "ba9b2937-59ee-4b35-9e3b-bdba8bb2ebce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974881, "uuid": "ad9e9b0a-f00a-4b83-93bd-9bd08b4e612b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec7db02-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666949330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949330, "uuid": "198c3e9b-624b-4a60-ba86-b1fbcf7e0e05", "comment": "Malware payload (Formbook)", "value": "4bd711fbb6499756e10a3dbbe3010e95", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949330, "uuid": "4feed900-3ced-4a6e-90f2-2c6435e79452", "comment": "Malware payload (Formbook)", "value": "1990b2eaee218de2df312c4381e4c327ff5afc890867f4a6507d36b4b3b58e75", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949330, "uuid": "70930ac1-db1c-4391-a85a-679684f22d96", "comment": "Malware payload (Formbook)", "value": "732b7736db02d8e9b6495c80852dcc540df87df6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949330, "uuid": "55b2827c-a350-47c6-bca2-76a1b1757c64", "comment": "Malware payload (Formbook)", "value": "1b3a0995253596df726ef5bd2b3948403fcfb38e5cdd250e68d7daa89e949f316f7eb9873f21ec8e2255543ef5733e53", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949330, "uuid": "1f4e1c79-000d-4cc8-9acf-8712f457188a", "value": "T1C79153022B515044075B4BE76B2B70DAFD0C59AA3B68EC5FE160F591BE73420EAD9A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949330, "uuid": "decc9665-0a62-4ce4-b1ef-09eb0d95dfba", "value": "96:p96YUzghDncZWsLNwQZwG/C/mAUGK4SxeMQUUkfO0q6QM:bIghD4LNwQZf/ClUGj8eMQUUkfO0qRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949330, "uuid": "ecef6a5c-57ae-4bc5-a499-da0266a46050", "value": 4543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949330, "uuid": "47fe3874-17b7-4256-88c4-09b2c8fcb2e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949330, "uuid": "5f0e38b5-2080-4864-8382-fbce6c1bf77d", "value": "dla AWB #6199066016.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93de526f-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666963781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963781, "uuid": "acf34588-8fd6-42d0-a838-2dc832f989e5", "comment": "Malware payload (RedLineStealer)", "value": "4a109237373b9d873cfa3fe7ec2d93aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963781, "uuid": "a3b3a1e7-82d2-4bec-a66b-4d9d06ee9d1b", "comment": "Malware payload (RedLineStealer)", "value": "1a469f04ec57220db03cbfd904731ef50ebe30dff42e526f786da27a18ce5a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963781, "uuid": "ab20c34f-4c5f-438f-815b-050f64966e16", "comment": "Malware payload (RedLineStealer)", "value": "bfeb72c9568dbce311981b41e21066fd6528f8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963781, "uuid": "d1b27fef-3d9a-4836-8afc-4189c275bbc9", "comment": "Malware payload (RedLineStealer)", "value": "4e389421d9350a3b7879900f975d1143fc197579712d1c49199f5902014dd78a06c8f350d0d65c14a2b5ddd8e59f6966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963781, "uuid": "119f6d40-2378-4234-a933-e74c44f37630", "value": "T1B0F47D1235C1C03ADA7734314AA9EE7885FEA4311B710ADB939C167E5F209ED7F3162A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963781, "uuid": "deba04f8-2133-457d-8e64-3053023ad888", "value": "965be59bc41a205d90eb2c01d9ffc97a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963781, "uuid": "61119558-4b0c-4a8f-af53-997c279ef942", "value": "12288:4HLuCDNEACnEGD51k5XLL4n4EiDEx5ORWZ0lLY+c6V9uaULvY9oN2JY8X3nupF:4HLu0NEACnEQ2EiQxwRWZkoIoN2JYEXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963781, "uuid": "51738939-4e93-44e2-aec4-ceed13c7675e", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963781, "uuid": "e11bed14-a3bc-4ca3-a69c-668e8211da31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963781, "uuid": "968345fd-b3a1-4c73-94cb-1b49202bafaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad67d4ac-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666971125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971125, "uuid": "015f002e-f66d-4f08-b1c8-86641864a6a0", "comment": "Malware payload (CoinMiner)", "value": "127f819a1e7b6bae1bdf9f25fc295770", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971125, "uuid": "8b9eb77c-e81b-417a-b09e-530b0289140b", "comment": "Malware payload (CoinMiner)", "value": "1a506d9372f397b1ec69a6f5fefdc78796234298f1c63f07c69154bb309c5e84", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971125, "uuid": "d4d2d6d2-8a0a-46e5-b1ea-ef84d3a067e1", "comment": "Malware payload (CoinMiner)", "value": "57dd98995650469b85713088627750972dcd9305", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971125, "uuid": "21fb2d64-000f-4641-b41f-2247da5a4fb7", "comment": "Malware payload (CoinMiner)", "value": "cc923ce0349eb08862bcd1c36e9d5e6dcb3fe0be7c76e8a76f5f7691a7ddd12f414e9a1575be6b92b599c24c2533f9ab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971125, "uuid": "51f07978-741a-442a-b2d6-8512af724254", "value": "T1F844CF32BA92C472C4462170446ACFA16E7FFC31196149473BA4275EEF723D19ABA31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971125, "uuid": "42ccb7fd-77a6-43e1-8d6e-c5b7fd423a34", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971125, "uuid": "ee204b75-5cf1-4f12-bdf9-79858ed06164", "value": "3072:oXO2TH95Lu5AkqQrG5mj5jwrcBDyKipGmguCAOgtQrrDFMXBRLP8j4K7M/h3i:81HvLuqQC5n4g0vzDhraxRLP8h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666971125, "uuid": "0801a761-711f-4b99-9f1f-0dfbeb8e786a", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666971125, "uuid": "ad47e2ae-753f-4005-982e-5ad0e6f5c293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971125, "uuid": "d0a822f8-07c0-4a72-99db-0e7eeb4f37b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775034bf-56a0-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666948271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948271, "uuid": "d69ee18f-1a50-4b98-a355-8404a6493cac", "comment": "Malware payload (Formbook)", "value": "733e85d251ecbc92481f2cb5ea55229b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948271, "uuid": "19d949ac-0294-44c9-bde9-dd2546f67a7a", "comment": "Malware payload (Formbook)", "value": "1b53c5714322ee87fc3d6d7e513818d009b98fbd68dab63767567b6b22864d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948271, "uuid": "41b2ed84-a759-4d7d-b2ae-6e8f69d9d65a", "comment": "Malware payload (Formbook)", "value": "34105be29f430e948aa05485393f7defb381f307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948271, "uuid": "1d52d13e-7f84-4725-b51d-b16b826b801d", "comment": "Malware payload (Formbook)", "value": "a58b19bcc2c95598bf8a2766441d3f392ff4a21dcee6c716d80af47342fe4c30bb73af0b2894228b2479e26a9fa379ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948271, "uuid": "8c12dca1-6364-45cd-af9d-e6f8d42b7ce2", "value": "T1D894AE18D5485ED6D202B278E4FCFB1D46108FA6722EAB48D671BD4278327CF7426D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948271, "uuid": "f0334fa7-e361-46a8-b6d8-6fa9e400865e", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948271, "uuid": "aaf974a9-6acb-4869-976e-8410f451732f", "value": "6144:FweEwTKu1gRtv6cWGq9Ye/LydbuHfH+kIkC6uQPQVTMe8jL/MqEC7wkyeeyuU9zO:Mv6cxqye/LqUzIkC/aQBMH7wkfeU9H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948271, "uuid": "872ee7b6-0b83-434a-bb64-7b2ad823b253", "value": 417123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948271, "uuid": "5200d5f4-5789-404a-80e9-96f7dea6b6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948271, "uuid": "351c0251-9e2a-434d-bdd4-f761893840a2", "value": "DHL Consignment Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6605bd-5704-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666991120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991120, "uuid": "3022a745-1bc6-46df-8bd6-52d551321ab4", "comment": "Malware payload (RedLineStealer)", "value": "ebfa4145bcb918c642a8b3777a68e76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991120, "uuid": "056c0c13-08f4-4184-a4e4-2cc6246dc0c8", "comment": "Malware payload (RedLineStealer)", "value": "1d43def9cdf81d689d8de4b6512cd596a0f7958c162bb545c20328fdad42e40b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991120, "uuid": "1186ded5-c4e5-44f8-a999-2d75844e76ea", "comment": "Malware payload (RedLineStealer)", "value": "2bc8d1a03de4a47c3ccf6e4871cb0cc2f8b5fbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991120, "uuid": "d44f08f8-0162-413f-a317-221d5a69d37c", "comment": "Malware payload (RedLineStealer)", "value": "d0163697f1132dc026990a994595cd511103c491ec6724b53d6811589c30d929b7ffa82f536293c2ed90c387f04b08a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991120, "uuid": "daf5d14f-3b0b-4042-8aa4-ce1d4b522d5e", "value": "T14384E17179C0D032D08605348826CFF5A93EFD746DA58A8777943B6ABE323C16A6631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991120, "uuid": "ed5f2cb6-54ec-4c34-8883-fd586a495eaa", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991120, "uuid": "6687a4c7-9e78-4261-83c3-5e29594cd427", "value": "6144:ctBcdnLoxvKzaU/5zxRyGhxUUt868bh1Tw:IBCsxizr/5PyGha/b0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666991120, "uuid": "2968d60d-97c3-4f74-8403-7b792af2c9d6", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666991120, "uuid": "52b84699-e9c5-4e77-819e-78c0446bf0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991120, "uuid": "bb7bfc11-29e6-44f5-9532-25bc0d300682", "value": "ebfa4145bcb918c642a8b3777a68e76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58fc05c-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666959086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959086, "uuid": "c6b788d2-a8b0-40f0-8c72-b6db1e0a2361", "comment": "Malware payload", "value": "ae59e82ddd8d9840b79bfddbe4034462", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959086, "uuid": "c2dea3ab-38da-48cf-b67c-fe0107283107", "comment": "Malware payload", "value": "1d8596310e2ea54b1bf5df1f82573c0a8af68ed4da1baf305bcfdeaf7cbf0061", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959086, "uuid": "8af60485-b2a8-41dc-9ae0-f5276ae8999b", "comment": "Malware payload", "value": "cf1f380d736c035793581d87868952efe789520a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959086, "uuid": "1b268c8c-b4af-4303-82f6-cbbf4ccba374", "comment": "Malware payload", "value": "24201ce74ba795a94779bfe5a86e58fa27d9c8097a36c500e452cfb00d9c1a6377b0f43769818541135ca7ad15ac801d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959086, "uuid": "a9845bd6-524e-4163-8d69-4903bd5954b1", "value": "T1C072AF3CD500A816CA67097DE44A127DF1500528F67096FB3B60E7EDE9905EF0F9578D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959086, "uuid": "e833d0e8-522b-48c6-b48d-1e1cec28aca5", "value": "192:HN/Bz3H9tQe1gfqpbiyG9zNxtpgoZ22NNaOHbOCKIutlDft5VOfoAd:t/1NtzgfqpuyG9zNxt/ZtNN1bVwfFYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959086, "uuid": "01f1c262-3595-4e35-8c9b-8d0ee4224b1c", "value": 17019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959086, "uuid": "0e9ebe74-5d6f-4006-b2b7-9544369c77da", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959086, "uuid": "7d7df236-8b0a-4b70-b16d-5dfcb8be8207", "value": "v5sqpe.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc328a3-56cb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666966696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966696, "uuid": "8235cab0-4591-415d-8501-d1dda8d30ebb", "comment": "Malware payload (RedLineStealer)", "value": "a1546bec2896e409a009188d8ad15530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966696, "uuid": "4b1e17ae-6f10-45ae-bada-a234da568a6d", "comment": "Malware payload (RedLineStealer)", "value": "1db704f3f9fe100025e28edf65664262a7c3a75d8bd302bd2c4ab2d73cc53be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966696, "uuid": "391263aa-b34e-43ce-bb4d-1f54ae626eac", "comment": "Malware payload (RedLineStealer)", "value": "fd96f55629b15afb6bd855852fa397a4a25251a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966696, "uuid": "5293c599-e13d-42e7-9f0c-6a83d96c5c22", "comment": "Malware payload (RedLineStealer)", "value": "cd2d11f89392326b742f35764c57d3fde4b3f99b4a679262881b7180d889cf2b5baa545a243e85fc4b6b7bb95234d377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966696, "uuid": "f3d9d7e5-0a60-4fc8-b520-96e460508000", "value": "T122B5BF3AE74614B4D76357B1C28EFE77DB44B6348022AE3FFB46EA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966696, "uuid": "275a0b6e-c7de-4770-ba2c-f20ac54197f0", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966696, "uuid": "3dcc1cbc-7f06-48c9-b16a-f5d74c8dcead", "value": "49152:qytRi/S6AJ9fcSPi/CTFOoARtzvKD5huxmYpLgfW4kOwhfqcb9:qytRi/S6AJ9fcGi/EYUg4kOwkc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966696, "uuid": "ec0ba521-0da8-4e7c-961f-38b497407e13", "value": 2443264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966696, "uuid": "a19e7ae0-0a71-4b7c-91d6-515ab17c9b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966696, "uuid": "372afa50-5ec8-4f8a-8bd7-f982b846a63d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c1618a-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666963589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963589, "uuid": "39faad6c-0eac-4294-a12b-59c23ced6359", "comment": "Malware payload", "value": "e397d187fbe9f4f91f68aba076e6eeec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963589, "uuid": "087ed875-7063-423e-b6f2-6587d2bf9c78", "comment": "Malware payload", "value": "1dc0c72ff2bfbbfed6c5d294614863aaac5b42f41f3cec7ad54891324494f74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963589, "uuid": "7acb013e-29de-4334-920f-56aaed99b893", "comment": "Malware payload", "value": "3e32e7cae1c56ca6a3bd0229d1e11f9c2ffa6479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963589, "uuid": "551a3274-6145-4829-8ca5-3d0d9379be2c", "comment": "Malware payload", "value": "1d0374bd2e34248f33bfd8b2b1f9f25c771ed30af39adcb2371517650287248cbe7f1212ac309baca74d364f42d8251c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963589, "uuid": "23e97568-1787-40d4-b717-193efaae2be0", "value": "T11F76333AAB564A62C8353BFB8853268437F1E0D35731FB572EFA49E250675649F3A300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963589, "uuid": "899860a6-3181-45c1-a6ad-73486d7797d5", "value": "196608:SBIKt5r2sFROeLQAdNpj6C/84LUW1AvD1pGpLTD:sIYXCAxj65W1uD1pg3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963589, "uuid": "57c90b85-6097-48b8-858b-bf2c0855f09e", "value": 7405104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963589, "uuid": "9dd340a8-bf51-4ee0-a5ff-4054b137f0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963589, "uuid": "2542117c-f6d0-4a8d-b6f1-b96cb79c3c67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745c51c5-56a9-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666952132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952132, "uuid": "a6893ec1-2729-4f47-a2d0-66b028626524", "comment": "Malware payload (AgentTesla)", "value": "86db54dd886eed99e089595223c68b73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952132, "uuid": "4387412f-1212-4e6f-9652-ea04338fc21c", "comment": "Malware payload (AgentTesla)", "value": "1e42fd63db40762ce5c2e456c38bf6d57801d2ba894dcecdfdde4e69ed35f49c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952132, "uuid": "aa2f5010-e5e5-46e8-a430-8705dedcfee4", "comment": "Malware payload (AgentTesla)", "value": "9251e0eb8e3495e1b77c1ed02b062246040a0fa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952132, "uuid": "f0c19468-b74c-4f22-aa71-aaa78fc9b914", "comment": "Malware payload (AgentTesla)", "value": "6b9d4af077df9997561a6b0c40b32a917a3edc372b77bb2d4fcf9f8a092536e6e7e9deb950857c879a581b25119205e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952132, "uuid": "ac7d6c95-29d7-4308-b28f-89ad85ac97f7", "value": "T1F20501BE719B8F03C3A85B3AC4D2630013A9D6868277F71B696811E94C437F3F9869D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952132, "uuid": "60374d50-89f4-4c21-a3ae-f333b172edae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952132, "uuid": "01bc6dde-f14d-410d-a2ed-8c9667799f5f", "value": "24576:paP69gyR0kePEWIVSCQyAc0W8GorX3g39:Ei9Ukg8SCQyAc0W8Gob3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952132, "uuid": "86aadfb1-a93a-459c-9cb8-1d11a3115da2", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952132, "uuid": "4cc28e3c-f12d-425b-93bf-294ced5bf669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952132, "uuid": "cd40a4a4-9dc7-467d-9d41-bb9938355cea", "value": "86db54dd886eed99e089595223c68b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4566e3ee-56fe-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666988560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988560, "uuid": "8ba9d20f-61c3-4dd6-85e1-8d8ae8898da1", "comment": "Malware payload", "value": "0b019c1529e5c72f0e1869f7dd05b341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988560, "uuid": "55d496a3-d32a-4570-848a-80532632c4a7", "comment": "Malware payload", "value": "1e6646402d0a8bebe62690184c3cbb96d0e74f11c2a0be3eefa462fb94caa104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988560, "uuid": "303a8b5c-d811-48c1-9367-966a3a83d91c", "comment": "Malware payload", "value": "8c80c5d1d6b131b8d19351476f644fccc0e37d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988560, "uuid": "09185860-4d50-4b59-89f9-b35267c91c77", "comment": "Malware payload", "value": "be888d0f56391a37c2e76d388b7be97bfcefe209eaf3c5281c64014e4f0da95f8aced40d7f5311eb4bb2455b7e2b59cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988560, "uuid": "022c914f-28d1-4999-b6a6-89696687e2f4", "value": "T1F5E40C3E2CBE223795A4C6A9CFC58867F444E1B731226D36A4D397898347D8329C717E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988560, "uuid": "aa89cc1c-ed05-4a82-be29-c6e87dda880d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988560, "uuid": "c5145c9c-8e79-4029-b2d2-e8403971c051", "value": "3072:wLKlIqga1BhRoUdIj9LuTvSj9tCT0GVfaw3V9f6EuQEXQu/5W00yfw+gesas9OQD:EKZ/hRoju2nq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988560, "uuid": "950085b5-a309-40cd-9a39-6abda300c5cb", "value": 662648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988560, "uuid": "b2dfe5bd-afd2-44f7-a894-98c3712c4cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988560, "uuid": "ee800cf1-a3c2-478b-9f72-9f6dd94a6480", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68908062-5690-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666941374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941374, "uuid": "942f50a4-591d-43e5-b1f3-48e82b1a31f9", "comment": "Malware payload (ArkeiStealer)", "value": "4ee1469f7e23dab24cec9f5e33f4412a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941374, "uuid": "7fbeeb98-9361-4729-b37f-da389fe22d1b", "comment": "Malware payload (ArkeiStealer)", "value": "1eccbdefba2e01b0f5b470d3881f7dc3b3c488d42f5ddbb7c72474dd11a011cb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941374, "uuid": "091c001b-b89a-47d0-9e75-9364c64becfc", "comment": "Malware payload (ArkeiStealer)", "value": "3e0e749ef2bb6c5cb02ae78d9493f17bffd9b734", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941374, "uuid": "d4bc8e92-4bc9-4363-b202-d016d0a2991b", "comment": "Malware payload (ArkeiStealer)", "value": "89cce0cc70e70ba0d8bd692726ab1199aeff1e92f947b2be0530bf764699519a3e81a3c1b0f988f7a7ebfb1fbeaa250c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941374, "uuid": "670a3c26-821e-4f36-89f3-6019b59c9bd9", "value": "T185C46A67AF42975BC3536876809DB6B116123FB656554472732C3BECEB388E28D22F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941374, "uuid": "9117890f-60c8-4b6f-b05f-11b9e91eaac4", "value": "2ca51081a11403485c51b862a1f5baa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941374, "uuid": "af0cab5c-800c-43e1-86be-fe4039f2f4a6", "value": "12288:PNv1HWSpJ6N+ewwhCyxXjYEH3ndTRD7Mhc0ZdQtPqnAFu6:Px12c6UeKyF0E3zvwHPQwnAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941374, "uuid": "22c4859d-2fc2-41e0-bcac-87ce525e3938", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941374, "uuid": "0b822332-a8f8-473a-ad28-3b4d2ef74dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941374, "uuid": "949ea58f-daf4-48eb-92dd-f9b241139722", "value": "4ee1469f7e23dab24cec9f5e33f4412a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70237fae-56ec-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666980901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980901, "uuid": "09ff1ed5-fb62-488d-8e80-fce64e73c3fa", "comment": "Malware payload (GuLoader)", "value": "b99f3ce9e314b3e7af4b8ddd20ca872b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980901, "uuid": "18653261-8e4c-4bac-b179-3225ee80bbb9", "comment": "Malware payload (GuLoader)", "value": "1f35fd4ea91f8aba06ff3b79c5af37e2ee5ad8456605522dadea676c10258038", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980901, "uuid": "f43a949e-adda-4957-b606-9ffada6ee1cf", "comment": "Malware payload (GuLoader)", "value": "808695638dcdba088a2755534d167fcd443b907d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980901, "uuid": "f5241505-d126-4e03-a9cc-1191812fbdb8", "comment": "Malware payload (GuLoader)", "value": "158f114366d0a19e36f67846313af7f69cf66759b1cfb419048bc393ebb0f4fe5464cfe6ddbc7ac30e9f24249f9ef44b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980901, "uuid": "7068065d-5253-4404-a664-00a5737626be", "value": "T1BB15D1C6CB5B0CEBC6683FF814C70E051C500E7AE46946877EB0551E928DAD6246AFEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980901, "uuid": "0154fc47-e8ce-4584-81ac-ec7ea2137f8a", "value": "24576:5cjNCIdtVK+Z6qgvNfLzG3U3oalgoJ+PPtH22:5cjNCIdK+Z92NfO3U3oalgM+PPtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980901, "uuid": "c384787a-41fe-412b-8615-6cec432d700a", "value": 902219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980901, "uuid": "4e26580e-374e-4911-bada-c0ecea6f9bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980901, "uuid": "22358fb8-315d-4f91-9962-916cb23a8e62", "value": "Allegato__CHIAM_SEMP_C_VAL_T_ME.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aa9ae8-56cb-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666966733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966733, "uuid": "874ec8f7-72a9-4c55-9630-87dac0233ff5", "comment": "Malware payload (Mirai)", "value": "bb16cd1bf734d2cd1fa61114eaa4060b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966733, "uuid": "0977b5fa-b318-4b0f-899f-788b1db3ac69", "comment": "Malware payload (Mirai)", "value": "1ff96f3c45d7df4a724131665e1932a394a14aa29fe582400e1b4cb3fbfa82c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966733, "uuid": "3dab7283-1f7d-449a-816f-59c03f67f1f0", "comment": "Malware payload (Mirai)", "value": "b4e397dd0e1c525607648de9e71198f787b851f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966733, "uuid": "21f005f6-5df2-4d0f-800d-0237bd509947", "comment": "Malware payload (Mirai)", "value": "f326404ed073af10c74c966a8c720d13e4b3f2feeafef1c21c9e08e6096b221aaf3e6d4113a64f9308cff085a836268a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966733, "uuid": "97e6cb0b-c9d4-4a99-a7d6-3c08237e9a59", "value": "T157331985B8C29A13C5D423BBFB2E41CD372563A8E1EF32079D216F54778A82F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966733, "uuid": "d2331cb4-f28e-4972-9d45-12743be14936", "value": "768:j1q1TI9F5cXTH5rSIRaEkCeu7U7dttjiGxXox3uTcSPXt5F/N+lt1W6P98j3:41890uIRMnu7UzyuTcaXt5FYtr83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966733, "uuid": "36acffc0-a86b-4a79-bc40-808f3c0d2eb4", "value": 52460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966733, "uuid": "b13e0e4a-698e-449a-a19d-1f353c357521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966733, "uuid": "0a944074-a962-4b41-a71c-405bbb8019e7", "value": "bb16cd1bf734d2cd1fa61114eaa4060b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0df1b7-5685-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666936867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936867, "uuid": "fe475199-5038-42e6-87ee-82f1bbcc4f93", "comment": "Malware payload (GCleaner)", "value": "c12e3fae771262c8bce0c646e47392c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936867, "uuid": "0eb9683f-99d4-4bb7-ba7d-95f989325b56", "comment": "Malware payload (GCleaner)", "value": "20afe07db7614734a57fb3acaf747d9dab71509ea9f68d867ec2b49d2177d303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936867, "uuid": "8412e2df-fd33-4b0c-92cd-593a88e6cd38", "comment": "Malware payload (GCleaner)", "value": "0792d9d4eba182e1c7dbfcb192713c86e5e2b9ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936867, "uuid": "34e842b8-3082-46c2-963b-cb2d2a1bd71c", "comment": "Malware payload (GCleaner)", "value": "d351405c77981bfa20315b6742e571df72ed8d44403e8b6b8dfcef57167adecfb8657098424cfdf1aefca210949f4e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936867, "uuid": "02305098-6c07-4fb7-bed5-12fd3654c900", "value": "T137C53303D76B4EB6C5A7ABB5CDB9C125CA33FC6044F2D825864C488E827F9E74B05792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936867, "uuid": "0fe257bb-eb88-4b31-887d-0fe40c3b8eb4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936867, "uuid": "aa2b32e2-c9d4-4bdc-a8a6-b1864c4dbf5c", "value": "49152:Z284uZobPrrNlpiUDpuIhbLVK7YfNZ7BbbyVxCHlAyDA5hq:M8BmbjEUD/KUNZVPdHmykDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666936867, "uuid": "89f6454b-1847-4b14-ae23-17714f8adf1c", "value": 2608525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666936867, "uuid": "b711c26f-265c-4224-8d53-377e3e4d1dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936867, "uuid": "85edc0ae-ebc5-42ec-bc4c-36d7234398fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfeb802-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666937652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937652, "uuid": "186c5733-147c-4320-b37c-91779e351569", "comment": "Malware payload (Formbook)", "value": "49b3d1037c136b42c6495c99643efdf2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937652, "uuid": "8f9837fb-f988-428d-bd38-3c147953bd30", "comment": "Malware payload (Formbook)", "value": "216bca29b24592d5bd9bc190cbd8a31bdfa7b21535e3c9a6f15495d7af5246bd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937652, "uuid": "05273ff4-b982-495b-868b-19af1117eb8c", "comment": "Malware payload (Formbook)", "value": "ed0e990d89aa7ed0fdf9d0a54aa42e94dad553e1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937652, "uuid": "c441524e-5269-4805-9fe5-83288b040550", "comment": "Malware payload (Formbook)", "value": "763709275ddb1de9402746493fc3c0a5ed452b5d74206eda4e653d4929944b84dd630137a54397a22333deb3141e5c58", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937652, "uuid": "e02ec429-d5e4-42e1-9769-ca6bd9249a87", "value": "T1FF628D75194C197BD2D3C816F3F5BDB452A2F0AFC2CB2A55426EE7F409E2700876684E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937652, "uuid": "5c6f0fbd-33f8-4ab2-a69b-34cc556a3d31", "value": "192:b9o6XAb+DciWHpteJVPIoSKoCVMCBT2+OCyhI0J8X7O5mSlEc:u2iiwpoJVPIoSKfZTxOCyJ/mNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937652, "uuid": "58b37fb4-ac34-4fa4-9fa4-067045857a3a", "value": 15435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937652, "uuid": "53c263ee-552c-4128-8963-8030600220a4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937652, "uuid": "a40afa66-9b7f-4356-8bb4-72ee38dd79df", "value": "inv_221027.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd2e462-56be-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666961167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961167, "uuid": "3c757989-cafd-4c57-ae98-c75df0f3b58e", "comment": "Malware payload (GCleaner)", "value": "859f77a52d879bc53e7035165b9437da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961167, "uuid": "219d8190-af6d-48cc-bb34-6d4ecc66ecbd", "comment": "Malware payload (GCleaner)", "value": "21ed32bec41fe5cd08b560a5199933fbb2794c318395b4ee12a7aeb068ab1ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961167, "uuid": "545ea50b-6e69-451a-9d5a-f6ea0ba97ead", "comment": "Malware payload (GCleaner)", "value": "16c9bc2dfbc09417fd698455cd4ca215f8c4cf34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961167, "uuid": "0db094f3-5ba1-457e-9f83-5ab8539d43a4", "comment": "Malware payload (GCleaner)", "value": "d41b440ed591ea170ad183139917d3f0e4e0e6e4b294668db1bda07b2d2fd80b4fe10bea8efc26c10d3a04040e6e2d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961167, "uuid": "175923a6-713e-4250-9258-060cd7e6b31a", "value": "T147B53312D7CDD231D112D170EDAA9D30C13E2D49156DE8A5AEAC66FA6F324C2CC1E72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961167, "uuid": "3ce33219-14b4-45cc-94bf-523f10d0eca5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961167, "uuid": "b1c21b61-fe3f-4307-bed2-c619fd6cfb56", "value": "49152:Z2sQQoEnLyErzHRN8u/O7sMKqHOyAKOwiwrslb7FiJPFXM/berQA5hq:MKoEnLysx5O7sM/DAKO4s6J94berPDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666961167, "uuid": "e842b5a5-b980-47eb-bb67-9993ff4d6bd8", "value": 2425330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666961167, "uuid": "a9efa55e-991c-47d5-810a-69cf6bcb03a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961167, "uuid": "5121eb0d-d638-462b-9ac6-b52ef4d2bd27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46300153-5675-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666929720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929720, "uuid": "0b8f7924-8af8-473d-bab1-ccee2ba9c106", "comment": "Malware payload (GCleaner)", "value": "5756090d33e6337251f6fca963597e48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929720, "uuid": "d345fec9-6fc1-4863-a420-ea582f4c6471", "comment": "Malware payload (GCleaner)", "value": "2231948817dc555fc0cfcb63a3e9f357c5fca544d28c4fcf9696137d1be56f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929720, "uuid": "50b99951-c3bd-4f33-90a6-4ee240749b57", "comment": "Malware payload (GCleaner)", "value": "2ddb0432065eeefed8735584e97c654a3a38faf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929720, "uuid": "a11517fb-b708-4628-846e-41cb3082c8fd", "comment": "Malware payload (GCleaner)", "value": "f7a2d23e42ea189079ea09dc0a0472d46f0983daa3facc4e0bfeda777e9f5c1720b813a69f0025b241d6fe6adf06d723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929720, "uuid": "ec2ad68c-17cb-47f1-9135-3c9b165d2cc2", "value": "T114C533412BD595F1C621CEBDBCB3CA10CC3BBC506D749898252CAC9E98635D7841F7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929720, "uuid": "b8207073-ae92-429c-883f-46792e8fa840", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929720, "uuid": "849d09c6-afd5-4c1e-8686-9516c06ee734", "value": "49152:Z2hQumgi4wY6eHMCLgrnnbHs+NPS62IMzQkVmSOVfDUO1C/e2vKY6VtZaeA5hq:MhhmxY6dCgrnnLs+NPS62IMz9VmjzYeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666929720, "uuid": "60352766-f109-4b33-ba65-27dbd45a47a6", "value": 2605861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666929720, "uuid": "4a343ba7-87bf-436f-8250-781336dc153e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929720, "uuid": "075ec87e-02ca-4dae-8139-44d23c0e2c3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691b8c71-5671-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666928061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928061, "uuid": "30fa61d8-e0cf-4fb5-a0e9-cd4d652bd4f9", "comment": "Malware payload", "value": "0d406739d2347f98f3df4dcd439cc405", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928061, "uuid": "01d1804f-d4ce-4683-aead-62aa38022f17", "comment": "Malware payload", "value": "2313f133607225819fca669c8adf3d7d0a7b2a6224826d2bd2417e87f727285e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928061, "uuid": "156cc980-e8e5-42f2-be77-a5358ec02cec", "comment": "Malware payload", "value": "0b5d30e69316ca06ca1c9703346c8998e5433a88", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928061, "uuid": "b8338cd9-5f7d-473e-82d7-349b74e67301", "comment": "Malware payload", "value": "481216a94131a891010c47c8425d42da2fa26bc9f39bdd2eec465133c56029fc7b348425412a8a3021825dd8b287f473", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928061, "uuid": "f1d74785-a29b-4bf0-b505-59e7e34805c7", "value": "T1BBE63382F7D9BD2FCC7380324BB5167661864C5ACB13E2436965736C99F7AD08E81BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928061, "uuid": "a58a7733-1132-49d0-96a4-39a03a3a006d", "value": "393216:imaBC9u9O4X9uGtUNCK54bOZkLx0hb2r2fZRpoAf:mBVc4X9uGtUXzset2r2ffp/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666928061, "uuid": "dfb90551-8e81-4ddd-8c78-317466b2dd65", "value": 14004085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666928061, "uuid": "afe6d71f-1aad-4c20-863e-76d833527771", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928061, "uuid": "2033854b-41b6-48eb-8582-f039238018cd", "value": "2313f133607225819fca669c8adf3d7d0a7b2a6224826d2bd2417e87f727285e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d702d21-56fa-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666986748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986748, "uuid": "7f7f9c28-cf51-4562-ac15-463f2cdfbd7c", "comment": "Malware payload (Amadey)", "value": "a34991291f15f1d18aa1e35f773b8eeb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986748, "uuid": "3109e06c-4665-4e02-b97f-7c0c2ba9cb92", "comment": "Malware payload (Amadey)", "value": "2362d77a533e3c791d6c0475886bd2a3ca81180834c99862f3626db1122078d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986748, "uuid": "7d6e3a49-134d-4ac6-942e-d25af086eb74", "comment": "Malware payload (Amadey)", "value": "bc258dad2e91eef2f1d4c7103354b54283f3176d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986748, "uuid": "f37d209e-6d7c-4d6d-9c84-0cc10366093a", "comment": "Malware payload (Amadey)", "value": "5a681140715fc735db0c2ccfa1ee67afeb3c30392dc0027f38d89534d13a28f00a440d7473c589334eec41531fde003a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986748, "uuid": "320614e9-7615-4d5d-b3c2-4e6f0d8647bc", "value": "T17954CF357590CC32F4927530482ACFE1657EFC2119694A8FB6A43B9EBD322C16A7631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986748, "uuid": "e7d6dc65-c896-4a6a-9ce6-ac1a0078a939", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986748, "uuid": "15a6f0b4-3be0-47fc-9a3f-7ec36192d03b", "value": "6144:PsBRjLOc18L+hem/RcP+Cd0L6iq+SNSol9GJ7:kBhKc18iRcJG6ASBMJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666986748, "uuid": "dad97598-d869-46ea-b89f-dc89b5ef6b52", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666986748, "uuid": "99af1d01-d14b-480c-9535-5d2de5e69dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986748, "uuid": "929fd752-6431-4899-a80b-1198748f091d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2e2522-56bc-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666960464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666960464, "uuid": "164b860f-b9c9-445a-b7a2-fc6009d76baa", "comment": "Malware payload (RedLineStealer)", "value": "627c70d1adf3dd95d9cb8cf3050471b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666960464, "uuid": "6c629a30-798f-47fb-aeeb-e214cb7ce428", "comment": "Malware payload (RedLineStealer)", "value": "238b438e31dfba8b3d9b775b175e222104aedb71491e8ead7271f7d5676cc9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666960464, "uuid": "65d0170a-cbbb-401d-a299-26ab312b4d5a", "comment": "Malware payload (RedLineStealer)", "value": "0fe7a09ea4f3c24c8e9b86791bb8e2ba9dc094cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666960464, "uuid": "e0b2fa16-b542-4c08-abbd-5734c14e0033", "comment": "Malware payload (RedLineStealer)", "value": "42f070631a9577e795dae4ebba1f62f694ab6cfea4237c7d298d30e9b152ac6b89fd661170e5a57055936a9d44f5d30a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666960464, "uuid": "d541cdfc-d120-42cd-8835-c445d6460134", "value": "T1D584F136B992C071C5912134442ACFB12ABFBC7116B50A4733E4376EAB713D199BA72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666960464, "uuid": "5ca89dc7-f9ea-4312-ace2-436020394e17", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666960464, "uuid": "702df267-e36a-4b2f-bd18-7d26e1f129f7", "value": "6144:uEHYLDjpebuJgh2vyeR7c2AZkhZxBIJa8OjL1l/dSgtf:uEHYTpiuJQqkKZEa8gX8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666960464, "uuid": "01c1a138-ff1c-4c29-beaf-95db7c7bf475", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666960464, "uuid": "235bc7a9-0c27-4e2a-aa62-6e939550c141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666960464, "uuid": "dd3bdac1-7f3a-4295-9fa8-f4c8f88b275e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098e9960-5677-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666930477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930477, "uuid": "931ec4ad-c29c-428f-af7a-9e255d96b063", "comment": "Malware payload (Tofsee)", "value": "9f97183c49b8835e9b89788493722892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930477, "uuid": "93bb5498-d647-4f2a-9fac-694832e2def0", "comment": "Malware payload (Tofsee)", "value": "23db0a695b205fcd69e20e9c7523e27613441073b794258a9652866468a9f400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930477, "uuid": "dc9a2bad-1cb3-4130-884a-a4921208f4b7", "comment": "Malware payload (Tofsee)", "value": "b3db5467e9b24ee18e1e82c5adbdd5297f212f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930477, "uuid": "b0cccf39-d024-4831-bb1b-b4fbf029d9c0", "comment": "Malware payload (Tofsee)", "value": "a24efd3af55152431c7970a3c79cee51dfe7392630f6ce3ab41510aabe99c033b0d8fecd6bb86a105684719c6a5833f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930477, "uuid": "4a608475-efd9-48ea-a621-25f762468519", "value": "T1CC44CF317681D471C0871130442ADFA12ABEFC31192546B777A4FBBEAE71391A97632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930477, "uuid": "6a5c45ab-f38d-4983-8d22-019701839160", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930477, "uuid": "f5446112-9bb5-445e-8671-698808fd93b4", "value": "6144:/nYOHxL+QnV08uPcPr2ql6F1SFjHYmUcZmjdl:/nYOHxasV3uPchYrSFjYjjdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666930477, "uuid": "73af0a54-9493-4007-bd77-104f041c1c17", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666930477, "uuid": "8e8953f0-36d3-48a0-ad53-b01d054e88d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930477, "uuid": "008d5430-db03-466b-bdb4-29825717dfe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084fe2e6-5663-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666921885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666921885, "uuid": "3ff9b196-b7ce-4304-b998-a15b36c4b8f7", "comment": "Malware payload (RedLineStealer)", "value": "30dffc1a9841a8ff6e8f60b07f089d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666921885, "uuid": "53f355d6-e825-4a34-ba0d-37194c89406e", "comment": "Malware payload (RedLineStealer)", "value": "23e1a029b184306ff6ec614f18b133d285a07be218ac5d811963d0d088bc0825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666921885, "uuid": "34c9fdfb-2bc0-4a7c-836e-4af96ea06189", "comment": "Malware payload (RedLineStealer)", "value": "9aa335a9ed94f5fbee0f2ec4168e36493a8dd303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666921885, "uuid": "67503626-e8ad-4d63-ad19-3ea29b8f4491", "comment": "Malware payload (RedLineStealer)", "value": "72f762da39f62308b8686783d332df309f7b4e2cb50e6d5132ac4bc123f1835b5a5a30a540216fd53deef96e7e64fb78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666921885, "uuid": "0e543626-0544-466d-b3a4-30d130a63e7d", "value": "T10584F131B882C8B1C48521344826EFE51ABEFC7115254A8777A43BEE7E713D26A7721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666921885, "uuid": "0c84129e-23c5-41ed-95e0-53eae3e48212", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666921885, "uuid": "b18c35b2-fd38-464a-908b-2cdfa8238e68", "value": "6144:xAqIck9mWmPjK8GEhCtDB8zKxyegWrTLZ7VT7F4LeS:xAqI1mm8G24DB8Iyegq5TB4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666921885, "uuid": "d86a0835-ceb9-496c-aab0-dbc7531995cc", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666921885, "uuid": "6239ff5e-45ed-4379-8869-6006cc51bbcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666921885, "uuid": "803e037b-c245-4b6a-a3b0-f02f5942211e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7972dcdd-5699-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666945268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945268, "uuid": "a5cc2876-3b3f-48a8-863e-4c23752a0740", "comment": "Malware payload (AgentTesla)", "value": "181010adfb6f847652d9df3afacdc237", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945268, "uuid": "b8b4943d-12b4-4a58-89cb-faa3306f6e68", "comment": "Malware payload (AgentTesla)", "value": "25092c20445f5a74f699abaef01403fc52ecea46769def99c388ecfd7489ae5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945268, "uuid": "e269370c-6559-4098-aa07-df5bfa36996d", "comment": "Malware payload (AgentTesla)", "value": "44a0d526766faa441ee2ef92475d3a35141c0b86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945268, "uuid": "13d7ba08-ce55-44a4-ae8b-dc1979f3922b", "comment": "Malware payload (AgentTesla)", "value": "a574ce007e592dafec48099a7fe4dc6080e441829fa84b4d686e18afcab724b12f1cf843ee53ffe9da8d700a38a82d13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945268, "uuid": "fda6a865-869c-4c40-8062-10fa95f21830", "value": "T1ECF47A35275E4F0BD0DACE34A8B0D5F416635DBBB96ECA81CAD46CF7B4162A46E0C087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945268, "uuid": "58de765e-f710-4197-9662-9ea28d6e1fcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945268, "uuid": "729f378e-ecbb-4759-ba03-467d022bae4d", "value": "6144:U5jWPG0KrdXSVYmEA2JvSGzNIijqQyk2E9GO5H9FD7TdlTqmcq+OhtZG4t/vbyWy:ISxKpaYh1OiXd2ONrD7TmmSqfGcNbmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945268, "uuid": "358bb287-987b-4ea0-b8e2-94bf40d15d33", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945268, "uuid": "a8506835-520b-4341-a3e3-55de67023d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945268, "uuid": "a59890c6-43d0-47bb-9ca0-6e7ee414f9e4", "value": "SecuriteInfo.com.Win32.PWSX-gen.28658.7120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77305657-56c7-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666965021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965021, "uuid": "c893c840-dee3-4a38-8c25-2b9be42c268e", "comment": "Malware payload (Tofsee)", "value": "f0abeedcdbdc16d9bb634be2e5578095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965021, "uuid": "7b8e6fd4-8f9c-4dca-88a8-b33fe6981427", "comment": "Malware payload (Tofsee)", "value": "251eb571cd24b09a456991fbcfc68179a3ce25d0e4c05a2987916c7ae0049cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965021, "uuid": "6bd46c6c-f90d-4f8e-b717-6f782f0910bd", "comment": "Malware payload (Tofsee)", "value": "e01fb3049ab074bfe13f5f7e0cd15d968870fec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965021, "uuid": "3d1423e0-bf36-48b1-b8d7-18e87cc54b21", "comment": "Malware payload (Tofsee)", "value": "4fdcba30145aaf257698b543761d41d43ba9f8438144916329757328dd853de6babbe2d99cf3f0835500a54631172125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965021, "uuid": "725b1b3d-cd80-4ce3-b8f8-9fced973536d", "value": "T15E44E0353A92D4F2F0952230446ACFA05EBEBC315670454777E42B6EAF713D19AAA30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965021, "uuid": "303e3d9c-faf3-4f4b-97c5-b63ad1d88ba7", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965021, "uuid": "bd7b4dc5-5d55-49b3-b395-d1e2101f6a13", "value": "3072:8XOWHrjLGeAYSOXGXmj5Ei4K2Gq8w76zPyMPic9Xs5Sv/U+k+MfEGVM/h3m:4hHnLGPOWXVfGqLkqo9XsmS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666965021, "uuid": "97d8e4f2-af65-4d20-bd63-15e93cf339ca", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666965021, "uuid": "3017fdd8-5b19-42cc-9b7d-f0f3b84cd977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965021, "uuid": "92e8a402-626b-45f2-8c40-4e1eedda664d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03769701-56a1-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666948506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948506, "uuid": "2dd1b267-bbfd-4d21-a533-a573a729a173", "comment": "Malware payload (Amadey)", "value": "4658ba231d95f53c8c041d12e14b94d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948506, "uuid": "37ec97b1-8215-435f-9a39-9e593ff8442e", "comment": "Malware payload (Amadey)", "value": "2640c31d7809b9718a58733c78c2304162fe6eb1dd2ba6199246aea5bb0f56fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948506, "uuid": "324d1995-5459-4936-be11-128adc5736b0", "comment": "Malware payload (Amadey)", "value": "f0d332eda03d507fae634c6fe9acd6343a094697", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948506, "uuid": "87659256-1d9a-476e-910c-83b731d8c9f9", "comment": "Malware payload (Amadey)", "value": "9a50d73fa19954804b5b3a1c82f234d6342364430080eada3a569fc0602570a86b0d285d931ceb531bda042693ee622a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948506, "uuid": "01dde111-ac09-4921-a35e-d29674345b1f", "value": "T1AC54E031F5E1C573C0422530442ACF9129BEB831EA604A8777B4276EAF753D295ABB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948506, "uuid": "3b8d28a4-6f86-49b6-87cf-b292d13f488f", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948506, "uuid": "546404d1-1d0b-4d40-bdc2-23ce9be6fe37", "value": "6144:T+iH/LXs5B3brNgPwzVV1ScjdglxMEERp:T+iH/D6BLpgPwzBScZglxwRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948506, "uuid": "7be9726e-a7a0-4e3b-87ea-0c6da8d4cd41", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948506, "uuid": "02947cf0-8808-47eb-a2e7-43a649ba6665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948506, "uuid": "8a1050c9-7286-4479-8eac-3bdb7fcb6d11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e53ca8d-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666939236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939236, "uuid": "44e3deec-23a4-4555-b091-8ccb90520ce1", "comment": "Malware payload (RedLineStealer)", "value": "fcab3ccd226f4d53841a2c6b0c9602fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939236, "uuid": "15aed54d-92bb-4094-a495-c5b34b9039b1", "comment": "Malware payload (RedLineStealer)", "value": "26acda93bf95c8703b4e1ed5bcb8939f7374d67be7327bd46f20316877b8df51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939236, "uuid": "a491bcb8-faca-4624-a945-a9715ece317b", "comment": "Malware payload (RedLineStealer)", "value": "035c5369203601253c3931d5f1cb7f4593b124c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939236, "uuid": "61e0bad2-3231-4e10-a93f-af1f23a52173", "comment": "Malware payload (RedLineStealer)", "value": "e00744c46e11040dc36df83ad7b3d31ce2fa4b2c737a015d327c108c49c6cb3861ed78ce39f5fad82f84b91ce18354ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939236, "uuid": "cfd1078b-7152-430d-aa55-2692c4a1180d", "value": "T1BE44E015B682F472C4C211308821DBF57A7EBC711625994777A73B2F6FB03D2A67A382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939236, "uuid": "2f32de05-34ad-4d45-9c6c-e5ccd9606ff6", "value": "ff6659a3b7adcc9d3b718a91e331c2a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939236, "uuid": "53066fdd-da33-4880-b4fc-51fc20893623", "value": "3072:P1XOmq+mx5nC00ZN5BtuG4ylbd83uwTf/6g53oAg5T/hPJ187mBP8ccH1Nlkajsp:pFqBfsuG40WewLnsPJ+SCccH1nZ40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939236, "uuid": "8d2e50c1-e515-44f3-958a-9154f586a07b", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939236, "uuid": "3ff3fa72-8395-4a0c-ad20-34d5d7e8c9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939236, "uuid": "3c95d5ed-389d-45b4-804d-b9f2bcb49ddf", "value": "fcab3ccd226f4d53841a2c6b0c9602fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c677b1-5670-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666927671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927671, "uuid": "56115bd8-76ff-467f-a5f4-7b3a6b731e47", "comment": "Malware payload (SnakeKeylogger)", "value": "e0bb2993260d186602bda11a41c49057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927671, "uuid": "90573536-3fdb-4ee8-a326-c9423b2e3cc9", "comment": "Malware payload (SnakeKeylogger)", "value": "27620392f50cf9cdbd25e28d8f37a29d8bb1f4a63f2748eef558c642c5686d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927671, "uuid": "2d246bec-c3c7-4538-9eb7-9333dafb7594", "comment": "Malware payload (SnakeKeylogger)", "value": "272a15a75114dde6aa258525ca2e371a603bf698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927671, "uuid": "ae882d9d-d77b-4c04-9204-87d6ec709108", "comment": "Malware payload (SnakeKeylogger)", "value": "00a771bb0e73862a28c43603c2f5538aa0deb18f94d4185f5ed1b3681c87dea53f240b37bef419d6e03f5c9614d9fb3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927671, "uuid": "29f030d9-3843-4cf2-9a12-9f41c24ec8fe", "value": "T1CBC412B24A509FE2C2C53AF795734BACC27B0D8D6475F457ABA973C8C6B398AC017061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927671, "uuid": "acf4df09-e56a-452f-8571-89fa5c202aa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927671, "uuid": "5960d707-9b07-43c5-a72d-ebe9a6440d35", "value": "12288:Dh7HkV94zOYagg/ZnjnbJFqAOLQUnt6MEyLR:yVOOewBjnNn4t6MEyLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666927671, "uuid": "06fb344f-4a7b-40d2-9400-cbcd88a99012", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666927671, "uuid": "3d120936-869b-4627-ad55-5bfc7787cee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927671, "uuid": "19f7b869-2ecd-498a-9532-a9acdf31dfd9", "value": "SecuriteInfo.com.MSIL.Kryptik.AGWM.tr.8118.7813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c225da-5706-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666992240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992240, "uuid": "81706ce8-da7b-46f6-bd33-1250c8f00b91", "comment": "Malware payload", "value": "b257888923c65703a302c1bce7aad6f8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992240, "uuid": "65140fb5-ab93-499e-ba33-454835d36925", "comment": "Malware payload", "value": "284e130ab05401ac4f07ec862d73f2bac0db95c9660c7806caf697103fea7a11", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992240, "uuid": "8ce61e88-596f-4228-9b41-493893b7b406", "comment": "Malware payload", "value": "355b183f47dd864ea8d6cf6513add4dab00dbd30", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992240, "uuid": "63ebc449-c754-4c69-97dd-a72b0f77fb2d", "comment": "Malware payload", "value": "bfe98f3644c3b037ba1404626e9776ceba653fa4960bdde0e72bf6d0c41951ed38c8880c0c12db07f7a767e26012a8a6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992240, "uuid": "e127897b-5942-4001-b03b-304c29dd9eff", "value": "T186F52313F622986BC8F5D3372124173560779D28DB07BB9A6C18B3BE24B7DC84B856D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992240, "uuid": "0a5bf3d0-304d-43ab-bdb3-a75b38f624cd", "value": "98304:dic6efffnRcj7jGPJqYiwFTuc06jtMPPCUAI9:dfXcXgDiwBuc0pPL19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666992240, "uuid": "2ecb66f4-1b04-4c43-8d90-a104c9fa7da3", "value": 3564453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666992240, "uuid": "66d886b2-565f-4603-82c1-7b1ad034cfe6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992240, "uuid": "8bca6420-3af2-483d-853b-93f47ea98433", "value": "Live sexy_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e90861-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666963566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963566, "uuid": "878649b6-b47a-444b-a5e8-74c395355656", "comment": "Malware payload (RecordBreaker)", "value": "ea4aca43d2bd6657beacbcb4fa86531e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963566, "uuid": "41bc4de2-d258-4c87-a4ae-428f3aad6ac3", "comment": "Malware payload (RecordBreaker)", "value": "28c1edc4fa9f29fde994540cd25402fd47d46404eb1ebbfc0fc0a245bf03bd04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963566, "uuid": "c59b5ae5-6bbd-4188-8d7d-a0791cd4fd12", "comment": "Malware payload (RecordBreaker)", "value": "6346de8a68910ffda532d3bec4fa787bca2b7805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963566, "uuid": "88d7e437-83a7-43e2-99e0-07432a0efc0a", "comment": "Malware payload (RecordBreaker)", "value": "b8147b01dfc4e10a2f72cc26e76bc5458bc2f150ac4a41f6bd033d1302187f901a3bc186d52c3c6d3c8ea53c8c635a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963566, "uuid": "ccd0ca81-44cf-4ef4-b0bc-662087c5b59d", "value": "T18E66F132716832CEF9F798B5411F686826B31FB705ADBE3D249677B01A61371F102E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963566, "uuid": "c2952166-44d4-4484-a619-c2d296092d65", "value": "b5af53b96a03972def1a5f287c0c1d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963566, "uuid": "af49ac0d-2662-4d30-aaaa-a6f2d649a6aa", "value": "98304:fH84nlR1uY7axigxCJLuqUF/kSC60qxF/D11rJ9QEQAors60bfQZgiMFZWk72vA:fLR1t7XmCJChsQ/BZID14dr12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963566, "uuid": "9191042d-61e3-4ed2-a47b-1bbb82612d6b", "value": 6594048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963566, "uuid": "4bcd78ac-bfa6-406b-b03f-ee7688c5aba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963566, "uuid": "305e785a-282a-43d5-b266-3da2c3f4a689", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23f0c0c-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666949712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949712, "uuid": "b03e830e-936d-4342-8352-9d393a60cd84", "comment": "Malware payload (Tofsee)", "value": "fff0aff8f00e0362cf3c1c1e32a2a4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949712, "uuid": "f85fcd4e-7ed8-43fa-9cfc-d4b01f44203e", "comment": "Malware payload (Tofsee)", "value": "294836bf0f547acdab9b319b9e93ebc4eac8ad19587400eaa08d79ddcd1b5f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949712, "uuid": "4d96b445-ada4-4aa2-a925-90ab5cc2fef9", "comment": "Malware payload (Tofsee)", "value": "b0c75795feed5a44286a69b4cac8c7ba1d002c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949712, "uuid": "254cde6c-ab41-4168-99d1-79bc7fedb359", "comment": "Malware payload (Tofsee)", "value": "caae7d6cba94d70c8d3787c0e91766ab721943717a2d9e02f1d12d280669b5a7e4d21b08df638aae182ec5ed4f00dd73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949712, "uuid": "5b3ecd88-6478-4dd9-be9a-950bb7e766aa", "value": "T10544BF31BE92C472C481E130442ADFA0EEBEB83119654A5733A426DD9FF1391966E3DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949712, "uuid": "fd12b7b0-15bb-411a-97c8-740837ef3335", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949712, "uuid": "86e00918-589e-4a41-8db4-6b45a8b28238", "value": "6144:43SHYLR3oYJCrNIqISqDbV1ySSxVE62zbp:43SHYF4YYpeSqDbVAlxf2zbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949712, "uuid": "b2ce01cf-745f-4f59-8450-79ce43ecb991", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949712, "uuid": "ea091b02-55af-4a1d-a984-674b5d9bab76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949712, "uuid": "b97b6371-1dce-4ee7-87e0-e1a79a87c41d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b728332-567b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666932252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932252, "uuid": "c77c4b0e-f499-4be6-910d-05e9fa92ff01", "comment": "Malware payload (GCleaner)", "value": "dd0ca0a8da1c8fb72b1ad80dc78c3ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932252, "uuid": "9290bc3e-138d-4515-8ccc-6fa471f9458b", "comment": "Malware payload (GCleaner)", "value": "29819b55e60be88f80f634504f1981e9a6694aa8c8c9d190f6d7b539a292e7e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932252, "uuid": "31bc644a-11cd-4c35-9f51-c59bb0c3a5ae", "comment": "Malware payload (GCleaner)", "value": "616f2bc9d06cbd7a1a1a88298c7eb71ec1d67a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932252, "uuid": "f56b4fc3-0ace-4da9-a998-f402162d5603", "comment": "Malware payload (GCleaner)", "value": "3d5c5895fced15f688bcafe49d52b6fc165265f45303dd441411c6adff040b8b2c81c47c3f39951ec92f836880734097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932252, "uuid": "10c82539-87e0-4757-8a1b-5a5471ec15a1", "value": "T1D174DF623892D870C49525308836DFA02ABFEC7514144A43B7F83B9DEEB27D1667639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932252, "uuid": "dc1fd84f-f7cc-488c-85bf-c59b4e33b0e7", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932252, "uuid": "016e9098-65e2-45f5-8425-364a1171a691", "value": "6144:gk4KHPL+kIvbbucJ+pjzqyYf58JsUQ5xetReNfCTj:gk4KHPKHvnucJuBo0sv5xetiqTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666932252, "uuid": "e0c01958-cda4-4b0c-92be-48dc6b6942bd", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666932252, "uuid": "8c387b81-f96a-40aa-9ede-3605ae8f3c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932252, "uuid": "66d0f85d-b152-4b40-9b94-6ebf90724d35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c5110a-56f2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666983700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983700, "uuid": "35e31134-859d-431b-b397-fb94eed9a41e", "comment": "Malware payload", "value": "d6e9e86e003086022805cd59d1a406bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983700, "uuid": "fdd35cd8-e6cc-4675-b235-ac5f236dc103", "comment": "Malware payload", "value": "29a808de2d82612a27d0ffb5a6505a90e0884d8ea332a282847d7da04f52b5f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983700, "uuid": "e1edf599-addf-47ec-bdce-ca310ec5cc34", "comment": "Malware payload", "value": "514a4aaa1d1a0577fb1f84ff5d36cba8ea9619ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983700, "uuid": "d295c41b-41cf-4ecd-84d9-569e360b1453", "comment": "Malware payload", "value": "e9ff1c1fc64e5aae200c49c4073dfd620279b82b833a0ce047d8d4be569aaabadeb922446cf7133a9adb5ab145577be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983700, "uuid": "bf6c4108-8dae-449c-ad82-e5d90de0a38e", "value": "T13C055082EA7C9103EC571D314EA387C98E1EFD90BE3870476A65B31E073E9D65E69243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983700, "uuid": "915950d6-cd61-4c47-a681-2ef49c7177e6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983700, "uuid": "cb48cb6c-7f93-4fbb-8f6f-18d53919a941", "value": "1536:Wrae78zjORCDGwfdCSog01313os5gP2DKPJY8rPf128M+ZtgTr2u92PUmqIf0O0Q:uahKyd2n31x5BuIZ7T9vGPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983700, "uuid": "7e69ae9e-c73c-43d7-9062-09a700fba291", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983700, "uuid": "019326c8-3a73-46ef-96d2-57e41a46ce85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983700, "uuid": "e1554867-a798-47ba-92b9-01247351e6b4", "value": "d6e9e86e003086022805cd59d1a406bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022255c6-5678-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666930895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930895, "uuid": "91a98954-d15a-4a13-9791-d41fcef58e26", "comment": "Malware payload (CoinMiner)", "value": "ef4dcd89c8f7d060afcec22e089a4791", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930895, "uuid": "33dc5630-6b0c-49d0-9e2f-da2e2477e56b", "comment": "Malware payload (CoinMiner)", "value": "2a51ccfe1a1711c364feeb88654d3f3a36216758e1a2d822748ba490b208c01e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930895, "uuid": "9acd704c-8326-45d6-ac59-a8f52393db6e", "comment": "Malware payload (CoinMiner)", "value": "8679d9beec94de7c3c5258569e9be75866084ec0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930895, "uuid": "8217fc34-e14d-4dfb-a30b-838c3e79e4f3", "comment": "Malware payload (CoinMiner)", "value": "375a18f4ea284093f1f628710e94f113faef02411d5e790c6b337d3e9ac306508c083865b280e82945606b43bda82eaa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930895, "uuid": "63a985ec-5972-4cc8-8328-859b7f2680eb", "value": "T1C344C032B991D871C0861530443ACFE029BEBC3119645B9777A43B9EBE713D1A6B235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930895, "uuid": "1a4f921e-c29c-49d2-8648-1d8ac4c1e945", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930895, "uuid": "e100b205-dff8-4d41-adf4-7440ee15d9e7", "value": "3072:rmQXOmHrGLo+fOA4egEGPfmlk5H9pUZA/cKosJYmdIfeRcQUQLYCg2VFaS7TM/hD:yE5HiL1fzgPPu2n/dlIfZQRfTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666930895, "uuid": "e6fed0fe-900d-4345-875e-774bf304fb33", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666930895, "uuid": "361f3853-a7c7-4fe0-9aab-1cb3a02819c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930895, "uuid": "868a4727-90c1-4a66-9ac3-8e3668ce114e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f640ac-569c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666946655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946655, "uuid": "1a65bad0-ba03-408f-a4bc-0bcce039c6bd", "comment": "Malware payload (AgentTesla)", "value": "73b0ba649f15d5d399690eb45bf0a15e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946655, "uuid": "382b86d3-7c64-4699-a3e4-df577038f06a", "comment": "Malware payload (AgentTesla)", "value": "2a5dd17e5e21e61937f6cda6865aec8f16d8ad250d0fd6187f4c771b09f6af1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946655, "uuid": "9660b78f-0c37-4116-b026-3cacdb99ea3b", "comment": "Malware payload (AgentTesla)", "value": "2592314020dbb378c40b5e75892e2bb74da8171b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946655, "uuid": "d2f0909d-5c4c-41fd-9f01-ec0b8b2dc255", "comment": "Malware payload (AgentTesla)", "value": "faca2ddf19f9ca836392a2038fc9ea92d7ede9bd28823bfb9f24c2e3c5b65fd28ad461290e27319aa93b5a8643d0ce9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946655, "uuid": "8bf00abd-230d-4dd8-925f-ccfffa9257f1", "value": "T1F364235B30AFF099F68C39C15744EEFF374911282593024AAA14A5F69225A70F3FF495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946655, "uuid": "6ca6510b-9b28-4310-b048-b710e7de4594", "value": "6144:X/4k+ErJyv00reZKtAEhefxUN8q56qsdpVSs6I6T3x5N0N3ZQKLmUxBFuSqM:XgHKyM0aZgNuUt56qs4s6b3ymmmUXFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666946655, "uuid": "b925841e-ad5e-4719-b3ba-abc9ebe95717", "value": 307375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666946655, "uuid": "a7ff470e-e50c-40ad-b297-e8701a641093", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946655, "uuid": "4253ee4a-9384-4ac9-b555-c19f9bc55b35", "value": "Remittance Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67e9e71-56c1-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666962550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962550, "uuid": "8805b116-c6c0-40c9-a479-1fb3b1c8ab33", "comment": "Malware payload (Formbook)", "value": "eee471264f9991994b48945a20235a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962550, "uuid": "afb0b5b6-dd0d-4f72-93a5-4e1d8abf91f8", "comment": "Malware payload (Formbook)", "value": "2abbedbc89da0e61258b519427e7e505aa3cb21c3b76f43617299d04356a4b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962550, "uuid": "e241c11f-9bfc-4b2f-94a3-5c3aac36944e", "comment": "Malware payload (Formbook)", "value": "9775bcb7bb29615601123d7a30a518dede380d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962550, "uuid": "00133d4b-c6d1-4def-ac4e-2dc9f52ce7df", "comment": "Malware payload (Formbook)", "value": "8ff2b1d676fc9764315ffa8fd66adea36b8b466565ed66468192428028a8d1f7ec9274b5b84bef1483eada840dbcd824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962550, "uuid": "73acdad8-b359-4af3-be44-c5421c59df7a", "value": "T1EB34020263E18F7BEA5F133058B6AB9AD9778D152C55A3CF53342F273871A83A4152E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962550, "uuid": "fc4f9337-2d32-4553-b506-7df26bc41f41", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962550, "uuid": "68f13d6b-d285-44be-9473-d0da08039f19", "value": "6144:PweEsfYFjjNQn/a85dxem89WdOv7gU6yOESGXFHkgv:fKSn/aN0SPJfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962550, "uuid": "4c10de6e-8d71-4951-83d3-8cb97257bb6f", "value": 246603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962550, "uuid": "6215d0b4-39af-4291-849c-7c7d666da1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962550, "uuid": "0ca06c8a-ecdc-45f6-b38a-20188b26b328", "value": "f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d5304e-571c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1667001389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1667001389, "uuid": "942897b6-7d4d-4715-9084-5e4d79a6b280", "comment": "Malware payload", "value": "0715f220c8a8bd2fc36acddd65220167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1667001389, "uuid": "ff1df23c-6473-4eb5-98c1-924bbd6cbe6a", "comment": "Malware payload", "value": "2b651d2032c30cd22ccaa07268faf17c2822094a4cd0823c914a7c66663ea951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1667001389, "uuid": "61202c95-c111-4ea0-9214-6757dee7376f", "comment": "Malware payload", "value": "7d38678525b2e31f03b3fb881d2e7756276bf50f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1667001389, "uuid": "6e4b2f40-7d5b-4919-97dc-a25f31f103ba", "comment": "Malware payload", "value": "3cdbcce61aabb26d2510eb78e747d29dbe125a28d71e1b64097f4058ea7baefc86379fbb013e698f66815dfd6c0bce6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1667001389, "uuid": "e4b54dad-fb3f-48a1-8d49-5bab4c2d07c1", "value": "T14026330B6AF51C03ED8059366B995EDC2E3C4FD518B8B76F122DEE4218E1A49DB5CC2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1667001389, "uuid": "2aeb9f7f-e798-4f18-ada6-c724e5a22683", "value": "bc4beedc62d5d5f91e651aa31c037881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1667001389, "uuid": "9d7e644f-b261-4aa1-9ee1-66fd98755165", "value": "98304:gF/5cokF429A/2sOdHJACr4qNZkc/wOKW6CPOr2ty1qOS6W:s5cokFaOXdpACcqsGKW6Styor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1667001389, "uuid": "448867cf-e65b-4ccd-bc33-4c573e9526be", "value": 4441432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1667001389, "uuid": "32c91562-4858-4381-9589-8776dcfbfdb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1667001389, "uuid": "e457eaa1-192e-4741-b1a8-08b1f9e6bbc9", "value": "0715f220c8a8bd2fc36acddd65220167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ba0c8a-56e4-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666977474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977474, "uuid": "0d9b9a17-e2db-46ec-adca-5ea2e59fc47e", "comment": "Malware payload (AgentTesla)", "value": "6bb722b50f80116c0f15e5da874247bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977474, "uuid": "d1199b74-692f-42c1-9f90-c40c835f40e8", "comment": "Malware payload (AgentTesla)", "value": "2d3a915422db61d554d12b68b8638f93ccea5684894b776c7683740f9ce0c579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977474, "uuid": "30ddd48f-16d5-48c2-8461-3e29d057f286", "comment": "Malware payload (AgentTesla)", "value": "da8394e92dd95ec3ea88892473dac6bdf614c056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977474, "uuid": "f0d84013-31e0-4b03-b502-74ba33370611", "comment": "Malware payload (AgentTesla)", "value": "b531b9f9b60bbc84c0e22ddb2d06d8118b739c2e82cc37d3a55e2f70a3a69854b4a19b1f06d2de2230437a41dde06868", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977474, "uuid": "cae979da-5c9e-4341-9b4c-9dd0749be085", "value": "T132059C34275A4F0BE0DACF38B4B0D1B057669D7BB92E8B86CAD46CF779122B0590D487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977474, "uuid": "e55630fc-8e27-4638-a5aa-04256a04c212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977474, "uuid": "4f269032-363b-4f1c-8480-ca4957a396ee", "value": "12288:6y10PPJaxEOCf5lpLR6AlAM6Qjo5MHccJTMaI3ngxASptyx5G/oQKLXZ65BdZuLx:xuuMHccJTMaIwxA7xePC0sLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666977474, "uuid": "b48cebe4-0e57-408c-a00c-679f42a3070c", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666977474, "uuid": "69e41d24-a533-4623-92a4-59a9b16af485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977474, "uuid": "b0a37062-cbaf-427a-a68c-f78d8452a0f3", "value": "RFQ-20220124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a9bc7f-5694-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666943302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943302, "uuid": "13ed4625-5424-4424-a35c-e5d5a9fdb746", "comment": "Malware payload (AgentTesla)", "value": "91f213967dbdbcf9f08c9eb9771c930d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943302, "uuid": "f2f8004b-41e6-4f7f-b4a2-39a129a7eeba", "comment": "Malware payload (AgentTesla)", "value": "2d83e9a73013c22604f4e57985b49a5f1616dc35e2287147546fd823ce0832e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943302, "uuid": "21f2153b-e0bd-436f-881a-c497b064a928", "comment": "Malware payload (AgentTesla)", "value": "2c787d1415372670a80341033bde7184478184dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943302, "uuid": "f87903c3-f1cf-4369-b869-d54612656828", "comment": "Malware payload (AgentTesla)", "value": "8f070a266dae84fc91823e0afb1e1e7f0de6ed65163a2c1b2e538889114277b8cfe007ef0e876d4c7d9db294582c8bf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943302, "uuid": "4d908c85-e55e-478c-9176-cd55f60ff93d", "value": "T1E115CEA116CCDA53E2282279C05570F15FE2BE32E219EAD73C963CD4B6F3F468B5054A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943302, "uuid": "f3a94acd-322b-41fe-a728-f238c6b7a7f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943302, "uuid": "25406334-cf5c-4fa9-b607-a17514ba1b16", "value": "24576:V/A6w+dGorX3g391mKv0sQC2HS/Aha9K5L:NA6w+dGob3GEKzQZj5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943302, "uuid": "f4edefe9-4c07-4da3-99ed-c154834c7e0b", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943302, "uuid": "f99565f1-992e-4ff7-b283-6e1a2193dcff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943302, "uuid": "e14b00cf-e95f-456c-852f-e87ae2dcdc17", "value": "SHIPPING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd4cd3c-56f9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666986396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986396, "uuid": "8f330375-377b-4b80-a1f3-d75c626360e5", "comment": "Malware payload (GCleaner)", "value": "4e463c3e39c86c4ed6aba630e8d16ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986396, "uuid": "f6edb931-60f2-4102-ab0f-f53c94200955", "comment": "Malware payload (GCleaner)", "value": "2fcda42c1209ac8c463a08a9a06e162f76f1aba13879af954e1766787b3ad917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986396, "uuid": "0bffb5d0-84d2-4705-907b-54cd860c68f7", "comment": "Malware payload (GCleaner)", "value": "0b76a9c5f06d50357420e909dfe7ac4517c5de95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986396, "uuid": "d7fac8d0-0663-42a6-a699-69ffd15af85d", "comment": "Malware payload (GCleaner)", "value": "2a4a710381e260df19ac663a0a76c0b0a2e940f620f483c88a892563d19a40c44b090475be43fe3e6f71565c07aa930d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986396, "uuid": "e78937c2-5685-4504-b065-955cfa54e69c", "value": "T171C5333D4FD781B0D5A38A746C1C8BE9C7A57EA91837C8A5F2ECA28C4F370981419B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986396, "uuid": "1c0dba1f-b878-431b-bdce-3a4b1307b30e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986396, "uuid": "cc24e279-d2d0-40f4-a8f3-8a9044ebe23f", "value": "49152:Z2QZ4uwV4bmjypaPzRrdr2jRnZNX+ucrQEJil34BEZq1fA5hq:MQc4CPJd6X+prQEJilFZfDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666986396, "uuid": "e6724044-2410-4e57-94b0-e15d9ad12485", "value": 2603391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666986396, "uuid": "f810e846-a203-42cb-8af4-0bedebb4d310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986396, "uuid": "d2b79adc-f9f0-45e1-a631-0d76b273363a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12609fb1-570d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666994917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994917, "uuid": "60ba09a7-f217-4204-b9d5-bc550adb5bbf", "comment": "Malware payload", "value": "43d8b5202b784e3752084943e4552c0a", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994917, "uuid": "c5c54b36-e455-405d-a072-5586dc8957e5", "comment": "Malware payload", "value": "30e4c446a6a84ff72f8325bd93425e9892883b33ef863bd1b6fbb2cab17a09aa", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994917, "uuid": "7f963b06-ec40-4a88-80bf-9bf909a6140d", "comment": "Malware payload", "value": "55f34a1fd91007966ce3be3f0d2a23f9974722df", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994917, "uuid": "25f3857f-df42-4edd-ae96-7fe57aec4561", "comment": "Malware payload", "value": "9ef9ba9741c2d5eef8fc5cede4bd04c95cf0531bc904db27b143445b02e981ab31f297b5defd007b597632988b1b5a3b", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994917, "uuid": "2499ec09-3de8-46a9-a57b-8b3423527b19", "value": "T158A2E1C55A980268C922F6AC3CCE2600F821DDDC49B3397116366D25DAEDDCF69332E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994917, "uuid": "bd10a817-1138-4dd5-b5d9-8b60faa53ad3", "value": "384:nFU2itCD/2ciHny4pyaDkE0B7poNWvP9NyjgETQMrJNMCiibJgdMmPRC+Ia21fZ:6qiHnTyaQnnGsDyT0Mr40gWv+INv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994917, "uuid": "91a2a073-1303-4c66-8ebd-4107f04c8a10", "value": 22346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994917, "uuid": "2d1642c3-028c-4555-8315-a35a674e91b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994917, "uuid": "2d2fe12d-b2ac-44bf-9e0b-858dd574d880", "value": "Which sentence has proper subject-verb agreement (93636).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3674540-5716-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666999079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999079, "uuid": "e2230380-a046-4e23-b5d2-a614bc27de7d", "comment": "Malware payload (Formbook)", "value": "ccd26e25d28ae8304ec6d25ef79247b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999079, "uuid": "f8689021-888d-4de6-bb61-c9752489a444", "comment": "Malware payload (Formbook)", "value": "30e561ad54c5afb263ee76dfd5128d3b785036a8f43ccf07f39dd4e9e04e0239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999079, "uuid": "b62a2f07-e7be-4574-8172-e0b5246a8722", "comment": "Malware payload (Formbook)", "value": "c0c41c43527205a5cc8fd243c2a3b6919c92782a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999079, "uuid": "200980ab-54e8-493a-bda4-28cde0de465c", "comment": "Malware payload (Formbook)", "value": "a5f3436d4a3b9f59609651aaf8c9e4c3f6481f41e8c96f833179aa3ed3d5b03e4cfd794f9540216725229ce2b506a584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999079, "uuid": "8c1c3828-5ca8-4f1a-974d-9935e98e9e87", "value": "T16EF47A34235E4F0BD0DACE74A4B1D5F11A675D7FB92ECA82CAD4ACF7B4162A0690D483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999079, "uuid": "85123e16-c496-44df-a03b-82b45848f9c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999079, "uuid": "b4859bb3-39ad-4032-8608-ecdb6d51c223", "value": "12288:1uJ/uE6xZnLhzrgy610BR2NQfaDH92BruJgTvh/6VaomJa:ApEZnLZBYKaD92BruJgh/6Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666999079, "uuid": "04fb5da3-52d6-47a3-a4f5-b0599dbdc55e", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666999079, "uuid": "b24cd58c-d653-4d47-999d-9465a3d9c4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999079, "uuid": "097f0a6b-5832-43da-8c5e-86bf04f979f3", "value": "swift-2022102808456789567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528d770c-5689-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938331, "uuid": "c7faa62d-55c3-4d89-b5ec-449b084db5dd", "comment": "Malware payload (Amadey)", "value": "79cf861ec8a42ec5cc373aa513ef8e2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938331, "uuid": "18e9302d-b2e1-40fb-bc7b-bf1f3121661b", "comment": "Malware payload (Amadey)", "value": "31cc0b34b6c2fc9eb15065561936ca30aab66cf5955f22eb3ebbe0755feef0ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938331, "uuid": "f6b788ec-e489-4b87-8ca4-e20d7f6e8260", "comment": "Malware payload (Amadey)", "value": "552ce5073efd679fd749e64862255bcdede3dafd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938331, "uuid": "dfa85fd6-59ac-4f69-8d82-d6ffbc03a014", "comment": "Malware payload (Amadey)", "value": "d36134bffbd8dd999e29af9120e9e2a6e07072f195cf44ebd4c055d92ed9d1a7169074b07bb2b5ecca58d7a3fb63f532", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938331, "uuid": "5949d58f-bad3-42be-ac32-bf13d3882f52", "value": "T17044CF31BE91DB71C48612304436CFA129BEEC3149654A8377B43B9EAE713D0A5B636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938331, "uuid": "26e8857e-50bf-415d-88e5-2206e9b8a561", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938331, "uuid": "2774a72e-5aec-4c38-8cc1-d66c89bf96a8", "value": "3072:ymOXO8xHS7LYlcAEKuoGBfmlk52g8+Ld09h6cCqMAv5pqHORWOOEAgLM/h3gU7:/W/HgLYlJubBuHwVcCq3vp46j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938331, "uuid": "48e4967a-13c6-4cf9-aaf9-6d20ceffb63a", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938331, "uuid": "b0d7387f-6f5a-4a80-a748-936917d5a129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938331, "uuid": "d411d861-bcde-4f1f-8ffe-6f61e6e18385", "value": "79cf861ec8a42ec5cc373aa513ef8e2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c39cd71-5695-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943555, "uuid": "043d5bf0-e3d7-40ab-98c1-20ccac10084e", "comment": "Malware payload", "value": "ac970fb8c5103cbecd94c48d02f0945a", "object_relation": "md5", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "windsoft-cloud", "colour": "#74C387", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943555, "uuid": "d078aa1a-23e2-439a-8348-324f8a1b23ce", "comment": "Malware payload", "value": "3215e8aad441b5f8ec63645d6cb5bf9396a3d2446360753a308d790dfb173270", "object_relation": "sha256", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "windsoft-cloud", "colour": "#74C387", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943555, "uuid": "71e6c2fd-1ec8-48dd-9df0-7458b6ba3d33", "comment": "Malware payload", "value": "e8f0e4b32ae82300e15ebf5986274f5703c4627f", "object_relation": "sha1", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "windsoft-cloud", "colour": "#74C387", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943555, "uuid": "408bd850-eb95-47ca-a1c3-0fffc777ba41", "comment": "Malware payload", "value": "9b2911cb8ddc58dfeabf1736e45dba7b5c00564b11c1b081b69fd41d10415b6ba711648295e0456f3ffec23ef8035215", "object_relation": "sha3-384", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "windsoft-cloud", "colour": "#74C387", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943555, "uuid": "2d9ffc6b-aab3-4e5f-b0aa-871bef2ef536", "value": "T11D56338D545C9B68E95A76C0087ECC5E7CACFF213DD48E9F4C88C2CCAA8648CE5A255D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943555, "uuid": "7c71bbc9-89b5-4b70-b73d-c34a0db20206", "value": "98304:jdEV+GISB+8fpYLvmoJ7rTflB23jdycMm3Q7s41BrEBkDcNOy2Oh1pwFv4Jns:jeZxfpImoBrDijdNMkQ7s4962Mb6Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943555, "uuid": "1dcd1af6-9a73-42f6-8868-e8a8cc53ccc8", "value": 6394078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943555, "uuid": "2b343405-6b50-4f07-90f2-f01f80c988d3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943555, "uuid": "94da177d-cd5f-4b5c-9b4c-bd808946bb5d", "value": "main pw 2022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579bea3-56cc-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666967005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967005, "uuid": "c04e8f02-929d-42b9-aa82-6040de85682d", "comment": "Malware payload (Formbook)", "value": "106ea547868e2c923b4a3f71f91b6693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967005, "uuid": "3b871797-2221-40bb-964a-1c43890479f1", "comment": "Malware payload (Formbook)", "value": "32ab9690566e716db22c9e6b6713e4d942cf3e7f851566721655d74e05684a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967005, "uuid": "29925a18-bb3f-43aa-9db7-6ea964a238a5", "comment": "Malware payload (Formbook)", "value": "8df50465c3e15ba4338b84689d57ca123b9a16af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967005, "uuid": "fffae636-be68-4fe9-920b-b37abe0ba5d1", "comment": "Malware payload (Formbook)", "value": "6f18345e9e1b562fe9e621269d5fd563e57986bef4d0342f416190b238255eb3a9dc1ef8b8da4419b63165b4f399a8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967005, "uuid": "4142b07b-429f-403a-8dd1-9e9aca7c7093", "value": "T1B4C42375DB12D217E76776F21C0EC6206A3E8C6430F6A8E4089C7E5E58E5A2D321F5F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967005, "uuid": "ab22a01d-96cc-4e74-9389-04a956a6fff3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967005, "uuid": "9eff9d8b-385b-4d62-9945-ab4513b3ca45", "value": "12288:Xh7xspZlbH95SfQN/lK51+SE7j5CuwmuoEyL:uZ964NNTXj56m7EyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666967005, "uuid": "95aa2ce8-34e1-47d6-ac90-da0652e7b7dd", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666967005, "uuid": "9722ecb3-051f-4a1a-9e0c-2701c9806bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967005, "uuid": "723b27d5-0182-465c-9023-5d0691315beb", "value": "inquiry order_details.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d898109-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666949436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949436, "uuid": "56f042b4-595a-47f7-a9dc-4d60f2e41bc0", "comment": "Malware payload (AgentTesla)", "value": "74403cf34b43769285ae35fd7611373b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949436, "uuid": "47ce06f6-25a8-4ebf-97ef-e2ae3e5cb460", "comment": "Malware payload (AgentTesla)", "value": "32c4ba9c21acb00b6af48f27b2eba6ad66d0867bb90131bff996d77aebd25d5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949436, "uuid": "150456d0-6e27-49d7-8afa-9d7a380a0115", "comment": "Malware payload (AgentTesla)", "value": "b14fb956fba1eb798688571472ebab92b924706d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949436, "uuid": "913bff1c-36f3-41a2-8e75-19f64b615f33", "comment": "Malware payload (AgentTesla)", "value": "ecd05d58699648f81a6a72203e7194df376e9df118d69e101a0318b7655b3e2a45f5ec61aab14e5dae29f0b599474d31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949436, "uuid": "793d6c33-020e-4e33-be53-56ec57b4470c", "value": "T1F3F47A34275E4F0BD0DACE34A871D1F01A675D7FAD6ECA82CAD46CF7B4122A46A0D487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949436, "uuid": "4f432de7-31c3-4f80-9f8c-ebe63f910346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949436, "uuid": "2d8f07ad-ebb5-4513-a698-85f9df77d65e", "value": "12288:Rtrm93g6yZdfl6nxhkzZtw9+VFkUfTwmo8KLy:uurdkCw9+xwt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949436, "uuid": "ad8a4618-0345-465e-82c7-d9742c46c287", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949436, "uuid": "c82d50d8-b320-47da-8a5e-43fbc4ed4e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949436, "uuid": "b64094ee-4424-48f6-a590-429378c2d4f6", "value": "74403cf34b43769285ae35fd7611373b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467fd6de-565d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666919413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919413, "uuid": "bf447a6c-747b-4e9f-85a6-5a33c6ff4645", "comment": "Malware payload (AgentTesla)", "value": "f79f436117cfc0512c221075851afc1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919413, "uuid": "11da74c4-a03e-4112-8b67-b4d28a98a603", "comment": "Malware payload (AgentTesla)", "value": "32ce4af90555f219552a1045072569278b801900a324a80d4415d59d1131e117", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919413, "uuid": "081543a9-2b1d-4262-a186-06933278cadb", "comment": "Malware payload (AgentTesla)", "value": "310bb7a7bcc635a3c554efb64cfc81dd3c08c59a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919413, "uuid": "ec7eb278-2855-40dd-aeae-5ba455eb2f55", "comment": "Malware payload (AgentTesla)", "value": "5b0b4a5b6331cd1fa5d3b1606b6edd9e1a10545b86b5f295eb1ef2e5801c92238308467f47387699e5a086dd1559d216", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919413, "uuid": "2f0650aa-6e2d-4e7f-a200-01b1842a4a35", "value": "T183120A0593D40132DEB102BA397B4786C736A7AB6847CFE974CC621E7F2255247633E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919413, "uuid": "f21e49a3-fccd-41ca-8e7c-4670f4f5b0e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919413, "uuid": "6a7f2ab7-4c5a-46d6-8604-392819488533", "value": "192:i4mV2r9lLlR4DwqeUnvl8stYcFmVc03KY:Z9lLlR4DwlEvlptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666919413, "uuid": "86e81a3f-26ed-4396-8bde-b9e277f8399d", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666919413, "uuid": "0af8ad87-7af7-4a36-8014-e4b81bc763f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919413, "uuid": "1cdc50ca-9d0d-4f3b-a4e2-f9dc658fb62f", "value": "SecuriteInfo.com.W32.MSIL_Downldr.I.gen.Eldorado.8870.20629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e298207c-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666959188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959188, "uuid": "2fc82036-ede1-4fd9-9ae3-bea1e3859495", "comment": "Malware payload (RedLineStealer)", "value": "b97f418203d62f7d860d48ea4a36f3c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959188, "uuid": "974c6be8-0777-4a62-9997-bdf2569be4c4", "comment": "Malware payload (RedLineStealer)", "value": "343dbcb52c9879c5b739c8356ce1a369fd8ef4e6c268c576bef998bc3dc82020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959188, "uuid": "0dd11343-e165-4068-94d3-8179b300ae72", "comment": "Malware payload (RedLineStealer)", "value": "343b361b0038df73722f57db55fb89af7103492c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959188, "uuid": "78fe584c-f128-4898-98d3-4378bfbfefb8", "comment": "Malware payload (RedLineStealer)", "value": "15f10947a8a4ee0c928d48a556fd7693cf725f8ecc6dff954a9303550f9a8fd440f94895a8e664be6a2bd3b30b8d4012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959188, "uuid": "2578069a-56b1-4568-a8b1-bba6343090de", "value": "T1D184F0327A93C072C06565384426DFE06E7FBC32096609473BE4376E2E667D16A7A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959188, "uuid": "e2c94bda-d3fc-42b2-a5a1-616c5a698004", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959188, "uuid": "5547b969-191f-4b9e-a548-9199087afb83", "value": "6144:gmHIL5q06YbW+8ntNQpwa1wXzgJE9LnUyKxLsEbhdGcA7b50ev1R:gmHI40tbkniwRXVb+xVG77tzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959188, "uuid": "3bf37760-7d0c-4802-b848-cf0a07ef465e", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959188, "uuid": "c7f4f5a5-d63e-4354-a2be-8835e2bf8b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959188, "uuid": "1d193bda-6a4d-4cde-b282-5a541b547ec8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c02f760-56fe-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666988544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988544, "uuid": "4d73bce3-e172-4abe-8390-05a80448324a", "comment": "Malware payload", "value": "d82044f9d5b7aecee9e1af50e1c53c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988544, "uuid": "e16054bf-f5aa-4671-a5bb-75cd500fcaae", "comment": "Malware payload", "value": "346b5a44d3330afaf15ac8740bad645aa5bfab48e68e453ca05cdd5cd423df19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988544, "uuid": "a199ddd7-0c62-40bb-8863-5240acda2ff0", "comment": "Malware payload", "value": "601d2241ebee4077505bad000e0b688eb5cd89bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988544, "uuid": "98af2abe-2724-4401-ac77-ff1b0fb88bcc", "comment": "Malware payload", "value": "e3a470780ce48474bcad66353dfc067a721ff398ae17e2f8271827a3ce4dc55c901eea888a106a905bd10248f6ac9764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988544, "uuid": "2f19544b-8c41-4051-80a3-eb979acd1c0c", "value": "T19D65A5E0B7D55E3ADAF16D73F5691A90C92AD91A6103224F18C121350F8EB33FF9A139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988544, "uuid": "edab4da3-63c7-4134-b1e8-5362bcbd9212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988544, "uuid": "c63ec0bb-455f-4b74-a25b-256c65d36ab8", "value": "24576:HN5PqkN2IIxcvpysb1HJrhVfUB6YqifFvk8p5:HPpTb1HZ4YY5h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988544, "uuid": "b095fea5-964c-4783-927c-9b384079d062", "value": 1431400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988544, "uuid": "5a64163a-2626-4a49-9f00-5f9b480abeb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988544, "uuid": "b0422a35-aa9f-4f65-bb6f-49e686847173", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097942d8-56b8-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666958395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958395, "uuid": "5c9bfd03-99a8-4d3b-86a2-5a2518d33158", "comment": "Malware payload (RedLineStealer)", "value": "363b425bb752c7a834dfa6d36b59a38e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958395, "uuid": "39ce7902-2934-4359-ac9e-95ce9fdc9193", "comment": "Malware payload (RedLineStealer)", "value": "3483be26d6bd55acbb7318e06984bfc417c7e6520a5f1cbff7c83cadad635e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958395, "uuid": "499ca567-bc2d-445c-8092-676c445ecb95", "comment": "Malware payload (RedLineStealer)", "value": "cd210c656342dca4bd915f22970aa801367e8296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958395, "uuid": "6cd32d39-7e48-4910-9192-7532b37b99b7", "comment": "Malware payload (RedLineStealer)", "value": "6f7ff9f2b0dc46ed505873f1fe843ee1356a47a30d5ea6a883838da86f7ab42d95216b7575ae087b09543cfb7593d951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958395, "uuid": "6c2cd199-ced6-4c05-9f0c-168e81f11a25", "value": "T1D984F231B583D4B1D0962534002DCFA02ABFF87102A58A5777A42B6F9F713D26A76B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958395, "uuid": "1fdebb14-9222-4f31-8569-461f5783473b", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958395, "uuid": "5f7b91f4-713d-4935-abf3-84761b7b6fc8", "value": "12288:/jmH3FNtRBqD4kpDgFkDttKnZfmljLKFyT:7S1dTooMttKpmlnKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958395, "uuid": "1130589e-2d05-42fc-8b80-ca6b67f03103", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958395, "uuid": "9f320b2a-9391-402a-9ce1-de5c322aa86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958395, "uuid": "861a6546-1636-4d5f-b4e7-b5d05e474156", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcfadce-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666949191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949191, "uuid": "1b055ad2-e7f2-453d-81ee-e8963a7fda75", "comment": "Malware payload (Formbook)", "value": "c5f2414ffbf5e3567301cbcbef2f87ed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949191, "uuid": "ec1a6e5b-2d87-452b-98b5-ca2e79afeeba", "comment": "Malware payload (Formbook)", "value": "348cbc4c2aa364e9523f840875d4a6f16c45eab3ef4559faca4e753476937994", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949191, "uuid": "b4b18b72-db2a-4201-9fc5-5d0341ada93f", "comment": "Malware payload (Formbook)", "value": "bed1307d3dd4be646a663953e53a449d148601bf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949191, "uuid": "8573963e-f02e-4f68-9985-daf635872a47", "comment": "Malware payload (Formbook)", "value": "71c50d1df31ebe985dbb8d10d8733091adba28f2f99e521430a5562c420237552fbc40da926dfa5b5c4b24dc6e12f065", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949191, "uuid": "00a91982-9596-497d-8d8f-dd1fcdea0051", "value": "T19C3423503BACA631F4C7BD38A46BAA4C1F9AED5D19C93F8214713B1D23B0E16A971F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949191, "uuid": "a1652861-ff90-4b91-8a3a-84bca9906afb", "value": "6144:XC/Oz6RLDBJxoixCip5aVJNgJLWgDHVE7xq38v81:SG+RfTxLCip5aVzgJLWgxifv81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949191, "uuid": "a940b990-46f8-427c-b544-f42dfeedeb7b", "value": 251528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949191, "uuid": "0fc0af5f-5575-47f0-afea-1dc3bc5ff942", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949191, "uuid": "612827a6-23c7-4ac4-aaa1-ae0e86f21727", "value": "New_order RI3328-10-2022(129KB).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912ea2f9-5653-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666915243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915243, "uuid": "6460a893-b59f-4b87-a2c2-002e1f4cd42c", "comment": "Malware payload (RedLineStealer)", "value": "1a3b88afce3a0044f0749a35ddeedbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915243, "uuid": "20ab6ba1-2eca-4d0d-a29c-7e343d86e800", "comment": "Malware payload (RedLineStealer)", "value": "368dfe8e72bf9e8f155b9f7a8bed7f4120c0a7268e8761a749550e49c055b689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915243, "uuid": "c96b0f83-644d-4eb5-901e-718a9f714dc7", "comment": "Malware payload (RedLineStealer)", "value": "ba6479bffac33930aee23d60a6e0c8c33736f632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915243, "uuid": "62681e7f-8d6a-4355-b542-f3eb80b0b106", "comment": "Malware payload (RedLineStealer)", "value": "53b4e7444d26923e50bbe862aaef68537ab2174bcd52de3dad5ef4d911f3585759bb0e134d805f55c75084f510b0427e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915243, "uuid": "7c4ccd41-47cc-41bb-a3b3-620f8f473662", "value": "T124B5B03AE70614B4D76356B1C29EFE7BDB44B6348021AE3FFF46E90CA4734126C89256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915243, "uuid": "fad778bb-f753-4964-ba3a-1ef21e602030", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915243, "uuid": "cab2811a-748d-43d5-bcbb-4ca9a3e5689d", "value": "49152:by0Ri/S6AJ9fcSPi/CTWOoz4q49RgOEpYMUuFjUOlDAUcLC:by0Ri/S6AJ9fcGi/Es4qKtdtuFJlDAUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666915243, "uuid": "a1f5e777-c28c-41a2-b5dc-2c36c2c966ca", "value": 2492416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666915243, "uuid": "7dba0f5e-a8ab-4379-b663-5057e65e2f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915243, "uuid": "986ee0bd-06c8-442e-82d8-9cef247d0615", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5a2098-56eb-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666980416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980416, "uuid": "7e6eb642-07c3-4a92-bd83-6c11380ec9c9", "comment": "Malware payload (AgentTesla)", "value": "bbf1e71505cdd870862da9fbf4f4c984", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980416, "uuid": "a4111c31-ed78-4f43-85f2-fb27c27ea434", "comment": "Malware payload (AgentTesla)", "value": "369901ee351d7f1a0aaa4e37867d9c65d68f0627f63eca89f2593cb8a65214db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980416, "uuid": "a2a644f2-092b-4869-a404-7d3b4e026ed2", "comment": "Malware payload (AgentTesla)", "value": "5ff126181e3d950d46cc124a58be3ed2cfd13111", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980416, "uuid": "87f7cf7f-6ccd-46dc-865f-b626cb37ce7e", "comment": "Malware payload (AgentTesla)", "value": "32b642008dc80ecf7eb0f0df31f1f9cf201cb24d53672877bd3d3727bc555668fd64f5a8aae90592f40e5e0226c34d70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980416, "uuid": "3f635cde-e86c-433a-b563-dcaa3a186c3c", "value": "T19C236C3662B5EF59C92F3975C8A386F90227EE41DC1687CF39843E4A7836280F571A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980416, "uuid": "7b1daa7d-bf8e-43a8-bab0-4315c3ece056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980416, "uuid": "66cfdb67-3495-4efc-8999-3231cdd57fb0", "value": "384:i2U9JcTuiQvsSdG8tUHHojSeRiD9vXbXml:/U9mTw9GFHHfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980416, "uuid": "797526a7-33ff-4519-8864-7b4a5d05b0a0", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980416, "uuid": "f7c41fad-b79b-4049-99e7-2b736ba54a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980416, "uuid": "8a845acd-f3fd-4dd2-bbbc-b94e111cd002", "value": "Swift m103_003756453553432343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ade10e-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994471, "uuid": "a38b4a71-5a04-495f-976d-482865253d37", "comment": "Malware payload (Meterpreter)", "value": "face8fd03157a49e11c71259c826b167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994471, "uuid": "b47b9277-fb66-468d-b24c-3d128e8e6e5e", "comment": "Malware payload (Meterpreter)", "value": "3712c16a93fc26a799ab13546996aefaaa32c8bd43ad18558a0f2bf3bdbec8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994471, "uuid": "1a5401ea-c528-4594-850e-cd1d3c8fb969", "comment": "Malware payload (Meterpreter)", "value": "acc60ad1a058d1dad05f2002ac757b525758876a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994471, "uuid": "4f67eacb-e1e8-49fd-a1ed-8f085efd9d97", "comment": "Malware payload (Meterpreter)", "value": "ab49919030484ce0668d3973f63a56b773265d87bdc4f2f40202e7089e5aeecb7c4dc3a16590858945bcd4b0e39a0ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994471, "uuid": "543027e2-b7e6-42f6-b399-4d974639a500", "value": "T1FC73CF43E5C41875E191113D23753A71A974F4FA3702C2AE768CC9F9DBD2DB0A2663C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994471, "uuid": "12455103-9e21-43b1-bc1d-d564c2c80d78", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994471, "uuid": "610db05a-26cf-4ad1-be9c-876c4f8fa361", "value": "1536:I4fQo7z95YTegof3XNEEg9m667D9umgtaMb+KR0Nc8QsJq39:PZ/nYTo/XNEEgc77Ngtae0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994471, "uuid": "e9e92999-dce5-4308-9743-b3feb065f434", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994471, "uuid": "17f27012-46ca-42d4-8ce4-97f1cca928dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994471, "uuid": "59ac7e37-329c-48a3-8354-09861bdc7802", "value": "tray.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40d3dc8-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937260, "uuid": "6d726c7c-3c7e-4231-9a55-9baf1b6952b0", "comment": "Malware payload (SnakeKeylogger)", "value": "ae56bc534888c582bcc174377cc3a527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937260, "uuid": "daca0554-808c-4b0e-95e8-a5ea070410f4", "comment": "Malware payload (SnakeKeylogger)", "value": "376c999716183d5e6971b9ed0ac92442bb670b3e362b1dad2ff366a34e052002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937260, "uuid": "e0763efa-c0ca-48dc-ba74-25eaba9e82db", "comment": "Malware payload (SnakeKeylogger)", "value": "9b8faa3f25e2d205b0384c300aa2c8f99cb02507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937260, "uuid": "3c3147b8-4887-4d3e-b89d-0099f823d9af", "comment": "Malware payload (SnakeKeylogger)", "value": "96e0d06e2a8f10e64f5ea0a00d729bb292899b96e1bc04be8e5ff3e407dd9afa3baad45c3265b0ebbaae7bd9a63d6528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937260, "uuid": "e84021ee-0432-457a-9f3a-c4daa2aa2632", "value": "T1DDA423D17A23FA2FCA6F33B0790A0A8C767B05D170957591B5C5796A0CBEE59230B8F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937260, "uuid": "de375d12-75ea-4c1e-9ff0-5285d01f8ade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937260, "uuid": "d7d8be5c-a7be-454b-a2bb-af867646f8d7", "value": "12288:Fh7Wg1FnvgXI9XaSS1jNR/MX9GMvT5cKOXe7W3EJEyL:DFvgXT51jQNlT5cV8W3uEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937260, "uuid": "d7675f57-25fa-4ead-ae01-2b18612c045c", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937260, "uuid": "c950cea2-9651-4230-b710-1d8b1d6f6a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937260, "uuid": "29e6a7b5-bdb0-4ede-b875-e0921ef6921d", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8bc160-568c-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666939507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939507, "uuid": "6b3437a4-1e5c-4587-8376-984e18ed787d", "comment": "Malware payload (Loki)", "value": "66f7a39e9ed6fce17b24304fefe9014c", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939507, "uuid": "78e5cca8-8969-48f8-a09c-b7830c42377e", "comment": "Malware payload (Loki)", "value": "37ea8495af0513a701cecda94f6fddbe2595f8c560b2ce66bc8440ccb47f671e", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939507, "uuid": "a2addeef-473c-4bae-b667-dc32e3f0cf8a", "comment": "Malware payload (Loki)", "value": "6efbd9680dc254b27c0b738f8ed82d6618566bb2", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939507, "uuid": "531aeda3-29fa-4828-ad89-11dd40bf952d", "comment": "Malware payload (Loki)", "value": "73f44f4de8ae2af27ef7d4c944e188563210e5e9809a466c2256191b61bd35f71a3cbf66c0c7a962c9a298b04db196bb", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939507, "uuid": "a5cc117c-f978-4ae3-b342-cb7b4d76c90f", "value": "T10FA42371A4AE19EDFDFC5533F68C281AB3AB12D6E81648FD7850170720E654B18D4B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939507, "uuid": "aeb4a7ce-05e2-4daf-bfa5-d4c4ee063724", "value": "12288:nrcKRspfRVAiYIRUnyyOTVWiPPVer7jQCAO:rcTRVA1pnyVVW6Ver7jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939507, "uuid": "1a613ae4-6142-4b81-8dc4-47b698bf2676", "value": 459555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939507, "uuid": "d1c5b3c7-83e7-4748-a9e1-ebe073443ad7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939507, "uuid": "58730ebe-2637-4112-aac8-2310fa3fae05", "value": "salinan FhQD3l9vhmaFZ3L.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8b2e8e-56cf-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666968416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968416, "uuid": "0ba7d5cd-2516-4a00-ab10-94c3a6ee9caf", "comment": "Malware payload (Formbook)", "value": "3359916b838254bede2336070d99b6e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968416, "uuid": "8a8d8a7f-27e9-4bca-8921-00d29cf9e704", "comment": "Malware payload (Formbook)", "value": "37fc27ae593c57c90608af9929d7ade4fc5924ec4e795c445c4bf8a5a1bf8585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968416, "uuid": "6fae288e-7c82-4665-bb40-f8fce2e0d41d", "comment": "Malware payload (Formbook)", "value": "ae40ca0d6b91624cd8d9ef1b30e1ce2338c3309f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968416, "uuid": "c51571f3-509c-486c-a515-f486c7084d4a", "comment": "Malware payload (Formbook)", "value": "5b2dde5fa8695a6e2b92d4468ab276810f29253379e1b21c73903b2f2bf908e1b7340c9650cd82308f6107baf397df8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968416, "uuid": "0bc4e7f6-6323-47d4-b86b-bd7155636be9", "value": "T17334123A769280F7D6D50F3188F3A2A9D1B2DA09560673CBC7614F3A3D502DF960E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968416, "uuid": "6054cd57-87e0-4c9a-bc7a-f3be046ab85e", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968416, "uuid": "50c81692-fdbf-4e8e-809e-2dea6507111b", "value": "3072:qUJoFfWzzl+cSM2wPddXssJXKAI95ibwrhlikpXbeK3eMmR6M3vcJLSmKqcHKrF+:qweEp2KjV5IDiErh7bNmv0JLlcHKrF+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666968416, "uuid": "b79e163b-19da-4cae-911c-e63075b3bd8f", "value": 231014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666968416, "uuid": "a0f502d9-cb73-45a0-ad87-ce10eea0644e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968416, "uuid": "88bb4403-7388-4618-b7a9-15eaf84153af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645d4d64-5692-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1666942226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942226, "uuid": "9bf9d6a0-be09-4808-bd93-cecd86a383e0", "comment": "Malware payload (ModiLoader)", "value": "61a43c0f65f283f6a10afca1db8e18cd", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942226, "uuid": "9428c0c0-7b51-4e5d-90fb-1f108e1c31d3", "comment": "Malware payload (ModiLoader)", "value": "38378b2c35193f1ecc436e538932c0603ee28cb33525810048e3e87bb5b83349", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942226, "uuid": "17c1cd05-55ef-411e-ad91-0822cfa94ffb", "comment": "Malware payload (ModiLoader)", "value": "dabb80f7e060d3a4b812c21a9e5204a837a1943d", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942226, "uuid": "ea160982-14f6-4a21-8c70-c6adf6ff393e", "comment": "Malware payload (ModiLoader)", "value": "679e7d22d807ce28aeb1df8fc3d28b709e3be0f8785f79b03c274ff65d5cfc6d2257d697b347e51da28267018f75997f", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942226, "uuid": "aeec090c-f87d-493a-a7ff-02746ee2cf23", "value": "T15074233BB11916EDCFBAFE5A0869C4AFE04D0E60959D6B546253C9B59CF78C06C8EC0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942226, "uuid": "3a8b534f-10df-4cd1-bb7a-28912ae89a04", "value": "6144:ovysWBZZtm1kkUlkxneNW4Os2QoosgPBRpYwTRYValo8yTtsUiMmgJ9TB9xRD6ua:oKs+7YqkUK14QiXNYV8obTtsUX/TtA0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942226, "uuid": "0425333a-cff4-4a41-8c3b-78b2ec4e6ffb", "value": 362768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942226, "uuid": "1b4be519-5c24-4a51-b9c8-829c9c97309e", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942226, "uuid": "600d5ea1-357e-468b-a95f-72bed2584f8f", "value": "Produktproben%0D%0A bestellen pdf.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e674ec-5672-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666928718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928718, "uuid": "e6710629-8645-4477-ab52-264c99cfdd09", "comment": "Malware payload (GCleaner)", "value": "a665c00f2c1727927e895527de581ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928718, "uuid": "04880989-4c24-4265-950e-15aec93bc255", "comment": "Malware payload (GCleaner)", "value": "3a1d2b366ac701a72fa80601b1ad621a6e1c912755c760d5a0ebbad79207493e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928718, "uuid": "4c6c473e-b0d2-4560-a27b-8a883c43eeca", "comment": "Malware payload (GCleaner)", "value": "6737ee87e15589d8ef0ea093cff6940956510f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928718, "uuid": "e436fec6-c608-4c7d-a665-456c665940bf", "comment": "Malware payload (GCleaner)", "value": "c6a375c84c09df5d8ffd6d9f7f31de776759c0e70b125586e35dc07b9d4ad1e6d9da9e5bf7e4d724568ec998b4e1e4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928718, "uuid": "6ffa4721-6cce-4045-88e6-cac3e0009c28", "value": "T16DC5339A82B59531C012DDF88C3B2D2CBFDF6E954CB8A0AA32DDD4491E3094CED27765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928718, "uuid": "899d4d9b-620f-4416-9b71-0e64e04cecde", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928718, "uuid": "9b8362d2-03e9-4781-aff9-4100bbb0d438", "value": "49152:Z28ei0CPByVLp2EmdMyBxt/0OqSivII5qckKjm7TDzkIjIzEtfMiA5hq:MzNp2jPvt2Sivj5qcbYLkI0uADq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666928718, "uuid": "76a4149e-1402-47e8-9909-243d5b173ce8", "value": 2553259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666928718, "uuid": "33ea27c8-87ab-4f4d-b156-651b366261ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928718, "uuid": "2df6d595-ad75-4e30-b52c-c3fa779aa7e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f05d07c-5694-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666943157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943157, "uuid": "7c65c941-f4d3-4451-9fcd-046e90ab7e7d", "comment": "Malware payload (DCRat)", "value": "3e3f004811dc24abc0f1dfbfd0ce488c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943157, "uuid": "4896c70c-2701-4430-bbc3-047c909d36d6", "comment": "Malware payload (DCRat)", "value": "3a2b4ccda0e38fe4da06774a523934d5cb231d504188ad29e0b51a88323b386d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943157, "uuid": "dfb7fe25-2a37-47a0-9b2d-8f0733de80e7", "comment": "Malware payload (DCRat)", "value": "c79b9b448908992d8268b1eda450503001c44a66", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943157, "uuid": "9b16ebfd-d7b9-487e-bd3a-df4eeb4b05b3", "comment": "Malware payload (DCRat)", "value": "122ca0c8febaa4cb1ac2f9a78d9aecb2565bb0786ffc336f30bda0b93b49aaf3f20d02fbb9a51e75f64672e9d2a66b2f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943157, "uuid": "1eb0f581-37cd-4e1f-b1b4-194a4fcfcc25", "value": "T1D95529017E44CA11F0181633D2EF85644BB4AC216AA5E35B7DF93B6F252A3937C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943157, "uuid": "fc937004-7c0d-492e-8693-b8f82a77e013", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943157, "uuid": "862fe730-3deb-4409-9c20-588247dadd4b", "value": "24576:O2G/nvxW3WiKNWeNRakrSu1sJBRVif0e4UQg8cH2a01:ObA3BiWuNrSp5iaLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943157, "uuid": "da2605d4-90e0-4a2f-80a1-b7c9d2d481ed", "value": 1293906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943157, "uuid": "bd3549e6-f89e-44eb-aa6c-5f0705fa57b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943157, "uuid": "f24f6d5d-6ef5-4822-8246-d9219b370101", "value": "3e3f004811dc24abc0f1dfbfd0ce488c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d21296-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943735, "uuid": "499aee11-9ff9-407c-8b90-2aa99b9eec09", "comment": "Malware payload (RedLineStealer)", "value": "4b3e22f3dac10f871c5c2dd028b2e99e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943735, "uuid": "8499fbdb-e75f-47e3-a006-7cf4bda6ba88", "comment": "Malware payload (RedLineStealer)", "value": "3a4177611fde4217e666f78a01aec8b3d60539a0ee8bf2c47b315a3933104a0c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943735, "uuid": "8862e168-090e-42a2-a55b-e1c0259e4b41", "comment": "Malware payload (RedLineStealer)", "value": "cec081c311042480974149b088181232df1a2274", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943735, "uuid": "b4d5d11b-accf-40f4-b694-1777d3c89eee", "comment": "Malware payload (RedLineStealer)", "value": "68a6e2176ecd06cd396de7308e73ad1a64afc59205375fef4ba0d441e01097c9422914963d179cfc561c319ca8f3310a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943735, "uuid": "f74da65c-ba86-411a-97da-740be5473e3f", "value": "T1385502AC74B4B95AF6D4837BC6812CF6DB3CA540D7993DEBCE2040563E8310E5F6A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943735, "uuid": "9431f625-d50c-4743-9a1c-c56bb3272438", "value": "12288:0cNUn0uDx3ijU2Y4SCB1U8S5Szyfi+s9tEQc:lNObDx3ijtYXE9S5SzUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943735, "uuid": "6fb610fd-b36b-4719-8343-ae26101d26aa", "value": 1323817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943735, "uuid": "744aa224-f91a-4cec-af80-ff9f65b8e31b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943735, "uuid": "08b51409-8c1b-46e4-8a49-1ec594ed8a3e", "value": "FL Studio 20 Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496753bd-56ab-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666952918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952918, "uuid": "5df1a448-bd08-4748-ba85-9040c740514f", "comment": "Malware payload (AgentTesla)", "value": "e95b2f6e6bdc2301c67c32388a5f54f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952918, "uuid": "25bbfa81-353f-4e23-8a19-a8fa7ad7996e", "comment": "Malware payload (AgentTesla)", "value": "3a5b89fbcec7dbba0e57d0aa74b126c3d78c2cf753b18c7dcd8e132c1c4df3c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952918, "uuid": "68edfcd8-3611-4e12-85f8-d6932d7bbe69", "comment": "Malware payload (AgentTesla)", "value": "af76d58f165f6f893f4d497b7a2544bd549463f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952918, "uuid": "b0c93e3e-5f3b-4a8a-abdd-873fccd9acd1", "comment": "Malware payload (AgentTesla)", "value": "be93ccb6832a081bbd6a91b934e496f0755871ee7bcdf8aa0cda1ee1673ea871a0b833c2745bf71bd7b038b8bc29489b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952918, "uuid": "e60c1c00-990a-4406-a0ab-6df7f5cbc9cc", "value": "T1F2B4AD362C739001FFFDC135BDD0739092A93ABE9CC90F86E654B9DA35632D196709A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952918, "uuid": "9306a508-97fa-473b-96f7-b68e533bf7f0", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952918, "uuid": "c64e9e6a-d7d6-4f7f-8ba6-62f3839f6528", "value": "6144:dweE9WrzIJJH/QZrRVDw1AoXUx+frXWTwPygVtnXrUYoWgZjBlockv:8azILfCdMAsPbVtXo/WsB6ckv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952918, "uuid": "e49725be-ca31-471f-b23d-d7bedb79f09d", "value": 508475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952918, "uuid": "f2c0feb2-642d-4030-8903-c7a7cbce9c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952918, "uuid": "f3f2c5bf-a7ea-4e58-ace6-9f29f9727e08", "value": "7091336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d704fac9-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937265, "uuid": "a59a2829-60e6-44aa-b0ea-8c2c785bd822", "comment": "Malware payload (SnakeKeylogger)", "value": "8e66cf46ca6aead543f733f3afd3d965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937265, "uuid": "c29f3eef-539f-43fe-9291-bff9b7899989", "comment": "Malware payload (SnakeKeylogger)", "value": "3adfda6dc7720c78135fcccb714e09432afde40e5d05669d6c27a4f850ec33fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937265, "uuid": "e4d0c05e-bbcd-41ba-a7a3-52fa0545f623", "comment": "Malware payload (SnakeKeylogger)", "value": "a32c868dc8a221b740eb43bab99d4f964f828d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937265, "uuid": "79569a91-fe72-4676-b377-6577750a63e5", "comment": "Malware payload (SnakeKeylogger)", "value": "48ca2b41afddd4a9dda86e001d3827b39d6f295725aa403cc9e95f536ee3881dd44a64663d37b3a5dab6e910b4ac5efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937265, "uuid": "8918ffa5-b4b1-4e17-ae16-7b3ff5ceb189", "value": "T1A4A423719F09E2B3CE632333E91D57A827BA4AC479B544AC04C5FA1911EBE4B521FCE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937265, "uuid": "7707f06d-3a2d-4eab-a0b2-d0f0672bd76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937265, "uuid": "c414b55b-cc15-4683-928e-208ca3b46443", "value": "12288:Gh7KWfQWxMA08H+++je5UEk28A3RD38oF/EyL:7BiMJ8f+je5jky1/EyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937265, "uuid": "0b215ca1-b7c5-4a6d-a941-107c8ff71798", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937265, "uuid": "04396f2a-0233-4870-90e7-188a81b2aef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937265, "uuid": "48beb47f-9fb5-4b1a-a810-f16f5bcf46f7", "value": "invoice 010220089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add84c80-56d3-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666970267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970267, "uuid": "10aa2b36-86c7-4ab9-9095-6464b2bbca24", "comment": "Malware payload (Loki)", "value": "c566c73ac988f410ec4a081e7041662f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970267, "uuid": "64c70cef-e779-4ea6-9e46-12194a49def7", "comment": "Malware payload (Loki)", "value": "3b4dc97ae1b5e981715bb60130f7867d7e1db77a2887302d98a7f0bd8d0d425b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970267, "uuid": "6aeda220-3a24-4352-bfb2-34259e7e0c5e", "comment": "Malware payload (Loki)", "value": "822523e75a07004dd38dcd4c369f6652a72de392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970267, "uuid": "48597b89-afdf-433c-8471-2ddafaf7f472", "comment": "Malware payload (Loki)", "value": "fd7660a7906523e85b91f35d54ff0846a10cde9c43b308bc987cf3ebdcd349d9e9f2ccaa91afb0feeab27cc67e9cdd8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970267, "uuid": "9f0250e3-8b79-4705-9623-b03c27fc61f3", "value": "T18E24123061D1C0BBE4820BB599796B7693FB835035AD960B23BB2F73AC754C76B05392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970267, "uuid": "cf14b200-121e-487b-ae73-9bf57b647bda", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970267, "uuid": "44b90d42-935d-4794-9054-a924f4f9824b", "value": "3072:qUJoFfWzzl+cSMeTPACnBbDWxnmid+pbmY2OtGujf3tPk+hxfqM927ZVwniqjTh5:qweEp6xWxnmX/JtNL3tPh5qM9QWDvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666970267, "uuid": "a011bcc4-d948-402a-97eb-c36ef149e6ee", "value": 229843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666970267, "uuid": "3a27530a-e99a-4257-a422-ea680b105b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970267, "uuid": "0d85526e-ec61-48b2-966d-98be6aa297f9", "value": "Shipping_doc_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80f07df-5655-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666916248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916248, "uuid": "eb7025b9-177b-4a75-834e-9e5e41b995ad", "comment": "Malware payload (GCleaner)", "value": "79a19284a65f89615bc95e2a0850f8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916248, "uuid": "9bf2085c-0c74-4bb8-a8e2-72c28e5c5322", "comment": "Malware payload (GCleaner)", "value": "3cb3e60ddd980b22e9a03d597b9d002afc88698ebfd00f9596e8ce61cc0fa2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916248, "uuid": "1b15d438-8bd9-47c2-93ac-a08601da43d8", "comment": "Malware payload (GCleaner)", "value": "391fa8a08586ccd75b1d98b571b51be9cc92c608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916248, "uuid": "21d87b81-0c35-49ea-afc4-e46c023134c2", "comment": "Malware payload (GCleaner)", "value": "87ee0202c69a1449e5d4210b25682fc260401de676260240e237866c2fafdd09cd8dda298e008528b1722b64df0e87c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916248, "uuid": "dac0fa4b-50ae-4a46-b4fa-34d5685c3ad9", "value": "T167B53319C6B0E63AD356D9B8DF794B11C7401D9109BCEC84FBCC8AAF4A51EC2C58E7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916248, "uuid": "b70af619-67f1-46a2-acbd-3593639abe82", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916248, "uuid": "ed524575-a35a-488b-a60b-b717d044872c", "value": "49152:Z2IvwGzsfwSMcdOFaDuY4lURSZqBZ8AnnDlSOOD5xJv+bdrvOA5hq:MIvnzsfpMyZDuYrRBB9DlSOI5xIprvtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666916248, "uuid": "17486549-0674-4cb8-ae2b-3cc476b6dee1", "value": 2447860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666916248, "uuid": "a1808c12-f24a-4ab5-b8de-861c90167f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916248, "uuid": "ce2af921-d4d7-4185-ba76-9afe42020530", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d1d0a6-568b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666939140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939140, "uuid": "907434a4-5891-43ce-924f-917f06405802", "comment": "Malware payload", "value": "b7121e903157b5f4f00903aca7d762c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939140, "uuid": "d3720242-40dc-4d4a-a865-6190a1334335", "comment": "Malware payload", "value": "3d0cf6db616d4549d18e9731a9d4d205e071fbe3c12ad3e5a0ad3ae7bb3bc0de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939140, "uuid": "a915aff1-6787-45f3-be23-c878998f1bc8", "comment": "Malware payload", "value": "76ad2cf7339acdded47089bb65d04d3b1ce90ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939140, "uuid": "deeb1d4c-9e02-4d17-bd5d-de9fd15e9eaa", "comment": "Malware payload", "value": "341260cfda506b44c0f661feb12b7f45d59d86144954d00b177410ac14496610be1cb36a36387335b26f028f2a3c90df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939140, "uuid": "f58d281e-7281-4eff-82bf-956e1a7b78fd", "value": "T18D7633B13A469D79D9556CB292D14B09A2FED8242FE2DA771BC4020F0E7C5B8C472F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939140, "uuid": "9adb5c1b-0cd2-4e2a-9c63-86d5cd3abec4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939140, "uuid": "5f784e95-8566-437a-93bc-986b08a4f7af", "value": "98304:91OAaUnatRN3NWsrZ1EDb4+tNJR99t1skDVzwpoEjlJnbjPqndl+y/jzkU7dUlfS:91OqatBrZqHtNrbswAB/Pqnvrilq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939140, "uuid": "5bf77c1a-599e-4864-b45d-677956a44d31", "value": 7635990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939140, "uuid": "5370eb04-9936-4c0b-9a40-8a674a091b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939140, "uuid": "adfc2c97-3a72-4eb1-8956-e88cccfb265b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4463655-56bb-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666959970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959970, "uuid": "2f0718e0-127d-49ae-bfb3-40e29efc1d9a", "comment": "Malware payload (CoinMiner)", "value": "abe419dadc519b178787ade78bfd8764", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959970, "uuid": "24e1ccba-b538-44a2-bdcf-e92cc32ea392", "comment": "Malware payload (CoinMiner)", "value": "3d209bd2241f74c0e58bfb19836fdeeb54ff226c2d781f91fe677b3599cbc806", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959970, "uuid": "b62795a7-10d5-4559-a870-907a56948a4d", "comment": "Malware payload (CoinMiner)", "value": "a6b0246ace402f82f583a734f6f34b451ecb1b22", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959970, "uuid": "e98b3683-b744-4b1c-a248-e9f41708d86e", "comment": "Malware payload (CoinMiner)", "value": "37967e26ffc897aed1cde5783a61e17915072b9c25d927c832b1f26666972be44222de7e75c04040536f46e2a9097ef0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959970, "uuid": "0820262f-21af-48b3-bc4e-642d3836c12d", "value": "T1CE44C0317992D471C0811630456ACFA01BBEBC312A747A8737A43B5EAE713D09A76F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959970, "uuid": "bb988f47-cdc9-4f88-986b-4df625660676", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959970, "uuid": "395c341d-06bd-4cf6-953c-b7a8becb15a4", "value": "6144:trUHYLfxvwqMcOgrN2Omdn9VyXPJbv7O/e:trUHYFvJ8gSdn9w8/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959970, "uuid": "53504f0b-0b90-4e57-bad1-cb0124db2c04", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959970, "uuid": "b87a6868-f2f9-495a-97d5-53f2ade45a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959970, "uuid": "2164bf1b-bc7c-4964-b116-f358cad9cfbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b29c140-567f-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666934131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934131, "uuid": "d29ba37a-6cab-48ae-8ad6-9a84fd35f6a4", "comment": "Malware payload (DCRat)", "value": "1a1c9374d843cc49c203ba9b72883cae", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934131, "uuid": "7ec210a6-8438-4704-80c5-572e01f885f8", "comment": "Malware payload (DCRat)", "value": "3d2e5fca23c3e04d3736fcf3428b93423ca3543c2ceee7e41aa0951b0efd54de", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934131, "uuid": "2105ec4b-020c-4d21-962b-afcde9ca0dd3", "comment": "Malware payload (DCRat)", "value": "0c2c19e3dcc4e4f54366561830b1a0b2e1768314", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934131, "uuid": "4c99d518-2bdc-4a95-b62b-11fc5b391127", "comment": "Malware payload (DCRat)", "value": "142357db5e8b124c9e9d9815ae47b1af8f358569b78abab2ac2a2bcee9b8b194202fc16b8d73600e9369ac414254ac7c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934131, "uuid": "f870f1d4-3b6f-4286-a462-67fcaec85194", "value": "T120557C017E54CE01F0092233E2EF454847B4AD556AA6E32B7DBA37AE55123A37D0DACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934131, "uuid": "bfb72690-40cd-44ee-809e-7c439b6cb0b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934131, "uuid": "d736cedb-fdfa-43f9-bdba-34c6e8d94266", "value": "24576:YauwrMM/wRk3oO+DQuKoJX0N1SMt7hfhyORWNb6Yyhvn+xG0lcC:Y9PyuD4XSO/PYyhvnmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666934131, "uuid": "e57b0d6f-5ad7-40b8-8019-1bc732c6f58a", "value": 1349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666934131, "uuid": "8b76ce3e-c9b5-46f0-be51-7ff7033870a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934131, "uuid": "07287629-a917-43f5-940b-d716a910f9ac", "value": "1a1c9374d843cc49c203ba9b72883cae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e4b91a-5713-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666997787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997787, "uuid": "5b4cb56e-064d-43fa-bef6-6ecffcc6e1eb", "comment": "Malware payload (Tofsee)", "value": "528f3dc43030d6230041bd63bcfeeab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997787, "uuid": "5290bdf6-2f5a-4b33-a08d-140aeedbc721", "comment": "Malware payload (Tofsee)", "value": "3d70882087c836bfbb9ed3834278bf0383c00def854b2b469c0e11b54957a5ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997787, "uuid": "06b538d1-0d67-4dad-9e25-b78a31c7b2e8", "comment": "Malware payload (Tofsee)", "value": "050a09a3873513d7aac2f4061238a5fd13dee264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666997787, "uuid": "16a4da40-249b-4075-8f46-0c41e93b106d", "comment": "Malware payload (Tofsee)", "value": "85d6d33606f112ea67a621e150df65ef6ed538c6ecb0f88a7de30ef5384865fef57caa7133ad407d0a7f319be3504d3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997787, "uuid": "c9c4a11e-2a6e-42d0-a4cb-b6801f92274e", "value": "T18344BE35F690C432C09617304925CFE0667DFC3259698A7376AC3B6EAE323C1666627F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997787, "uuid": "b318fd2e-6e66-458b-8333-b933b3cf4c7f", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997787, "uuid": "0d486a56-2124-4871-9d00-98543fca1ff0", "value": "3072:N5Q0nBfZrdBLYlzKJz5hZZrjTE+Be6is2QCzgBiEeoHdP7I1XMiIc6M/h3:s0nBBZBLszwrjzli8IsiLIRIBIc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666997787, "uuid": "dfca6bd9-29f6-4119-817e-24bed5ac3180", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666997787, "uuid": "2b63b440-7d39-41f5-b2c5-ab199be91206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666997787, "uuid": "59f94af2-045d-4989-aaa0-89f8bb6c6f97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a974d736-56ec-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666980997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980997, "uuid": "755a6aab-f6ca-4511-8f97-552ca0ea1cc3", "comment": "Malware payload (GCleaner)", "value": "4fd4bd9b10bbc975f5ab431f96117ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980997, "uuid": "2cd2fd92-db90-455c-bbf5-c2540c00e03d", "comment": "Malware payload (GCleaner)", "value": "3de4c55b95d5f5797fa32432874e0407700dda3a214be1442722ef3fb0f9dec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980997, "uuid": "fc3eaa53-02dd-4f19-a39e-e12440d96492", "comment": "Malware payload (GCleaner)", "value": "d7574c2854e28c18e23f46c50fa250f872de790c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980997, "uuid": "4cc8aba8-aefb-4e15-ae3b-f9744020408f", "comment": "Malware payload (GCleaner)", "value": "d4e2d97cc9dd4986f0c243a0bc5adeafdaaa5d2cc2ba502d03918c38f4b869e2be4842e31af9707a48e6b20754c0b67a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980997, "uuid": "1f7ef861-d1ef-4ec5-8f66-deadffbf4f04", "value": "T153C533CB8FA004BAD411C4F07C6DD99C66C36247A0FE3E64B5EC34A4593398AD9277B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980997, "uuid": "5ea5cf61-8478-4481-b102-f7c6301ca35f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980997, "uuid": "b5f83988-2954-44af-a45f-d1a62418b848", "value": "49152:Z2kbiByPsshLe3qb6sD3SWIRJu32WMRIzNMrlD744KKce7DlyA5hq:MjB3qy3qn3uRJu3cKsl/Vc+D/Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980997, "uuid": "c700204d-3bda-42bd-9752-f027b53004f9", "value": 2594413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980997, "uuid": "8dc1b55d-56e0-4387-844a-e8fb3e9ea06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980997, "uuid": "512d6410-93cb-491d-880b-c9efd3033c02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cecc52-5703-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666990685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990685, "uuid": "41b1f5e7-ab1d-4920-8d65-23b7556e8af3", "comment": "Malware payload", "value": "c446e68d647897db88a161289f4d4635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990685, "uuid": "9bfbe498-3e4d-49a2-8293-282946ebebff", "comment": "Malware payload", "value": "3e6471fe0cd370a3fa47ffa76664525b9e190aeadd9a0446f3f2647471be84e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990685, "uuid": "9af7f4b4-33c8-4a88-a028-2082770ccf58", "comment": "Malware payload", "value": "6b58f77ef7ee340388452250d47adfc4eec3a3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990685, "uuid": "e2d3d119-d8b2-40ae-b02d-36e2c8ecdc97", "comment": "Malware payload", "value": "046c4704e8374b170016fbbb31011b44361b88eec78264bfeb9427986c4fe6d86b16ffd4ea46366b2d2e9e7568ec7c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990685, "uuid": "ab098cd5-0c3f-4264-a510-2ebe7fe07816", "value": "T11FD533860B05D098E2B95139373234D8C4D175D7E08D602C366EDB0BAF3F7FA9A64E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990685, "uuid": "e69c954c-eaf2-4b19-8ff6-03834a9ffc5b", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990685, "uuid": "73ad7f8a-87f4-4a64-b6bc-3bb98bedaad5", "value": "49152:COPTF0v86Xcbox0yXFzs1IBXQAOxf1W+D0dqrL4PhruxVeIz9+Q0VTlxysk4OaJV:BPTF0vr9RXhTBbOB1Cy4PhceY9qTlxym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666990685, "uuid": "4f177a85-2b6a-4d02-99f3-2e7d0146a2db", "value": 2949848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666990685, "uuid": "2c4103c4-5bdd-4fb8-8dfb-912cc7d414af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990685, "uuid": "3dae0ace-84dd-4049-905c-f3c3b6731d1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244ac03e-5685-11ed-9266-42010a9c0072", "comment": "Malware payload (BitRAT)", "timestamp": 1666936535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936535, "uuid": "613b0736-5581-4c86-8fe1-023237bf86bf", "comment": "Malware payload (BitRAT)", "value": "7e9811681ab52fd4e2ac4441f6a3cc20", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936535, "uuid": "80cabafe-f1f7-4f48-af43-024f7f36b9f3", "comment": "Malware payload (BitRAT)", "value": "3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936535, "uuid": "d2bda747-8522-4d52-bde4-5b32cf0d5bc0", "comment": "Malware payload (BitRAT)", "value": "201d2cf050703a3c030d996c01812ae7804f8008", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936535, "uuid": "4a6f1f30-f015-4036-b185-fd0eec56f18a", "comment": "Malware payload (BitRAT)", "value": "7d07d902be69968a13141aef9eb95b209b999b9de2931ef5ffb65d0ea1c462beb706d9da02c03aae71f07955c3cabdff", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936535, "uuid": "881908f2-45f4-4901-b998-bbc313ecec71", "value": "T1EF8523291F9FC536CB66087F1F93A9063F4FBB3143E6B2F26AA705194CBB5958812580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936535, "uuid": "472809f7-b881-4b6a-b041-67f5a71a72df", "value": "49152:1BteuU1W+Up1gB9/hsG5jtSXWOjhGBRjIugWeRpTC:QuU1F2gH/mjtGBxJgWWTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666936535, "uuid": "d9e1f80c-276d-4999-879d-21bcefabb66b", "value": 1776128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666936535, "uuid": "79131115-5204-4203-8bb1-d40dab210f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936535, "uuid": "56e38438-be0d-40ef-a5ce-1670e6f3924c", "value": "a1d9736DPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b2f1c5-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1666949340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949340, "uuid": "6f85c71b-7d75-46f7-9b9d-9908fe702b12", "comment": "Malware payload (a310Logger)", "value": "cb914f3634196598e82630e2541056c7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949340, "uuid": "1e99b574-b679-4dcf-ab87-5d24c5c7d1a1", "comment": "Malware payload (a310Logger)", "value": "3f85a033bb846b12cff06c5d1eea67296f66fa5c0632b38bfac3bf93d496022b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949340, "uuid": "09067e07-1975-420a-bea2-a7926f343af2", "comment": "Malware payload (a310Logger)", "value": "ffceaea16f97b690d5e812c55fcbc7d3bd6af786", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949340, "uuid": "20550081-e435-454d-8272-e0e98a76261e", "comment": "Malware payload (a310Logger)", "value": "319d627c0ab85929a93e2442c1a4d38b1133f1dc2873a7a0312b3e831abda08e78e2bd1159f16c886011ed75d14dcdc8", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949340, "uuid": "844ee5cc-ece8-4add-800f-bca6aab5a892", "value": "T17A932000CD900EA2D97BCE726C334A828FAE5FE7C6649AD5345C32C4DFF35923626256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949340, "uuid": "758e648e-9599-452b-b81b-6b18b1afd866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949340, "uuid": "a737cef0-5d21-46dd-90cc-c238b10facf3", "value": "384:cU9HgmWfNUxzXAV8F5av8+Oe4BbT0O0g0T0J01lJ9w8uy20DhB3LyDQT/7rfWFci:cUxENAvFgv8G7gnxtYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949340, "uuid": "65193315-b435-4104-9421-2775b77bd6e7", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949340, "uuid": "fb180153-d9a9-4a4f-a267-e09dde04229b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949340, "uuid": "c167378d-69b0-4eac-8843-3a38f9e68485", "value": "Ziraat Bankasi Swift Mesaji_20221028,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab3e9d9-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666937673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937673, "uuid": "f1fe9950-d24b-4386-aaf5-11f0c3d56e6e", "comment": "Malware payload (Formbook)", "value": "4d3c876fc949d37fa40c845fbeb04e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937673, "uuid": "ee92c98e-61d5-441e-b636-5fa2608548c4", "comment": "Malware payload (Formbook)", "value": "3fdd151be1130daa30b97fd53420ac6ccd214d36dd14083d7b3ee557956277a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937673, "uuid": "3a5e1f1b-b99f-4c84-bc95-4b99e1f66a55", "comment": "Malware payload (Formbook)", "value": "deb8cb48363650f9e6ef21d426062fec017b8ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937673, "uuid": "b8d79927-7bfc-4933-85cc-e7f095d56361", "comment": "Malware payload (Formbook)", "value": "458c23c540508986189fedacb42b0487bcebc23f8924a397b037f4e531aeaf4d8a7e49ac4d16b9d35bccade5f49010ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937673, "uuid": "e439abff-59db-44a3-a431-5a20a2ab79a9", "value": "T15D140ED06B5ADC3BF488B474A6858064BE8EBFE5F4E345CE244DF64A4A3279144F0D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937673, "uuid": "fe1f4b06-2c0d-457d-9013-402ece331595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937673, "uuid": "b8a99a07-94a6-45ee-9a2a-a3bdc141af08", "value": "768:shTZuhObnAApqu3oiIBNzeJkusvx/SFjMbd05C3d4OoxHrKtSDj5R0gtYcFmVc6K:sXukbtgMmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937673, "uuid": "2159318a-610c-47cc-8d39-f802e8bdfa4d", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937673, "uuid": "620e2db2-ef34-46c0-99d2-72a1a4d9aeea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937673, "uuid": "7b4de139-8ba5-479c-a856-1aa9eff3a5c0", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c7015c-56b7-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666958014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958014, "uuid": "a35655ce-fccb-4fcd-8676-e53a1dfb9495", "comment": "Malware payload (AgentTesla)", "value": "7739c713ab24ab08e379a740a1b59214", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958014, "uuid": "9c7404ed-e2ee-46a3-af3d-c6d57c31c1fb", "comment": "Malware payload (AgentTesla)", "value": "40c8a5e80fecc8b1d3aa93ec9fdcd95e92e52bdbff1dcec111db70aa670b27fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958014, "uuid": "4d2066a2-7667-4cf6-b451-f4a89ea78f61", "comment": "Malware payload (AgentTesla)", "value": "274dcef82734a6f93b5f098db068bd676c4c2220", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958014, "uuid": "d8653f00-61ff-467f-9613-f3b237aee159", "comment": "Malware payload (AgentTesla)", "value": "99ee828e9b02fd72f8e90da6bc398de6b37e46b6c5984f69953c5c3033bc4d403e1b9d20c18d958b4e591dea6ded5235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958014, "uuid": "b4d22b42-a21e-488b-977f-6d341b2c49a7", "value": "T17204E6B2E3C1C474C6484677C2D17B29337F9F42AA2A1D1AB83A7B5A5D39364BC27305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958014, "uuid": "aaf55e5f-aa90-40fc-9577-065a7b8c5139", "value": "3072:Xk3hOdsylKlgryzc4bNhZFGzE+cL2knA3DsNiXpyj0PPpBjp:Xk3hOdsylKlgryzc4bNhZF+E+W2knATF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958014, "uuid": "56093969-2949-469d-993b-213dc771a27b", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958014, "uuid": "ca50232f-505c-4547-aae3-462d244f3050", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958014, "uuid": "64684086-4af8-47b9-b5e3-0cf583c48975", "value": "ARRIVAL NOTICE.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b7156f-56cd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666967436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967436, "uuid": "62703724-8d8f-4c49-baf5-f5b46538b673", "comment": "Malware payload (Amadey)", "value": "5adcdf648ed5f67f1e841444b496a272", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967436, "uuid": "84097dc6-25c4-46d2-9612-e54a7a48ad0d", "comment": "Malware payload (Amadey)", "value": "40dab3229be6b602ce6e14f6472dbb32ba8ea0dcd6e5c8e02619138c7dde707b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967436, "uuid": "e004c183-78f5-46d1-886c-0578b72d3d8a", "comment": "Malware payload (Amadey)", "value": "7664b90e7e911071aaef20582c699fd5cfb418ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666967436, "uuid": "8c6713ed-73c0-48a2-920c-5001bfb4e91a", "comment": "Malware payload (Amadey)", "value": "2f4a1b8f45398056052cbc196030649d0cd2909cb8de0fc5b0acf2ef959615068c2520301009994d7e07d2a26ef21a03", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967436, "uuid": "5037681c-4c00-421c-b807-36a844026d06", "value": "T10224CF223AD0C072E26701759861DBB46BBBB8700B315A9B7BC4977D9F316E2DE75302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967436, "uuid": "b83fab42-2635-4f3f-ab81-38fab2abf105", "value": "9277faa69a3b2f155b9e8565ccbc8235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967436, "uuid": "baedf4b3-cc08-4d58-a95e-8a8a86ac6b4c", "value": "3072:ZDnNTW9m28lJCOyRLMO6pwn86mP5S8ohL0sKGALfnOPHk29od6h18X:ZDVWcR2RLhn8DYBiv7nEEPY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666967436, "uuid": "94c174b1-cb23-44c4-a2a5-83929ffaadb8", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666967436, "uuid": "ae4774ae-98dc-4835-a16c-8a8621c724a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666967436, "uuid": "a4df2534-2d53-418a-ba83-2b8fb0c8cb12", "value": "5adcdf648ed5f67f1e841444b496a272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deed8f1e-56af-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666954887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954887, "uuid": "66ee27e5-9974-43f3-aace-fa1e3eaee634", "comment": "Malware payload (GCleaner)", "value": "89a77e100510a9f2e359c9db766f03a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954887, "uuid": "fba55192-e645-4d4e-b9da-d1a0532749cc", "comment": "Malware payload (GCleaner)", "value": "41e71c47d29eb9de4f6b83185e8ba69f0d4eb3a21e07049bf15a94d9ffb27bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954887, "uuid": "ae5ebb14-191d-43aa-9c9f-8be092eca081", "comment": "Malware payload (GCleaner)", "value": "6508f449040064f0845da9b15b1bc547e2999691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954887, "uuid": "6698aebb-10c5-4ff1-9363-b291c47c888f", "comment": "Malware payload (GCleaner)", "value": "008bd5292748d98f57db6e0279f77e1a57496f132dd9cd85785cf05a9062e56bbe805d2ad037e7798ed04a7fb4e5fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954887, "uuid": "1e37f890-addd-486a-91d1-7400ff7f1b4c", "value": "T1FFC533678B33DC30D0808B7EBE19D6AD5A36A5F5297DD0A17B0C48CD1D372A5EC123A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954887, "uuid": "7b1b3a6d-4e42-4afa-8cbb-f75669a6823c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954887, "uuid": "dc07a14c-ac5e-4623-af55-5f4be8119e13", "value": "49152:Z2xL/HI5oxfLMQopX11ToqCLGonGVjQtaI00efo1vOezgTZb5/3gHLA5hq:Mq5YoQIXD/kGonGVnZo1GqDcDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666954887, "uuid": "f745ee13-aa4e-4e40-ba66-f97b3781a0b4", "value": 2623607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666954887, "uuid": "d5692c79-240f-4503-9639-cd3259a8b287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954887, "uuid": "05966df1-331c-43ad-8b3e-a7cb7a826975", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46fe08b-5697-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666944589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944589, "uuid": "8c978ad4-1e73-4469-b60d-9512e9ce60e7", "comment": "Malware payload (GootLoader)", "value": "f7e66110cfdd7ffec3272765cb982cca", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944589, "uuid": "7b121c8f-4f3d-4e99-8f79-f8fb2923bedf", "comment": "Malware payload (GootLoader)", "value": "4221be8923edff2dc67bb51a2aeade6e13de30257ea64f5d234849dd46d9a126", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944589, "uuid": "ebdc198b-34ea-483b-8dda-aed8eda4dd9e", "comment": "Malware payload (GootLoader)", "value": "a3ea632b89156ddf91e08b84b7720eff7c169aeb", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944589, "uuid": "2b05d2a8-4cb6-4b40-ab4e-4c655a67cff2", "comment": "Malware payload (GootLoader)", "value": "98f78ed71497e67aaa1991f184c5fb9106fbb884ed9496f0eeab5d9989886b9fa9199ef5a4735f93ab7a6442927c4855", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944589, "uuid": "462361e1-35f8-4441-a443-57736cf95901", "value": "T1BAA2D11AF801A047A4F7D971991819E4A37F46D80D0DE9017F68EDF0C5EA21DA18F81F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944589, "uuid": "ad165375-ed54-48af-920b-b0233e024478", "value": "384:yFbHiFXInHlTfrTZYpA4XBsZ/BfsM5rIFJga9wmm7ty7KHKK+ggMexNWrdX:yRoafr/4eJBfN5ggfmoBnbkWxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944589, "uuid": "720b8b55-6a9c-4407-abf5-d99a09562545", "value": 22361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944589, "uuid": "2dd72640-c2de-4e5b-821d-7c05bbd5ab19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944589, "uuid": "ecc651d7-085e-450c-a0cf-fad7298299bf", "value": "Which sentence has proper subject-verb agreement (51695).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8227912b-5670-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666927673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927673, "uuid": "f91de3fa-f3e0-4d95-b254-23863c817e0e", "comment": "Malware payload (AgentTesla)", "value": "09629af1babef1756931d963e7725027", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927673, "uuid": "ce5accb7-80b7-4f5d-98a7-ceac30da6ff6", "comment": "Malware payload (AgentTesla)", "value": "4235176a2ecb85ace89f817aed30d855bd2c9f1a9e2d5a0b421e2199e45964f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927673, "uuid": "90bdbec7-0795-47fe-bece-83552b00d581", "comment": "Malware payload (AgentTesla)", "value": "875aec9ff02c2433ca71f2212fe93c52088fbf31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927673, "uuid": "3ca36d37-0239-4c9e-bf24-07b6f741b421", "comment": "Malware payload (AgentTesla)", "value": "7edb8f12c496e5fbac5c20d4e85a79ed0c464e48d64fc244e795ff2018adea56a790b892892dff93b700688386221070", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927673, "uuid": "93158b7b-2827-4bcb-ab5f-bc683a6b728b", "value": "T1A9C423A3BB20B63FCABB6B34A85D0B49B73A0D50B5F354BD018EF6DC046F50912169B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927673, "uuid": "4b373418-1201-4e0f-b4f3-2ff5137daa79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927673, "uuid": "629deb76-86bd-4a46-a76d-32b17679b82e", "value": "12288:Mh7W5CcyL06U+Ema/D2xtZuUeCcgP5eclz+5CEyL:x8cw06U+Ev0ZupCcuouHEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666927673, "uuid": "67b8fbed-8341-48e4-9d96-18c62e7aef8f", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666927673, "uuid": "35cd9ab0-8166-41d9-bc97-51ee27d13361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927673, "uuid": "4f34dc0b-12f2-47af-abef-2019b1664c8b", "value": "SecuriteInfo.com.MSIL.Kryptik.AGWM.tr.16426.32519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70e03d8-56c9-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666965987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965987, "uuid": "be4a1a25-fdcc-4439-9d29-12c2633e5e81", "comment": "Malware payload (Mirai)", "value": "6a21ddf02307d0402c83dc6ea287a8c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965987, "uuid": "60b3840e-ed99-4716-b378-f1c397a136a5", "comment": "Malware payload (Mirai)", "value": "425cddfef137b4917a73488869bda5225d02f882e5b05abd4a585e98b6be39f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965987, "uuid": "574f3687-0d23-4e45-a4f6-67dbaa638d06", "comment": "Malware payload (Mirai)", "value": "f46794533ee758ab95a4f9d22a588c5da91c0779", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965987, "uuid": "c88d1251-899e-4aed-bfa5-27ebe8856a3a", "comment": "Malware payload (Mirai)", "value": "ce2378a6f9522afa83f96c23d0c07a9ab7d1d83e90abc1da0d879a3fe45224b31cb0522c333f891a55bb00a5152b9810", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965987, "uuid": "0e053723-bb7a-4806-b4a7-c52bf33a7c52", "value": "T17E331955FC82566AC6D02376BA6E5ACE332173E9C2CF7217CD205B203AC655F0D63E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965987, "uuid": "805cd0c4-1630-4a2e-ad3a-4280225cfecc", "value": "768:OgdqtezGMew65pxcG5U8lUucOejhahVuqd9r8lG+dk8Ty/s6iUB3foNbn/N2wG:OYGhwq4G5UYUufKjWrEdTyd3CNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666965987, "uuid": "9d9e7d56-00a0-4c82-ae69-0c65174cbca0", "value": 51016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666965987, "uuid": "0b06f2d0-02e2-4b92-849a-54ce7101da1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965987, "uuid": "1fd342dd-cfd9-49c9-bba4-26de57a5d3a2", "value": "6a21ddf02307d0402c83dc6ea287a8c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb0bc18-5690-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666941406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941406, "uuid": "2b653491-580d-47b3-922c-3c664c4ca0d5", "comment": "Malware payload (Amadey)", "value": "e92a6a3a013a87cf57f3753d77a1b9c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941406, "uuid": "e1d55009-6826-4403-a1ea-31985e281fbd", "comment": "Malware payload (Amadey)", "value": "42a247529de63a9b43768ac145e38fe9da3adc8b2eed558e3ce11e5cd8bbc0e5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941406, "uuid": "0e35369c-ab72-4c74-853b-cd76040c9980", "comment": "Malware payload (Amadey)", "value": "01366b392cb71fed71f5bc1cd09e0f8c76657519", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941406, "uuid": "267602c0-6965-4f83-8301-e163ac327b7e", "comment": "Malware payload (Amadey)", "value": "35fdd4bea6564eb9dddf6dd498a35dfbe4338b6b0a5965d867c5a1ec944fa77dbee2da8724e38a6fc8269f822c6da424", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941406, "uuid": "dd83dd47-a5c6-420b-ad45-ae0fd199fd24", "value": "T1ABC36D73F1D08872D0710F7CAD5AA698663EFE202C351557B6E94E4C6D3B2C2296D2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941406, "uuid": "86c1fbd9-1a90-45b5-8cbd-f360a8adfeaa", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941406, "uuid": "77e9ddad-3f81-40f7-80c7-4db9aa6a4f44", "value": "3072:Yx7pOYzBekj3tiINwyP7XSSJds3zhrjPcnq4Lv4u9:Yx7ZNhj3vwyOztPcrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941406, "uuid": "9eb6a7ce-4ab3-4c72-8810-0f08430b65f1", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941406, "uuid": "62d0b95d-e712-4b81-b436-9d76d917fc84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941406, "uuid": "46b89d3c-fdb3-42fd-9c31-46c3ffdccbe7", "value": "e92a6a3a013a87cf57f3753d77a1b9c9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88936844-56cf-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666968486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968486, "uuid": "70389a47-50b6-4601-a4eb-915384996522", "comment": "Malware payload (GCleaner)", "value": "e4256502c17e223aae81effce861dbe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968486, "uuid": "7792dddf-1878-4340-b99d-5e652cbdc5e7", "comment": "Malware payload (GCleaner)", "value": "42d7d969cd8283b5ff1e47278c30526dc89398374e65cdc1f241e11bcd0ff12e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968486, "uuid": "046a3929-8a2c-4495-b824-82a65b556969", "comment": "Malware payload (GCleaner)", "value": "697b318a20032bd420ab5c1886e6cd4cfddbad27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968486, "uuid": "47797746-c683-473e-a71a-f51da0edaaa9", "comment": "Malware payload (GCleaner)", "value": "a441a896e822736861cca955b3e14ba28c7a51b7f2b96844b06ad75fd056774524dd66acb07263e53db96bb65779056e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968486, "uuid": "b00a1dfe-3472-4a2c-9c1a-cdaf07225ca5", "value": "T1DFC533335DF38A32C2668A325835180442327D0C9D66FA5FBBDC659B2F77B818C55BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968486, "uuid": "91f45ed0-40d4-462a-80eb-176f0ec6ddd9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968486, "uuid": "76344e07-36b5-4b0b-b34b-28573b077458", "value": "49152:Z2ihw52R8B9sCCKCLddoXYu25U+amEC/QIe9COiA5hq:MD2R2LAJwW6jQECwDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666968486, "uuid": "97d9143a-9059-4b3c-9b38-36fe442b263e", "value": 2577871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666968486, "uuid": "5520c3c3-ede9-414f-9487-823bb1bebf00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968486, "uuid": "9ae23b39-b1ef-4a8e-b8b7-9675eeea6e92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26d1ab3-5665-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666923030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923030, "uuid": "dbe9612a-bd64-4879-9d10-e8effdabe20f", "comment": "Malware payload (GootLoader)", "value": "d77a5e2878ab6e264401339a77cff7dc", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923030, "uuid": "795fee4a-0a33-48a9-a0d7-4e73af2fb5f2", "comment": "Malware payload (GootLoader)", "value": "430371c26b27cec7d5db89124f4e888633bcd63e3ac4fe9345ee65b9e417a3fa", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923030, "uuid": "3a6c1e4f-1a0e-4e9d-ac35-5dc269290f59", "comment": "Malware payload (GootLoader)", "value": "ff8f0e631f973b102be87abd30cd0b67313fd6f7", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923030, "uuid": "7e584bde-2cb9-44e7-9dd3-9438120fb6c1", "comment": "Malware payload (GootLoader)", "value": "6e4539948de2c443d2cfeff400e6b033de1738400ca593226c15514cf115b466fc3d1505040cdd361875c9a14ffc1f9e", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923030, "uuid": "f73c7ae3-a579-4f5c-a575-b119f86d98f4", "value": "T155A2E0BC36F5BB2BD30DE5170F15427AFF7DD2C8AD6FA69C00184BC969EAC1901144A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923030, "uuid": "62695121-2e31-4f87-9271-a9d0e8199be0", "value": "384:sa7fAYY18kqoFQaEfVbJ+n1qjsXAn1Qkog2D27CBcoTV+iVNi/LSAg:N+0fNJ+1GA3D2ecWBNiuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666923030, "uuid": "d888d933-9364-419e-a297-3e69b340151a", "value": 22234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666923030, "uuid": "331dd358-d778-4624-be30-a43566cfb172", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923030, "uuid": "ede92df5-e978-4e41-980d-c3117c87e03f", "value": "Which sentence has proper subject-verb agreement (82023).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3fe4f5-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938641, "uuid": "4042e737-ffb7-4261-965e-32c00ed71ba4", "comment": "Malware payload (Amadey)", "value": "24e5f233787422196e41e36b0e63d861", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938641, "uuid": "1d469ce3-b37f-4ae5-aded-02c377276f27", "comment": "Malware payload (Amadey)", "value": "4487367116d41259ec417981ac5f91850437a53b0a292b93ca97a3b079781325", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938641, "uuid": "72f012e7-2ab3-4ac1-8efc-f49abae48a95", "comment": "Malware payload (Amadey)", "value": "4d0244491be1530ddc71b155466b0040fa20081d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938641, "uuid": "1552f582-6ad2-4c71-afd6-96a4154459ef", "comment": "Malware payload (Amadey)", "value": "040e1d301b1c6d9f7ec998a2010eba7862e105511e3492d8df442808798898b33cf636ddcf6998f74fabdd512adb6f62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938641, "uuid": "44bb5cd6-5510-42da-a4f1-f73aa0985330", "value": "T11664DE327592D772C0811530443ACFE119BEBC361F294A8737BC3B5DAE762C1AA6625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938641, "uuid": "228b7f89-7e7b-435b-ba74-2844e861b4f8", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938641, "uuid": "073bc8ed-e944-4a92-a789-a001a2310f76", "value": "6144:8FfHJLS2wzqMu4KMJRKX7HVvRJ763XLj:8FfHJOpz9u4nI15J7uXLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938641, "uuid": "d948c687-62d2-48c5-961a-ababe2626116", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938641, "uuid": "c3a23426-d0cb-465d-990a-e62a9d4ee951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938641, "uuid": "062ac5ca-0662-42d9-9e4c-0af447273c13", "value": "24e5f233787422196e41e36b0e63d861.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1051db-5683-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666935909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935909, "uuid": "5a1aa287-e2e9-4ebf-a230-60e130a17eea", "comment": "Malware payload (CoinMiner)", "value": "768ed2cfc2caf8c4b6d8d18ce7e4d908", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935909, "uuid": "bbe23eaa-715d-471e-8b1c-f43117c0b9b7", "comment": "Malware payload (CoinMiner)", "value": "4491b4c36cfa9fa3067353b223e606005916e82388bcc612ca9916808ee18c85", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935909, "uuid": "1d8a1c92-edc0-48c7-9cc3-e6d8934c8445", "comment": "Malware payload (CoinMiner)", "value": "5f9918e45710f53181a112f271ce3c3d8c0b8426", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935909, "uuid": "5bcdd2e2-e79a-4324-bb84-fbd1ae0efa12", "comment": "Malware payload (CoinMiner)", "value": "74c4bd3c5f7f7595c27a13b537bf74265f0787522bfeeff5e8b82f4198de9e14972f3cdce5391e02236a184fe73d95cd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935909, "uuid": "fecc1ce6-5612-4221-8e96-0f94604f2fe5", "value": "T18F44BF327592C873C4851E30942ACFA02A7FFC32156C8947F7A4375EAE712B1A96635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935909, "uuid": "f69851ea-12d7-4857-a873-0f0a86ee477a", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935909, "uuid": "6422d627-35f8-47a9-b9f8-64ea0cda3750", "value": "3072:XmRXOC/HLjLX6ZAxNfVGifmlk52EW/hx+NM9DCpANJ393BDed8s+IPM/h3gU7:21//HfLX6Cfsiuj/n+NMFCpANRDuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666935909, "uuid": "dca596de-e43b-4974-b7e8-61c73f674499", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666935909, "uuid": "0e26aa07-b331-4843-89d8-0ec89b96f3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935909, "uuid": "40561159-b98f-45a2-b30d-698b46c716e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a78d1ec-56f3-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666983951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983951, "uuid": "6513a58c-cdbd-4731-8f88-816c4e7122a3", "comment": "Malware payload (RemcosRAT)", "value": "73e14384290554c50e88da3319896d85", "object_relation": "md5", "Tag": [ { "name": "AGOSTOver2.80", "colour": "#D085B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983951, "uuid": "5fd1fd05-0d74-4cf6-89b2-b9d9c052cf5b", "comment": "Malware payload (RemcosRAT)", "value": "45c02c7b7bcf92f477c2d62d4f65090f79cf0fc6e9ae3a0a8d1f9523613e6b9d", "object_relation": "sha256", "Tag": [ { "name": "AGOSTOver2.80", "colour": "#D085B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983951, "uuid": "7e52f2fe-8822-4a46-ae50-b96ff174d061", "comment": "Malware payload (RemcosRAT)", "value": "062f8342878d2bb5c244c6b279c86d4346d9b3ed", "object_relation": "sha1", "Tag": [ { "name": "AGOSTOver2.80", "colour": "#D085B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983951, "uuid": "2f507ec8-a255-430c-b894-d1aacdc6dd14", "comment": "Malware payload (RemcosRAT)", "value": "d494564ec512d5f84731fba98179252dd98e7ee6c961b35894235ce8c119a986a0ef480ceee7aaa85fe63d4892777287", "object_relation": "sha3-384", "Tag": [ { "name": "AGOSTOver2.80", "colour": "#D085B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983951, "uuid": "ff0af8a2-db0a-4265-9698-848f4394d6ee", "value": "T15FE4D08E23603246E4124F39C819B715075D9FEA2D72D70EFA5D3B62AB3BBC11E46391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983951, "uuid": "42250694-af69-4bca-b23a-9f11de876796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983951, "uuid": "5f6485ea-d570-4e86-9dff-e9de40991edf", "value": "12288:l7d65KfX47OiQDzg6pqCd1Q8jTdvzrN7mzwvMsHXH9ums:2eEOXnvbrN5Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983951, "uuid": "e1b03109-f046-4caf-8ca5-c60d86dc4941", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983951, "uuid": "05d3200a-8e86-432f-ad3f-50506114874a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983951, "uuid": "61b2d558-8db8-484b-a1d1-0199f5ab3136", "value": "Demanda_Penal-PDF_parsed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3da2744-570b-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994409, "uuid": "71b2a23a-24fe-420e-941e-476076468dae", "comment": "Malware payload (Meterpreter)", "value": "2cb908660103e6449ac76bdae06d81c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994409, "uuid": "192ae696-0043-4b81-a6af-1c7ad6cb23c7", "comment": "Malware payload (Meterpreter)", "value": "460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994409, "uuid": "eb677811-36c4-4466-90d3-09dca55112f4", "comment": "Malware payload (Meterpreter)", "value": "0cd4d2c3025f8eecf315fd5f0d3e6b11e7f4e5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994409, "uuid": "959ba7e3-3168-40d5-ad5e-7c4d94afb8c4", "comment": "Malware payload (Meterpreter)", "value": "f24a2fc0137c6652624329b9e5f8e4018b036dc8fece0e1c2d35dc0a4328ebafc4de8d1c69a80b972b893c1f6d2eeef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994409, "uuid": "6cfebdbb-1652-4a3b-849f-6582706c8df5", "value": "T1D373B042D9C05476D2A6113D67713B75A970F6FB7301C28B3A8CDDE5DBC18B0A2663CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994409, "uuid": "aba448e2-7608-400f-bb1b-85dc137108b0", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994409, "uuid": "66a4033b-cc68-4752-a642-db7bd785ee62", "value": "1536:IRzHYsNS6WbtF2BeGoSDGBnjokWzY11Mb+KR0Nc8QsJq39:EzHZWsMGRk1YW1e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994409, "uuid": "8510a9a5-9441-4efc-a005-fa49d3dc7346", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994409, "uuid": "bfba2b5b-2968-4c7e-9560-fe2406f8c616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994409, "uuid": "2214fe09-64b8-4f7a-9848-7695ba834f43", "value": "ndulele.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3519c0-565f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666920417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920417, "uuid": "b8dca763-5892-4e5b-8281-4f7316c7afc7", "comment": "Malware payload (Mirai)", "value": "c90e74355b458f43c90b5dee3b152d5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920417, "uuid": "bfd0ac08-640d-44e3-b986-56ac91609a24", "comment": "Malware payload (Mirai)", "value": "4689495bf28304116f7ffcc93ba76d3a00db6bed2cd698a262a035d1227d159e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920417, "uuid": "7b1fb5a5-7fc2-4987-b143-e96f05991b78", "comment": "Malware payload (Mirai)", "value": "4a77d94ee703cda562dfa5eefd8e7350e9343506", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920417, "uuid": "2026b750-301e-49b9-bb8b-bff0047046c7", "comment": "Malware payload (Mirai)", "value": "380dc26272755ec317591c5b9befb1568ef58d6e76c10de69abf769c6901a2152121d65001499929688af23b62896f50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920417, "uuid": "f8799d22-c480-41f5-92fc-ea821d68b8f2", "value": "T19A732955FC819613C6C1227AFA6E02CD372623E8D2DE72179E215F2037CA95F0D77A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920417, "uuid": "9db0c475-f512-4e5c-9a3a-366930abb670", "value": "1536:JVzRFVsqmebnFV+Tv/zAKN5ioo/8R8fNRuNQvXGP:JVzR+fp/ioo/quJXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666920417, "uuid": "571e42ba-4d85-41a3-b11b-c492989a98c9", "value": 77180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666920417, "uuid": "c6fd86cb-95d7-48f6-8987-da6ac638bf7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920417, "uuid": "9b233db0-6258-4089-b95e-4cce6a3bf750", "value": "c90e74355b458f43c90b5dee3b152d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827507c8-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666939270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939270, "uuid": "b5d125aa-bf91-46ab-9b36-53033d68c177", "comment": "Malware payload (Formbook)", "value": "a85b9fa45ee233e6c841854481899473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939270, "uuid": "0e5bec39-0afc-40d0-897e-1b97fe7f7f9a", "comment": "Malware payload (Formbook)", "value": "472da5e8a2bf5c1cd335c7ea829094bfcba064bcc35953e0c1df734629d86de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939270, "uuid": "20f77166-a4d2-453e-a9fb-06a175e43332", "comment": "Malware payload (Formbook)", "value": "ed94df49daf4411e4465f99a52ff3434ef0bb3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939270, "uuid": "7f4831c9-14c0-4391-93d7-7faf9a0387b6", "comment": "Malware payload (Formbook)", "value": "275423b7247f41d946558f555e2b0d68f1c962dae5379350b51d4ded48dc674639f8bc26a717c6ca709f45fccc68dec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939270, "uuid": "dd74fc59-2c86-4e10-b141-db1c740dbe96", "value": "T17E1501BE31E74F53D7EC4A75C4D2660043ADC58A9177E75B6A0802E88C133E3EA85ED9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939270, "uuid": "e608d04e-a9c8-4803-96a9-64355a549ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939270, "uuid": "ae7bc2aa-33fc-431a-a37d-bc5381c4e5b9", "value": "12288:zvw2AXstlOofDbJJC0hMV/8VwpWdWwlBrZt97ap4Aoi0k2gQjeGqMVorLb355w3s:rtxDbJJNhW8UWdWWH9uXGqcorX3g39q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939270, "uuid": "db0e8813-1c55-44d7-a7e4-b6d241bb7eb3", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939270, "uuid": "6bf1f459-d47f-4f00-9579-b036fcd94cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939270, "uuid": "b6185cdc-b896-442c-9dbd-d63dc7308d29", "value": "invoice#1222177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30426973-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666936985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936985, "uuid": "0c3519bd-7bd4-41a1-b243-bb93b81ae3ea", "comment": "Malware payload (GootLoader)", "value": "7007fc6dcc171f04cf1f115063581294", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936985, "uuid": "b005a057-8117-4128-97e0-908155a44af5", "comment": "Malware payload (GootLoader)", "value": "475f92815bdd3ce0fec937fc2cd6a289d75c91fa1d225b113aff0b63cd9e6c5d", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936985, "uuid": "79f5a9e3-0a4c-4b6e-b625-e1a65ff77eca", "comment": "Malware payload (GootLoader)", "value": "5432eaa52390242daa605dfcd990e477ddc5719a", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666936985, "uuid": "e85114ed-0861-47a2-a2ea-65024b5f74d2", "comment": "Malware payload (GootLoader)", "value": "00c53517fa58e11e78d5c2b5d688ad8e9cd9057016633bdd977f8025cd4a5f91ba2f37cbc8ac5ca3fc40413fa5792c1e", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936985, "uuid": "147dcde7-4c0a-4eb7-abd3-1b8573fd84d6", "value": "T1D0A2D1F0B81D2F09A7B3F5DC8AF4A91C6B52C294A5FB52D22E64233C58E41A7D2406CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936985, "uuid": "51dd4754-98be-41ec-8eb5-37f78551b57b", "value": "384:QX4Ll+ivwJyZMQeSyWeP27ZyfZT6hWYZ6lltrWCY50NslC+:QoLwijReP7LzWn5rlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666936985, "uuid": "100d5ae0-ed01-4e90-841a-8f8d6fc0b9b2", "value": 22220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666936985, "uuid": "70710da2-179d-4564-ae9a-f6c84ec97d79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666936985, "uuid": "ed28eea8-fddf-4145-ba7e-6105360c0d8d", "value": "Which sentence has proper subject-verb agreement (57266).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b602f37-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666939124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939124, "uuid": "41ac009c-e6d7-4606-af96-d9370def1d8c", "comment": "Malware payload (Smoke Loader)", "value": "a2b2d82960423b0ea00a66902c7b29ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939124, "uuid": "b96c25c3-4a10-4e4f-92c5-98d21e129d35", "comment": "Malware payload (Smoke Loader)", "value": "476eee19ed8c422727d9900fb5065ce206e8dcebd9b2a08c57f6b1af8a2cfb1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939124, "uuid": "66200559-83a8-477e-910c-238ccac778e9", "comment": "Malware payload (Smoke Loader)", "value": "d8a0723546521404f2b179027230cd20c4424792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939124, "uuid": "bbebd11f-f4d1-43f1-a5cb-b51c79e3b876", "comment": "Malware payload (Smoke Loader)", "value": "85ad5a5173838e762e0efad21d24a1e89fd872a58640e44ce7fd255f17ab1e80539d75122f2faead3db65e0e1d3d5cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939124, "uuid": "b4a21b87-c829-420e-9d23-a1d05643ac62", "value": "T17C44CFF17A81D8B1C4851130442ADFA02A7EFC71DA20464F77B83B9EAE753D1666632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939124, "uuid": "11b279c9-d440-41a4-8ad1-d88db9cda441", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939124, "uuid": "a352d449-99b6-4e38-8862-25778c6f5c45", "value": "6144:CrLHSLW8lx7ouLgTUfZZZI9aVVWrPC6j:CrLHSyKxMuLgTUfZZZea6m6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939124, "uuid": "a1295b1a-d5ea-4c59-a414-bd0129f2797c", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939124, "uuid": "704cf3c2-18bd-4e26-9304-b17dfe36a1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939124, "uuid": "2c2340b8-99ec-4a2c-9be9-763456eaddad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca28a21a-56ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666953993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953993, "uuid": "4f2f4675-e911-4083-8874-09aa786686bf", "comment": "Malware payload", "value": "4f51ef9b304712d37f68d3cd72b62e2b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953993, "uuid": "2b5c18db-b6fb-452b-832a-b09cd46053fa", "comment": "Malware payload", "value": "47bd52c21c5c65922ab88c1e801f4c0191c3793f9c1ea2d7038c7ea9331f2c9f", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953993, "uuid": "33f9d5dd-0cb1-48c3-8580-cf4f9611ec53", "comment": "Malware payload", "value": "ce8db8b3f783c551a02e890fef902d1b3f6206ec", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953993, "uuid": "79409a20-8b64-4291-a1a1-8df4d9c5c573", "comment": "Malware payload", "value": "fb83f32814b8ea89b0b774b636d008e256e7667f9c4f78807edceed0d85a20daf9a59774e485169762320742dbb752d1", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953993, "uuid": "1c9d00bf-c0f9-4e8b-af37-7a256df98400", "value": "T18701D632A212D8CCDDB3B373EC68AD058024DF21FDC5ABC4441AC45613D2421F5E47C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953993, "uuid": "cdb32db3-83f9-46be-9057-6e1ff44bd7dc", "value": "12:7a70dU7WhBCAaBGH0/7gAWTA7HR28H+Tsj8zbyiif7npDvWUiWOlYMv:7O0dUqVoGUc/uR2m7j8yicpbYlYMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666953993, "uuid": "028c5630-b0e6-4659-80a4-a979527e329e", "value": 708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666953993, "uuid": "d055f510-3eb5-4d0b-b610-10192285763c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953993, "uuid": "ccc5c5ad-2fa7-4b56-b70f-ad0b650672ee", "value": "Solicitacao-Reserva-TravelCorp-10033766.pdf.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b9495c-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949100, "uuid": "6ed004c5-5801-4c46-ae0d-ba6dcb9305a4", "comment": "Malware payload (SnakeKeylogger)", "value": "59c5abf3e757442e127c561a77677c58", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949100, "uuid": "053d4549-e581-4833-a4fe-e1c400c18aa0", "comment": "Malware payload (SnakeKeylogger)", "value": "481148ea5ff0545bea39a7cf4798aa7eadbd540918be89beb27cb8064fb9310f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949100, "uuid": "0367d019-b8d0-4e6d-bebf-0c08d6993a11", "comment": "Malware payload (SnakeKeylogger)", "value": "bc7a706066b19be30448c5b0b0bf3a09cf9d0c79", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949100, "uuid": "9ab6cd71-4a3c-4ce9-8e1a-804b4fb9e430", "comment": "Malware payload (SnakeKeylogger)", "value": "79cc5771f44a4faee871678e056d259a62b964823c7b5321b641b93ee0ac4e35a9d10fd8df37b34518f2af14f2bf7c2d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949100, "uuid": "92482a4a-c999-4f5b-b5eb-4ceea3df9648", "value": "T1EDB41298350172DFC92B8976ED991C34FB3029B6935FD742B84329A89C5E94BCF061F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949100, "uuid": "5fc82ebb-bd59-45d4-81ad-7dfa87d98533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949100, "uuid": "8acacd4f-8ab6-49cc-a7ee-9103adbc7fce", "value": "12288:U+h7pQNJqmXx5D+9hZ+MwmOzYASl7FLEyLia:ULq+x5CF9TZFLEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949100, "uuid": "90825b2e-851a-4500-aa7c-d810c674ee79", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949100, "uuid": "4a675254-4a5d-4353-9734-dbeeaa7f34b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949100, "uuid": "16de961f-24c1-434b-a38c-251abff25bc1", "value": "DHL 7342554120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd8bb95-56f9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666986698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986698, "uuid": "ba285e33-0e13-4cbb-827f-4a83a222ecd5", "comment": "Malware payload", "value": "c45cedf0fe3d9299f5a7a748ea585fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986698, "uuid": "ead7d806-1ad7-4790-bf7c-9c0eed773442", "comment": "Malware payload", "value": "48197635cfea947883e4dc02bab2d254dfd6fd5166cf145a9f9a787d0bf3ccd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986698, "uuid": "471fc562-e7a3-4f28-b0fb-2bf04128cad6", "comment": "Malware payload", "value": "9dfcff5564a06bfcfb6a05c1af7e2ea145dbd6f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986698, "uuid": "3f4811f2-0c85-4928-98c8-926034699fa0", "comment": "Malware payload", "value": "57a8ae13264605f49f32c3c7eaee54cf307c9340e32f31d9788a08755c4d27cb4f19b046202625664ffb63cbf8ca51b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986698, "uuid": "365e786f-d765-4ea0-a709-04319c905815", "value": "T12776331432DE8BB5F64A90348E717B4EF069DA760D24C4636BBB9B871F3E365D230246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986698, "uuid": "ad0ad1ee-44d4-4e8e-a405-25756939862e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986698, "uuid": "e8997f65-7669-4d77-a6ba-b461153c5d14", "value": "196608:91O9m9uaAWEotPQ7rawMKsoYmLArHTmzBbzY4:3Owua/rQ7ra/KseArHTmzVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666986698, "uuid": "b4d62ed5-c89f-45b5-b846-b309b9fd3e95", "value": 7619577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666986698, "uuid": "14cf7594-8ea7-464b-a4c6-5a93b4c27eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986698, "uuid": "46a3ffa8-84b2-44fb-8555-0871306fb64b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517909c5-5689-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938329, "uuid": "61b596f2-acab-4d08-89ea-bd5a85b5c0b3", "comment": "Malware payload (Amadey)", "value": "6f26a8e639a843fd0386eb7021448f79", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938329, "uuid": "105549c4-e56d-49b3-bc07-691ed479b52e", "comment": "Malware payload (Amadey)", "value": "489d251e0bc3cc1294fc9f186ee0f3b71b28a100732df775b0a161996f30f2b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938329, "uuid": "e0365007-9e4c-4040-8d78-7e9e805fa160", "comment": "Malware payload (Amadey)", "value": "dd76d38e8a4eab768366538e815437acdc15fb33", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938329, "uuid": "a68401f7-6680-4345-9011-516b2e2fa6af", "comment": "Malware payload (Amadey)", "value": "1139aa5e30f131f2e4fd8ee3579b5fcc752d0747a53b057cf380b3ddbdbc96859989385dcc7e507fbb3df20c8bad35de", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938329, "uuid": "457fa230-5a3c-4d96-8ee7-9454a8eba3b2", "value": "T1DF44CF32BA91CCB1C4851130842ACFE029BEEC715A644AC777A43B5EBE73791697721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938329, "uuid": "0ffce01c-c30b-40db-b339-be67c08fd724", "value": "7b61acf6f32731558508831ea4bb0cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938329, "uuid": "ed54db9d-b07b-467c-ba6c-64d7ab23f514", "value": "3072:JvXOsH0FwLe3I/QgdxCcGC8c5ja9tXWmc4txsommTqWgtKf6YiL9hRM/h3Q:JHHuwLe3IPxSCpkXc4teomwKYghR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938329, "uuid": "ac8979a5-29bb-4d0b-9621-bd94e172250e", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938329, "uuid": "b3fb9a56-06f6-48b9-a7eb-3c9184f70df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938329, "uuid": "7b6f7db8-b71c-40dd-b562-ae720fd7c4d8", "value": "6f26a8e639a843fd0386eb7021448f79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a4a004-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666938933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938933, "uuid": "0c272382-a135-49c9-861e-1dee44e8d68d", "comment": "Malware payload (RedLineStealer)", "value": "c8b051c767a3a084be347c7180cec418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938933, "uuid": "5b2e2f83-7255-45ae-ac4a-cd1c660eb40e", "comment": "Malware payload (RedLineStealer)", "value": "48fc6edc3337ef0bcd51b5ab338d42d34e542034078ce7d2d76693b7685604aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938933, "uuid": "8ccbc379-cc4d-444a-9cea-e3ebdcfd7f3c", "comment": "Malware payload (RedLineStealer)", "value": "b1ec11543a3c393e87c933568c6d9a6941ad14de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938933, "uuid": "9588c9e3-3344-457d-84da-11e489832466", "comment": "Malware payload (RedLineStealer)", "value": "c8b3158b2636f7854a2a171c9b423d6f70c0c9c5a02145aed4d3b60c9df44baddf92864cd9614fb21cbc93b7163622a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938933, "uuid": "8f31672d-b01e-453c-9870-9e267ce2ab29", "value": "T1F644D026B582C872C48111304835DBB57A7EFC315A2889AF77543B6F6FB07D1A7B2392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938933, "uuid": "b8cad128-210b-4179-96d4-06ebb6876224", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938933, "uuid": "8b8753a2-abb2-47fc-901f-59ad5a2319af", "value": "3072:7AXOfqk4xquUnq568h6xq0EC0tkE2rPZRWVcqZTT0Kh:IYqazFxqa0GLUVcc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938933, "uuid": "2aaf9f70-ccba-4111-85f9-a94c659ef16f", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938933, "uuid": "05826018-28a6-4702-852c-7614a36dfa73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938933, "uuid": "fd13b7e5-ed16-4dc5-8f23-1e7948bc6115", "value": "c8b051c767a3a084be347c7180cec418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb7c9cb-5714-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666998129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998129, "uuid": "1bb060da-6232-4757-bed4-454334814452", "comment": "Malware payload (GCleaner)", "value": "c5637f0db1674a86fd00b44b0fd0410f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998129, "uuid": "7aae570c-054b-4d62-880f-a0c41ef56e0c", "comment": "Malware payload (GCleaner)", "value": "49bc20d0b2e947febb9e05fe3f3d11cf302028e5d42443e824dfc165f60b0a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998129, "uuid": "e67d314a-5f31-4cb3-a827-b963ad5b56f8", "comment": "Malware payload (GCleaner)", "value": "989dafa2f3a8efb4c055e9e8da129362f9f4e32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666998129, "uuid": "082add5a-3d0c-4458-bec7-1c8422261d01", "comment": "Malware payload (GCleaner)", "value": "63f06156006090d1ee906172c3cdc0c7d42228713a02b329e25fded34ac5337eef1b7115723d4e829888f984f48a050d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998129, "uuid": "4f77c6a8-d27f-41f0-8a48-b1cfcd873724", "value": "T192C53311AD410134F0B8EDF44BF74E26D6726D27346BA2603CEEA91C6F538B5E9853CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998129, "uuid": "fb3201cf-843e-4540-b5c4-b594731bb6a5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998129, "uuid": "a134052b-cd8c-4a0f-98ce-9b8c61a2e0e9", "value": "49152:Z2TA9ArbDvDR3w3YF+yWOg5+hrzTzUlv+RDoWR7GbrnbA5hq:MTA9ArbnNqfyVBrY1+VoayrMDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666998129, "uuid": "42fd5b49-7a4a-4918-b49b-3f8c8d5d7422", "value": 2608575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666998129, "uuid": "65e71a30-4a8e-4f4b-bc8d-819de32716bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666998129, "uuid": "59b9659d-8afe-4dc0-9b43-3cea59ef5814", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3ef82a-56cb-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666966610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966610, "uuid": "0e620e9e-ac3d-4aa0-9ce0-c1ddcc6f19bb", "comment": "Malware payload (GCleaner)", "value": "82469c55792bd9033cc5293155d1b537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966610, "uuid": "07c0ad9c-2a4d-4628-8a59-6049d1678afc", "comment": "Malware payload (GCleaner)", "value": "4a2659cc422414f0bbfc9c3778df91575c4c461bfbd05e5c799daeb76e7396a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966610, "uuid": "5c3a8b28-3c58-434f-bcb9-bb749ac19fe0", "comment": "Malware payload (GCleaner)", "value": "8ca141e4450e872e8276a4c6b159ad558cf8a4de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966610, "uuid": "52e4b4d2-d376-4a15-8cd7-402259f3d6a3", "comment": "Malware payload (GCleaner)", "value": "5aba21d54a43a2a838e039322924a76bfbbd79bd402cfe469aee834181a4a225fbe08dd65d2c394dab76a1a387c98442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966610, "uuid": "16c8f0a3-f1d6-4b48-ab20-2a48994e94cb", "value": "T193C5334B64C1BE33C0D2C574FAFD445A1B766A09451EABF83ACC88B82F7B2D11455BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966610, "uuid": "325a6a2e-2745-4bbc-92a0-d578153c4cd9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966610, "uuid": "82ab2261-de62-46d1-8f74-c91f18c70064", "value": "49152:Z22ZSJt1e1ZBfnZ+NocThaTSeGnVk4ipLj807Mx3KlN4EoP4KVA5hq:M2ZSb14ZB/ytThuS64WH82MxMNHoyDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966610, "uuid": "0e7ee4bc-8604-494a-9352-ffd59f6efea9", "value": 2617630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966610, "uuid": "b1c48a7f-6d20-4748-a9de-1a15856a89af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966610, "uuid": "0fe3785d-f915-476b-86b1-60918cecc403", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dafe1b-56e6-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666978352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978352, "uuid": "6a039390-b60f-4605-a7d5-21fe84891f03", "comment": "Malware payload (GCleaner)", "value": "b2c6b3363df999810d16e871f5124581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978352, "uuid": "2c396785-4425-4434-904c-b257b3f45c13", "comment": "Malware payload (GCleaner)", "value": "4a75d423320fd96f2702fc780f438337c7b3e1754b0ee590a021cf8b3094ef87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978352, "uuid": "2ed4a68e-61fd-4420-825e-bba112917b39", "comment": "Malware payload (GCleaner)", "value": "b2ac167eacdd584b712d5460f91365168addbd65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978352, "uuid": "c4748863-7a4e-4cc2-a82b-a2b464ab76d1", "comment": "Malware payload (GCleaner)", "value": "2ff9ee664d8cb24925ee47a6c4b40d2a566f69742b3c747abbe3349e33c8835464641d6d98d34a8a792ba7b7949b6297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978352, "uuid": "6f5b0684-be41-4053-a7b9-4cac43330ab9", "value": "T13EC5331252DAD5B1C4719CBC0D7D19D2D8612CAA4E39FA323FFCC86C0FA5242AC55BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978352, "uuid": "e5f32678-b2b1-4e07-82a4-f5856251dce7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978352, "uuid": "cfc0ed57-df7a-46e1-bb4b-2a9b0090006e", "value": "49152:Z2P/vOk2Cz2bnnZ9wRmTb0YtY1UBX8gjjMh8+V/B5c8wmbNczX5z9Ap0cnWfA5hq:Mfd2w2zPww0YY1CX8OcV/TRwmW1zBqWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666978352, "uuid": "e06485d3-4486-456b-b7e1-f72dc146ea00", "value": 2562029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666978352, "uuid": "0ffacd0f-4b5b-4c57-bc8b-98b73c60ad85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978352, "uuid": "54e24955-e2da-4020-a367-122391c745b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2aff96-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949110, "uuid": "30818878-f3d4-4c33-9895-3348432bd4b1", "comment": "Malware payload (SnakeKeylogger)", "value": "035cd7d854598083698309c35362ee32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949110, "uuid": "42067f8b-40e3-40c0-8936-c89c8576d8be", "comment": "Malware payload (SnakeKeylogger)", "value": "4a7c732e04071421b16fceefad0a2a2c046d8d59b2ece54f50f89645b4eac10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949110, "uuid": "45491174-79b8-49d2-9684-d1a7162355b6", "comment": "Malware payload (SnakeKeylogger)", "value": "228d6b4081c9610668b2d30eb75c121ab27bf3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949110, "uuid": "cff6c3ee-76fd-479f-8cc2-19633dadb19a", "comment": "Malware payload (SnakeKeylogger)", "value": "ee776b656aed375c86acfba7ac49a3b39c1be7b0d748075efb07732b6849f09b56b0474099cd5ae379b923238ab42d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949110, "uuid": "09cc6290-cf24-4055-b1ac-0d3710d80fcd", "value": "T165B412953514B19FCE4BC7729A9C5CE0BF3118B6536FD293900325EC6A4ED5BCB1A0E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949110, "uuid": "a91de03b-a9af-4568-a4c6-d577bd2421cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949110, "uuid": "bf20e79b-8ff1-47c5-9977-19b9d71f8093", "value": "12288:Ah7BAlmq96AaKDtp99uNd6mmFlhUa7HqF3tDdV5EyLhkQH:Y094SpIuE8qFxL5EyLhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949110, "uuid": "74015771-187b-45a6-bc64-3caf6d8da5d7", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949110, "uuid": "899c9dd9-41bc-4a91-952c-a43b44b011ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949110, "uuid": "737d961c-2627-417e-a601-f0ec113d00ce", "value": "Halkbank_Ekstre_20221028_08.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af79aa48-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666952660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952660, "uuid": "26a49d3f-0b61-41b5-979e-c6042d9a84ca", "comment": "Malware payload (ArkeiStealer)", "value": "58f2bf15e9c4064ff73292ef29d394c0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952660, "uuid": "332103b2-9252-4efe-8e1f-b4db7228a0c1", "comment": "Malware payload (ArkeiStealer)", "value": "4b6df8f781da883c897102059bc10531355239bc32cc019e587a0d4fd7333c9f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952660, "uuid": "12d65a31-25e3-44cc-9d4d-682fbda41fe0", "comment": "Malware payload (ArkeiStealer)", "value": "d002656e5f067acd18ac9be209fc5335b81025ea", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952660, "uuid": "51a0e452-e126-4cc6-9397-b088cbb7735f", "comment": "Malware payload (ArkeiStealer)", "value": "5adf426415fee625c0a853fd90cfe617278695abf5d70ade0390647439d667f49006f9076d38fa22cd2ccf0b8c379d76", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952660, "uuid": "caca5f98-4416-4297-9d92-3c14f64148f0", "value": "T14E74D0717641C872C48D1534882ACFF0197EAC3519684AB7B394F76EBEB1281ADB631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952660, "uuid": "9fb63fad-7f11-4102-ba91-6c544db27f83", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952660, "uuid": "5f576d4f-aa19-45c7-9af1-980fa649ae7c", "value": "6144:5BHYHSL21jejKu3y2FntMsI7Z64SkXMkASqA6w6j:5B4HS6FeeuCEntJI7Zjb8jSAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952660, "uuid": "5bacd159-4d58-45a1-a4ba-c9ba1e72e699", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952660, "uuid": "3993f032-3894-451b-a2d8-e531d8438bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952660, "uuid": "d1ad170e-b16c-44d9-a1d0-b46d0b0cc10b", "value": "library_2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad407f93-568f-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666941060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941060, "uuid": "b45efb28-e51f-485a-ba19-12cf6a43b446", "comment": "Malware payload (Loki)", "value": "5b51538a46e7e0176f3d1720133a6ba1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941060, "uuid": "fe0bcbd6-f62b-45ba-a55d-431d2de86866", "comment": "Malware payload (Loki)", "value": "4b89e0932b58878fe1944e3f18fe8435e71013b861bc27765ad34fff02965863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941060, "uuid": "cbdd8ba8-9b16-42b5-9a86-bdf8d048324b", "comment": "Malware payload (Loki)", "value": "0a8f532342d4f9b4e65c68eb0a1b0584ef9ecc89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941060, "uuid": "59993098-e478-4683-acdb-86faa42b11dc", "comment": "Malware payload (Loki)", "value": "b295c1ce4b96cf573efa774c1438f5eef67cd20cbe04c775af352ce0dca20d3dbb514d8102aeb15b9d9a789538c57a11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941060, "uuid": "1d68b31b-0f70-4f0f-8db0-009db0ba8561", "value": "T1AA04125AB4C4A46BD49313714ABB93B2C7FBE5041263310F5BB55FFE6E382830651A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941060, "uuid": "914ada9e-0440-4bd7-8238-af7aa101f24c", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941060, "uuid": "6e96c187-a006-4153-9dc7-ddcaa851bf25", "value": "3072:qUJoFfWzzl+cSMvhcIaELcp59iehKSEzoM71MaS/Y6jgWEAczvN4SpMRdLqRaN:qweEp5cXnrBM+a0FrgjpMRdLqRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941060, "uuid": "749daf8b-fa9c-49fc-9818-edad69cdd74c", "value": 184715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941060, "uuid": "402d081b-3b96-4259-a546-5f71e682561b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941060, "uuid": "2a339073-daf6-4aa1-aa59-14cc8f8e984f", "value": "5b51538a46e7e0176f3d1720133a6ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6534b4f1-56e9-11ed-9266-42010a9c0072", "comment": "Malware payload (BitRAT)", "timestamp": 1666979594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979594, "uuid": "8dca71fe-4e72-40c7-80b9-3daef12dd26e", "comment": "Malware payload (BitRAT)", "value": "4adad0455a6845f2dabbc95363c78e68", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979594, "uuid": "4a2f60d1-9a24-45b1-8416-eb946c5676cd", "comment": "Malware payload (BitRAT)", "value": "4d1ff49d8b7a59faa4b9ea7af73906edb258b6dc6d29fbe5f0a76294c311eed0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979594, "uuid": "b8e07c04-dcfa-46f6-b48f-57d183756eed", "comment": "Malware payload (BitRAT)", "value": "40c62fe0ce0ecbfacf7926e7834f2614c4f1ba29", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979594, "uuid": "3d5902da-82e9-4eff-b4b1-06bab4218f58", "comment": "Malware payload (BitRAT)", "value": "7e24b006ed70a1807d229f34fcf1d9c48202c612f2881f1dd27d8e217c0a1c1553042bab20fd0b6ca8045f7de251c301", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979594, "uuid": "a5f9b60d-185e-4336-8b3a-09321e2c2d01", "value": "T146B2E759D1810434EB2AED71C7720B6136F62D88AB16DE0D786F7DC63F73BE25A22019", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979594, "uuid": "a235981d-e26e-4bdc-a21f-e43faed2f596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979594, "uuid": "cb831c27-873e-4348-99bf-2f4ad00c67ff", "value": "384:YSOowV0CzlyxmnSj3ge0GTR8TptYcFmVc03K:Yy+XnSj3gYSttYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666979594, "uuid": "cc7a3947-4e4f-4f52-a740-cabaa8c04be4", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666979594, "uuid": "cf55ff54-6201-47c7-930c-33f73427e33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979594, "uuid": "e2c6b4b9-09bf-4bbb-9c1b-0798bb70ce83", "value": "swift PO#069122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50598003-5674-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666929308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929308, "uuid": "f2de826f-6e75-4919-abbb-5f0142380a96", "comment": "Malware payload", "value": "15dc8cbaa5c1366113f3da23721fc42a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929308, "uuid": "2166cee9-c18a-41e9-a398-f158a67d0fab", "comment": "Malware payload", "value": "4d2f7f41db1c31f8cbea3dd4858973458973733592c3a65f3a65636fbe4b4592", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929308, "uuid": "3f131ac2-a61b-4001-90d8-49061b9bd7c7", "comment": "Malware payload", "value": "f7a8ac1e7576b4ad14e134a279d4babebe3c8b8e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929308, "uuid": "671afae5-1a3d-41e7-812a-a696bd212625", "comment": "Malware payload", "value": "72ee50b84936b52e95be73baa6987c7227081af9207f8dc8a4d0188d8bed2e327a89e9ff31fe5effb52c19f5c1751031", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929308, "uuid": "c39e6ff4-ea2f-4f71-af82-80e3d70e968e", "value": "T1BD2733A31C0A9D9AC0326435197E2385A9B5CF2A3AF267621044DFB7D5F3861C9DDFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929308, "uuid": "14806f55-c1f5-4230-9333-db280f5347bc", "value": "393216:Y+OP9ksJA35z7A79L+cGt1mbgafiubc9Z7bRT9i/zVN2I+TX3dIKpPbNiRSKcszJ:Y+MlJA35z7c507mbBffc77ri/zVN2Ikc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666929308, "uuid": "6a2c0dc5-2c39-4f28-b9c2-fbae3232eb31", "value": 21599893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666929308, "uuid": "3b753fcd-8629-4bc8-8995-3dc538ad2ab9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929308, "uuid": "c8b80b3a-fc7d-4aea-8bf7-8afa29ad16f4", "value": "4d2f7f41db1c31f8cbea3dd4858973458973733592c3a65f3a65636fbe4b4592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccdbe28-5683-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1666935932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935932, "uuid": "2ef3070a-12a9-4a85-ad44-ea3b95f2aa66", "comment": "Malware payload (Vjw0rm)", "value": "744ae049bf8a37d2e945802c3349e240", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935932, "uuid": "0dcb6a94-dd9e-4614-983a-9c34d32e1f12", "comment": "Malware payload (Vjw0rm)", "value": "4d33a89607377958b5ebe7aace8999e255d3a39d7b709bc026104975a6cc1d9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935932, "uuid": "4eb71b96-9218-49ef-ac89-016a91ae999b", "comment": "Malware payload (Vjw0rm)", "value": "7af3930f68e5b1c4bec8aea48b7d43e4aeff8719", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935932, "uuid": "a91c051b-3035-46ed-a331-d3b1440c43d5", "comment": "Malware payload (Vjw0rm)", "value": "b214e9cd66150cbded4100c3c127aea7275a5ab943e4ea4fa01c935da374972a7528a8e197deef54d8f9c5bf0cb6330b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935932, "uuid": "1f97b38f-2dac-422c-a613-c58f6a03005b", "value": "T1F4339D88DE128B81EB4C3B435DFCDD2827387CDF15B59D5F66D8B68C618240AA14B6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935932, "uuid": "6f361bb5-bb10-4858-93db-f40c904dc1a3", "value": "768:DUEzBbCFLKCRxwxE1k/FvZIaf9fgWQ7juipgGfvoclPfDnJPbIpDEsYOLJVK:haLvGE1ktvGaf98juipSgfJb84sYOVVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666935932, "uuid": "1722964b-a7bc-4e9c-b5f6-553f7374dc3a", "value": 53172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666935932, "uuid": "0d2383c7-ef62-4d80-90b7-af08cf55d810", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935932, "uuid": "292cfe69-38e8-476d-a060-27ff84225cec", "value": "NewPO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550d3349-571a-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1667000612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000612, "uuid": "524dd084-6889-45ff-be87-721af7e6822a", "comment": "Malware payload (Mirai)", "value": "c0fbc01ee52bac280e54fd1cabcffc16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000612, "uuid": "15a83511-be8e-4ad0-b928-9398790dedcb", "comment": "Malware payload (Mirai)", "value": "4dcf2339c09e655a2160c13a3e5bd328a892c570543acfa21177b116f50d963d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000612, "uuid": "398ba4bf-22c9-4d04-9883-a2f5d03a3853", "comment": "Malware payload (Mirai)", "value": "681e6bff6ea33a7e9efbdc5756e0db439f3aec9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000612, "uuid": "75daabfa-b0cc-47c9-9d4e-ad69daf301e6", "comment": "Malware payload (Mirai)", "value": "e68f33ed88844e975045105c1ae169ba6169351161a6c3addb447dd0d8014ab3d0b588705f582b3def24ff80178f5ed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000612, "uuid": "7cb1dd31-7355-40ab-8d00-2ff76a9c170d", "value": "T16CE2E12D9584A8A9C6FE1C3D911A2FF3A252B0C462176B94932184C4FE2CA4775446FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000612, "uuid": "257c5173-e8b8-4b35-9643-d964a1073209", "value": "768:m4YuDs1kNJ/fKHilq/J/Bjapo9NQLwyvpvZ/RbYWE:m4UYJ/focfMav70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1667000612, "uuid": "15ddd0dc-2fe6-425e-9837-780c65b97eca", "value": 32012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1667000612, "uuid": "420384c1-9419-4dab-b40d-22165f50cc7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000612, "uuid": "c0a58104-a80f-4ea2-aa9b-cdab9b5669d3", "value": "c0fbc01ee52bac280e54fd1cabcffc16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61f2a35-56b2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666956134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956134, "uuid": "195b0f20-b2c4-4467-8115-1b725ec4e180", "comment": "Malware payload (AgentTesla)", "value": "f342b2981d29bb7675fb1c259781cffc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956134, "uuid": "6c4fcbd0-365c-48fb-a00b-cf1fbbb4d1b7", "comment": "Malware payload (AgentTesla)", "value": "4e97fc9e26c25405c7805580ee27614948e8b9ba034c630adfa84406bb83c7e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956134, "uuid": "68053a9f-b989-4fcf-b547-3860b85f74d9", "comment": "Malware payload (AgentTesla)", "value": "259fdc8362568b5d6bd5fba43265010f714c2812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956134, "uuid": "afbb41e1-24b3-4cb5-9f78-2a0d2d853e58", "comment": "Malware payload (AgentTesla)", "value": "d617e48b553a21d2f18e4c212bcf1090c86b113a557b203f2bc2e6978ed2d3bf4b1901d6f94d98864520e1b48c962815", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956134, "uuid": "a78e9976-bad0-4e70-bf3f-7a5fda49188b", "value": "T1FAF4C03429EE421DF277DF705FE478EE89EEF6332606E4A9149107C64B12E41CE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956134, "uuid": "c0719c40-769d-4d23-8f56-367eea619015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956134, "uuid": "b8b03d4b-6f0c-489e-ab09-dcbff3f04902", "value": "12288:lSdAgHtDg5xE1UtExnEdQEUkfPSPEMiYvQCIikLbcSMdVorLb355w3z5LErq:lSL4QxEZUIPSPEKvfjkL4SGorX3g39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666956134, "uuid": "296f7326-9d09-4c05-be76-9c66af8cbbff", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666956134, "uuid": "4daba7d8-a5a8-4a5b-9807-fca1b32a6096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956134, "uuid": "5f404fa4-3db6-480d-8aa3-168117df953d", "value": "Outstanding Payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675ea2f6-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949103, "uuid": "c9cbd4e5-d499-4522-9cd7-b189a24458b9", "comment": "Malware payload (SnakeKeylogger)", "value": "2ca6370eaabdb597a0948a79f5eac8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949103, "uuid": "7764ed2d-03fc-4349-af91-34f8d8380cb4", "comment": "Malware payload (SnakeKeylogger)", "value": "4e9c0ce7fa6f96767cfee4ba612d9619b07e83267588d4f13b7f87269562e0cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949103, "uuid": "4d9af785-96b8-40fa-a4f9-36ab0a333460", "comment": "Malware payload (SnakeKeylogger)", "value": "5687deef2e1f449e4fbf93fff5fe673cba022295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949103, "uuid": "71b7cc80-5541-45ab-b953-85050ff38739", "comment": "Malware payload (SnakeKeylogger)", "value": "a88f10006df0abfe09bbb1fd96d7660d678a7fc3fb5924a121379595341480328d87864b03307165e532d650db00be17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949103, "uuid": "f6d8e16f-68cc-41b8-b529-4dfedd46e373", "value": "T185054BD1F15098DFEC6B49F2BD2AA83024937E9D94A4410C559EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949103, "uuid": "b86db4cb-9a26-4d19-b74d-23fc6409d412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949103, "uuid": "2f51dadb-6a6c-4802-8447-4c1a3f023624", "value": "12288:ah7W3FK6ZCp5JphZO6vVW4fXkYtbMsXoCeN4EyLw9DjBJ:B3Fcp5DpvVW4fXpePR4EyLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949103, "uuid": "765a9481-5e2a-4d0c-9c6a-cb253aa0150d", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949103, "uuid": "44c3036b-0436-4451-a33d-5d6edc8cb123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949103, "uuid": "b8e71481-dfb4-4808-94e9-b04d39d7e930", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15956b8-56c3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666963481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963481, "uuid": "8c5266d8-ae7a-42ae-a55e-ed7e51876da5", "comment": "Malware payload (Mirai)", "value": "280bcf5faf0f565ac04bb7da77784471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963481, "uuid": "4aef16f8-097f-4d3b-aea4-fa8013e4773d", "comment": "Malware payload (Mirai)", "value": "4f51b300fbb5b0a52c9e8d15119287e1aa86811451b84fd90e6c6397362821f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963481, "uuid": "2737ec7d-82bd-4bdf-9769-0a4e938e3f07", "comment": "Malware payload (Mirai)", "value": "ac15bb731ff8b5f5311676f0e057082ad034d787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963481, "uuid": "fa4afba5-6425-420f-a265-abba419fadd9", "comment": "Malware payload (Mirai)", "value": "34ea261c0d07728ea1516b03a5d8dc439edabfee84ebf1e815034e91253a05f57b3d8035c9f3895d1581aae81678097f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963481, "uuid": "ebe426fa-950a-469e-b25d-fd13cdd70093", "value": "T179832A46BC918E15C5C9227AFA2E108E33036768E3DEB263DE145F2467CB92F0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963481, "uuid": "5a653482-e0bc-4802-a091-a555d750648b", "value": "1536:ZAn7hpYeF0NMSjE95qEjQI7wn+tbrzg2izMXnuMYiEGtmEt4ip:wpYTMz0I24vSGtmEt4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963481, "uuid": "bc9278b2-265d-459b-b7f6-97e25604c7d0", "value": 83292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963481, "uuid": "2ff142b5-836f-4a98-9069-ef5d747d2bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963481, "uuid": "c92a686a-2870-4283-ab7b-d02524146c8c", "value": "280bcf5faf0f565ac04bb7da77784471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92be6cd5-56c5-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666964208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964208, "uuid": "352721cc-1076-4c7c-ba12-cad2889be71a", "comment": "Malware payload (RemcosRAT)", "value": "c44491911d5cfcc1dc31ac019c2714aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964208, "uuid": "97a25809-1242-4a1b-8737-5eb13f18275a", "comment": "Malware payload (RemcosRAT)", "value": "4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964208, "uuid": "53bcb012-e6a4-4618-8299-14285aa90301", "comment": "Malware payload (RemcosRAT)", "value": "635e1be851baee85fb17cb2781bc6d9ee6a94f8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964208, "uuid": "45793f76-9a38-4a2a-9051-2286ab90b9b3", "comment": "Malware payload (RemcosRAT)", "value": "012825d5317a61996fc19b5626ff315c30b44c4dc55ae22785b31f7f94546054c0aa4dadcdbd2afe61ea35d491f72351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964208, "uuid": "ee25a363-edd9-46e9-9567-e21606168c11", "value": "T14115230934A4B28ED3B909FBD57E71CE2F7281987253D39F5FC881CC8922B749589A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964208, "uuid": "682604b9-e52c-454e-a97e-4a02ee1365cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964208, "uuid": "bb11eb04-7c9a-42a6-abce-0a1847d73cd8", "value": "12288:/44mF6XP6Cau9Jez6Qf2ItKcTvNwjc5ul/1hfeq85A1DisBCos5yrO6okfY+uEjQ:/Ba6fsWlawcWrZYoZfBBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666964208, "uuid": "64f23cda-c1f0-4376-bc36-147e9988c6de", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666964208, "uuid": "926d95e1-cf08-4b42-97a5-e89e308e3e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964208, "uuid": "9f75f706-dc05-41b3-aa8e-029cad6ad5e0", "value": "XLA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a12627-569c-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666946763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946763, "uuid": "a52b976e-1c24-4b0b-a13e-e1de60243fc6", "comment": "Malware payload (Formbook)", "value": "30f044a7b4f6f70cd151fa002b7b2d69", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946763, "uuid": "19b781f0-2f7e-4b77-b2ff-4eaffcb41e71", "comment": "Malware payload (Formbook)", "value": "502636e54d4918b959687c4b0b42b8315a5c8b3740eb197a7465ce1492d839af", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946763, "uuid": "82df583e-33f7-4a47-8c46-3e4bb6fab0ee", "comment": "Malware payload (Formbook)", "value": "4e3d51d168163f5f55eef163976654d77752f65d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946763, "uuid": "f46bc775-1ba0-47a5-a12a-1da44ceab9b9", "comment": "Malware payload (Formbook)", "value": "c6a9f1e9db1925af5a68c09c922e7094a9a089c14aab8986ee952c3f9685ad6383f680d458b445d381539806fc0213e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946763, "uuid": "42547b66-d68b-48ec-bc22-eea184d9cc80", "value": "T17814139B7CB7A354AB36A983E941D99F64E001A111E8B706A5DB0EF13D148C0CC3BF5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946763, "uuid": "6550e6a1-87ba-48ce-af55-89dcebf8dc5f", "value": "3072:jq6w/w4swMCwddZxOaMHKiZ5mY55ocIwUNCpgOK6WyJIkAmTaBCc6vShBcR:EoJtZQqiZ5m65DIwKOK6WmomT1vW+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666946763, "uuid": "4b457fc7-2ce1-49dc-b1d5-5894fbc800ec", "value": 207203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666946763, "uuid": "5d0fac1d-9a20-4f6a-be15-908cbaad8fd6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946763, "uuid": "ba298653-21ba-4654-94ab-200d5a0cdb2d", "value": "Shipment Deatails BL and INV222010736.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67680d05-56c2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666962847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962847, "uuid": "5b403a0b-271d-4c4c-ac43-1761630b089e", "comment": "Malware payload (AgentTesla)", "value": "0079a21ea7b5606e0561b9bf01f9e596", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962847, "uuid": "0ff38bc1-287a-45b6-839e-ef93c3901cab", "comment": "Malware payload (AgentTesla)", "value": "5187a9545230bbf296e8a7b7f4683259e5470db039afd52398625de8d862bec5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962847, "uuid": "ef353a63-7c8c-4f3b-a075-e22dd5052782", "comment": "Malware payload (AgentTesla)", "value": "ee301fe57cccd2a81905c04350b24089aeffd4d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962847, "uuid": "2a1a59d8-0a23-4494-9413-811929621a1b", "comment": "Malware payload (AgentTesla)", "value": "c74ed26ec652de9093dc3599aa8ebb67d5f8f656e63cc0972e9db82bee467ad9a83170d901b903632760a90e04cdd537", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962847, "uuid": "4e7de41b-9ac3-46bf-8648-5a4c37969913", "value": "T1B0436C897BD87D8FC94ACE7A85A17D090AB8E4213B07C393A8D07B5D09573CE5E13693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962847, "uuid": "238fbf5a-5831-4ad3-a3cb-fb43a8fc0efc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962847, "uuid": "243cf76f-3a79-45f3-b71b-1f7040f84883", "value": "768:tcQKBMbrjqLFhLWtiuPmL9+zlkhK9UXNGvlUAJDs/Un+WiRPPrk+FP:tcQE8i8mL9M+sOX0vlUKDOFWixPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962847, "uuid": "aa071924-7c64-4c98-9456-612f2bad04c9", "value": 57152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962847, "uuid": "e86962f1-21ef-4ead-b003-75955a395659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962847, "uuid": "3a15c23b-b466-43da-b122-8c9e385323ad", "value": "SKMG1236102022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acbb347-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666937405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937405, "uuid": "6915788d-57d3-4da8-a33e-2d14447668b5", "comment": "Malware payload (AgentTesla)", "value": "3352175ea33891c873d120f8eea80946", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937405, "uuid": "4d3d2725-4419-4b6a-8344-a73db2bea4b8", "comment": "Malware payload (AgentTesla)", "value": "51bbdcd9da38798085d7fca64708ee95a44e3c3fc99a7cd69d112b68c89c1cbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937405, "uuid": "086ceed5-2823-4861-b0d2-60f496e8d5c6", "comment": "Malware payload (AgentTesla)", "value": "150a4046aad42a29bc49991e3ba19e1177760896", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937405, "uuid": "957664c9-4297-40cc-9104-da352bc6d17f", "comment": "Malware payload (AgentTesla)", "value": "6f2754084f2f304b7899cdf7cdf37dc3608b51e7c489dc8a11d46a832a742f1b2f29a39eec9a74a8a56dab5c12f3f374", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937405, "uuid": "72e197b2-164b-4489-b0f4-6c73979531a7", "value": "T118C129652A0C5CDBE8839D79DF84BE950BA7F1BA6CC72C50374DF8E40A2B15176A4901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937405, "uuid": "cfb9afd9-34b1-4329-84fe-acf483159ae0", "value": "96:DXuBRzlWMb2tCuoplmHiehHOigOccoz77BDmE24WzeEBWvHWbY:wplWMQAl8i+bUN7BCEdREaHWbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937405, "uuid": "8ddbee87-bd10-43b9-a216-7d4d28e3f8e1", "value": 5623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937405, "uuid": "4173525e-ab93-4a07-a6f0-817e156e3a59", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937405, "uuid": "6261190c-36d6-402c-91d5-879e5c2498d4", "value": "0082099375.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad70dcf-565c-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666918964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918964, "uuid": "d392cf82-6d8c-499e-b950-8fb25fe3f08f", "comment": "Malware payload (GCleaner)", "value": "3b29a0364ba8c8796e55bb542242f0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918964, "uuid": "1ac84b81-c3d8-4757-85d0-97f6b05c6cb7", "comment": "Malware payload (GCleaner)", "value": "51bdf171ebc0667c220f5423457b557a4847728c5a35009c3d95b959600a40e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918964, "uuid": "20a10e91-c910-443c-9aa5-a6bb44758314", "comment": "Malware payload (GCleaner)", "value": "2c0ecf5954301209542a65801cf6247f8336f15d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918964, "uuid": "d14748fe-7e78-417b-b5ce-c13b28f0fa63", "comment": "Malware payload (GCleaner)", "value": "c1909d628b29715a4130d8394807ba64f5a3e5bad2146057d490ef09894c73999d34e5347353a5cca160b488d688ea79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918964, "uuid": "c0344fb4-a058-4b6f-9e72-cd85be1c9078", "value": "T1FAB533104B4208F2E1FE9FB4BE78C9816665364397372425766D5B0B5FF3FA2480AB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918964, "uuid": "edd52c5d-9089-4e40-a641-5dae4e9ac6ed", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918964, "uuid": "845319e2-9f30-4609-bc98-53ee83fcde4c", "value": "49152:Z2kVFgm2tqeJDiYOr/MXXLVnmCnBuYe2OcDOWOyhLYcXmA5hq:Mxm20eJvZXbJmCBtD1hs6VDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666918964, "uuid": "ba3ae0da-4634-4e94-9a81-5c0cc918c850", "value": 2451451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666918964, "uuid": "7be12fc0-cd76-4bfc-89f9-1ca788b49600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918964, "uuid": "dd6bf37c-075f-4144-8840-864c73db4d58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2bb480-569f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666947954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947954, "uuid": "bb780fb8-4743-4106-acc1-a175bfae0a4e", "comment": "Malware payload (RedLineStealer)", "value": "43c315ec3be59be4ef5aa52e440fc10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947954, "uuid": "9451081e-0b94-4406-8624-9ce4f1f7750b", "comment": "Malware payload (RedLineStealer)", "value": "5207dd47df6e282ee4d949282a96f83bbda7be328f65719113623512df7e4015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947954, "uuid": "41ff0c7d-3a79-46b2-b79b-1b6747de97e6", "comment": "Malware payload (RedLineStealer)", "value": "c9b68a94fbd7519a290ec60d3a8a1eae2d8b4b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947954, "uuid": "8cb7ac10-931e-40e7-8c93-846825604fcd", "comment": "Malware payload (RedLineStealer)", "value": "f608f1bef5b48c196ef4cb01bcc8ab1adfff0d1f99be074ffb6303ccdb4d313e5cab06b006a46422309ddf99b17f3202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947954, "uuid": "3f42a895-a815-43a4-ba27-a5f03de9c87b", "value": "T1AA654BF4E0AB04E1E80B6DF1197CBDE6837271F38ED50D20277DFA044FA69695A4894E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947954, "uuid": "722a0103-c032-40fa-a192-754853915d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947954, "uuid": "9ec620db-75e4-4850-9fe2-ceec0f2ee52d", "value": "12288:OnjobNrYynWZQzjFeM6DJOjB9sTTHyeGkwhr402Gjaaz97PxYPKrzD0o9sIheoT:0ynYQb6VOKHwS0l3zVxRwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666947954, "uuid": "48b6c074-496a-4514-bf05-f5e6b95a0306", "value": 1473024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666947954, "uuid": "bba65b46-2886-4732-9d61-88ccf2ddccf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947954, "uuid": "5e37d19c-8e8f-4dd5-ab5f-9c78eba94e2f", "value": "43c315ec3be59be4ef5aa52e440fc10c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d01ffc-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994632, "uuid": "7d9188ca-d0d9-461d-992d-ea84b8e50eb1", "comment": "Malware payload (Meterpreter)", "value": "46e9d62aa9266ce1ed2a8620934bd7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994632, "uuid": "18358818-32df-48a0-a975-8dae4c27dd72", "comment": "Malware payload (Meterpreter)", "value": "5237f1c6bc2b3e3a4cfbd4faca00c7a503d7312bf99077b33aba7bd873d88c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994632, "uuid": "4c323f74-4107-4bc5-9d55-e021ac53ee1d", "comment": "Malware payload (Meterpreter)", "value": "3c2735804d4c0ab5456d0121993a76beea2b37a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994632, "uuid": "458b0383-31e7-4d85-b059-99537c9dbdae", "comment": "Malware payload (Meterpreter)", "value": "b0be132def4926f46577443f530234b8fe146f28f70c066ec79c1fccc80e71001ea2dec42a37d6c68962a231a8dbf22d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994632, "uuid": "6499b7ab-cacf-4cf6-a3d6-e8a0f6457cb5", "value": "T15373BF43E5C41421D1A6123D67B53BB1AA71F5FA3205C1DA7A4CCEE9DBD18B0B32A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994632, "uuid": "1bf1a3a0-e656-4b66-9bef-af391d0064b9", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994632, "uuid": "e50bbab3-b9f8-46be-bd12-a3769e9bf66f", "value": "1536:IFYOZ1A4aKGrZHhI2OXaocuIu1iryCMb+KR0Nc8QsJq39:iZRG1hVwGTyCe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994632, "uuid": "76612117-c3a9-4403-ac5b-a5eea3871861", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994632, "uuid": "7e6d6fd0-b581-4b43-a21f-946d477c64cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994632, "uuid": "d1ce8a1e-f8be-40f5-84ec-d51713e00d11", "value": "windox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c8580e-570e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666995320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995320, "uuid": "d81fca16-60eb-45bf-a9ec-76f7db6f59b5", "comment": "Malware payload (RedLineStealer)", "value": "0b1e13c771188a515ea4ea30b8d766ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995320, "uuid": "4b5aec67-7beb-4175-becd-7e25a976947c", "comment": "Malware payload (RedLineStealer)", "value": "5381690d532b1bb3a23cb7f58bb769b6ece2105541f93f2bd4b33621d2c89cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995320, "uuid": "69803e87-5b1b-4b26-a9fe-920af932d3ca", "comment": "Malware payload (RedLineStealer)", "value": "534a641565e23070d7c4d8759ff6ece56c088216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995320, "uuid": "cb8646c0-2c18-4f80-a96b-4a1b38a6a81b", "comment": "Malware payload (RedLineStealer)", "value": "04905d2ce0e6580b030423f928da1c565d6b734407a23bfafa25f1ccd308c56d9cad7a20c903dbc06e3bfdce35081689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995320, "uuid": "b6fd1227-b91f-4f56-8a70-6de1d6a71972", "value": "T1C784F1217490C432C09656305825DEE57A7EFC361EA98A8337543B5EAE337C1BAB631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995320, "uuid": "6b720454-e82c-4c18-9e6b-454c4a07cb4a", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995320, "uuid": "056e0d15-9cfa-4756-bffc-49c59a5fe2c2", "value": "6144:w4WBhwmLwjVR9juLRXoQIUzAyRzIanmDKHj5e1lwEoPJWwN:UBpcjVRK9NDzXFIfDKHFePwN4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666995320, "uuid": "245088bb-8f4c-43cd-bc98-a7e09e49ebd2", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666995320, "uuid": "6973c991-4212-4f11-9c19-261b56c0a305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995320, "uuid": "618e0ebd-c379-4e45-b627-a544277fb911", "value": "0b1e13c771188a515ea4ea30b8d766ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69dea78-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1666937693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937693, "uuid": "6a981c8c-1255-4cf8-acb9-970d2d0e31a0", "comment": "Malware payload (Vjw0rm)", "value": "7ddfc342c9f0e973e588d0b980400988", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937693, "uuid": "2aa9ece1-cb0e-4b4d-91ca-40d99dc366a8", "comment": "Malware payload (Vjw0rm)", "value": "545e07060055522336d2f99ea2c9c98d8aa292614118f8f27f3e1b8903358ad3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937693, "uuid": "e8ea82c2-5488-4a43-9c6d-9f126970890f", "comment": "Malware payload (Vjw0rm)", "value": "6e3cbb4392a2319fa671d6ff82782994ae33ced8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937693, "uuid": "493a1134-06a5-4cb8-aef0-98f0c4bda275", "comment": "Malware payload (Vjw0rm)", "value": "7b97a400077599aab645c8298243696f4b22108905fe925d6e9ab34b77cb3ba1a361e8da15c0a8003905f273eaf78c85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937693, "uuid": "9249847a-0849-4758-af4f-3d64a11c74dd", "value": "T18B338DC0BD5343B1AF4C3D4B7E68AD2A97BC5E4B11DE99EFBA14BF481842006E5051AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937693, "uuid": "ab61e65f-738a-4834-92d8-d3a6de8b89ce", "value": "768:1e+J7PKm43Xyn2t7chI6R0n/AJ7wRAm02eCTV8OQB7s/MsU5K:xteXcy7AI6aYJUqm02eCTV8xs/MT5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937693, "uuid": "df438538-589a-4c88-8bb4-f162e19abb2a", "value": 54259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937693, "uuid": "9ffeb8cd-0d00-4d3f-8a0e-1e59e3fae869", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937693, "uuid": "e6d5a6ed-fc15-4eec-894c-9b3d975b855f", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb318ee-5655-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666916147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916147, "uuid": "1d43ab77-538f-4b3b-8b34-bbe3b2d3e040", "comment": "Malware payload (RedLineStealer)", "value": "71155ca8463bc8274dd811e20ef71132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916147, "uuid": "22bea9c8-c076-4ed5-bcd1-e448eb2a48a0", "comment": "Malware payload (RedLineStealer)", "value": "5557a2bcc7fe32cb9d044a69d04ebc8d631ebdc92b9d519b4139680678dc0bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916147, "uuid": "923c795d-16bf-4729-a722-84e5f24e15ee", "comment": "Malware payload (RedLineStealer)", "value": "33e0e8357ef796a4a36cb95794a68f97cde28b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666916147, "uuid": "a550c60c-41fa-4897-8e09-e5d971bbc1e5", "comment": "Malware payload (RedLineStealer)", "value": "3b23b60658e850e5bce0bd9eafae534599fc63ed228558504a1ae05c907abc0edffa1bbdb32b51faaddecfe0192e48ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916147, "uuid": "13bd9dcb-4dea-4eb5-ad0c-ae8b7ab21ac7", "value": "T1ECC5B03AE70614B5D76353B1C29EFE77DB08BA3480269E2FFF46DA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916147, "uuid": "980109a5-a11c-41fb-8c43-1a18e8d55440", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916147, "uuid": "64d21ee6-c491-4b77-89de-64b90a7d2ffb", "value": "49152:aKnRi/S6AJ9f8yuC+CT6g4+DSqpqBEtrJVqrcZLIREFOqo6H:aKnRi/S6AJ9f8vC+E1FmEBV+Rt6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666916147, "uuid": "85ff6a92-3387-4273-8efd-a964d160b290", "value": 2523136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666916147, "uuid": "2df2b2bc-5d8d-4b6a-9786-27ec555ac7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666916147, "uuid": "df06894f-c289-4953-9cd3-f0f998bd0395", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39eb203-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "774eeb09-924c-4f61-b9e6-652ee8d5e416", "comment": "Malware payload (RedLineStealer)", "value": "37cdc5b3abbd074fbb5d85299d70067f", "object_relation": "md5", "Tag": [ { "name": "pw setup", "colour": "#CFE83E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "b1fa9972-0b65-4b09-ad00-fa9ecd13065e", "comment": "Malware payload (RedLineStealer)", "value": "5597ce2a72e2368ba87c2d1003dbf1d85bf0aeadcf7827533e131d32f228aef2", "object_relation": "sha256", "Tag": [ { "name": "pw setup", "colour": "#CFE83E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "22ccf52f-07d8-4b0b-9cd1-e212f1cdf2ef", "comment": "Malware payload (RedLineStealer)", "value": "7010a86fa36cb03c6b8690d555f066242da5d514", "object_relation": "sha1", "Tag": [ { "name": "pw setup", "colour": "#CFE83E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "c6391293-5791-4a6e-b5a9-dcc17451f5ea", "comment": "Malware payload (RedLineStealer)", "value": "ff16570469ec8c762fe41a39fbcb616acb8b31c815f5ccb1f2483e29c38dcaa1a05ebb9e29b00019156d58c071ecb209", "object_relation": "sha3-384", "Tag": [ { "name": "pw setup", "colour": "#CFE83E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "softcloud-link", "colour": "#C798B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "76c69e29-9304-407f-aa00-ae60a038cb6f", "value": "T1C05633680D8B9B1D3F46058235E8E6D7716D0D0D8A952968D63AEFCE705FCA1443EB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "f6cebcf2-5c6d-42e5-a73b-e147579e31c1", "value": "98304:MvE7XirW81+WtHGP6xJ/4pqQq2NcdAGO61eVZCr1vNtzToOyb8rspt93:M8KW8ttHG0/4YQxGO61eaRFtzNyb8g/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943728, "uuid": "8c5d9eaa-bbf5-4edc-8c66-05f0c44bc08f", "value": 6102014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943728, "uuid": "0a4e2257-6439-47a4-8575-d242de3915b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "e91a1c45-ad36-42b9-9b49-a4de14086fc1", "value": "FL STUDIO 20 CRACK pw setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241f0a47-569b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666945984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945984, "uuid": "9a0e7ecc-89ce-42f2-bb9f-53888272dcbc", "comment": "Malware payload", "value": "648407f49c353f1fd28ad0f212f94ab8", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945984, "uuid": "3ac4fec1-2d9f-492d-bf7a-6e438b5a4dde", "comment": "Malware payload", "value": "562f99694f409022a39966b8673727384d7c40baad92cf03fa1d99e1a0c2332f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945984, "uuid": "d757a4f9-4a44-4faa-a228-d2e7023a1648", "comment": "Malware payload", "value": "0024c91e2cf176caab7874d20fa09cfe660709d9", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945984, "uuid": "aa7657f3-34f6-4e97-9955-fcfc3bc78dc9", "comment": "Malware payload", "value": "eec0c7919ac24140f5c72fd63558223d733f046acc178486fed9ffc98377ff0990b548a5ef380266b55bc272fee466b6", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945984, "uuid": "cfb94e9d-f7d8-4d78-8f33-1fdc33e46eae", "value": "T143028E6CAF9AA930C2478674FA1404D3F35D1C09B717AEDA3E1112D81661E8C4BA7EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945984, "uuid": "05cae5ca-58ea-4848-b2c4-5690a3c57b3c", "value": "192:x3WmtfP0Fv6hiRNk6s7jMdfb8udNkJI2ojDC:x3ZWCOwcdj8udNYI2ODC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945984, "uuid": "7ec30243-edab-4951-b6f5-1a1da378dbfe", "value": 8468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945984, "uuid": "1c772757-d275-40e9-9a1e-4f597a3354f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945984, "uuid": "293d6a1a-820e-45bc-b437-adae1ce86d2d", "value": "Lea.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751b7a13-56b7-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666958146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958146, "uuid": "676bc17d-e65b-406d-ab7d-4a1a6b94e0a2", "comment": "Malware payload (ArkeiStealer)", "value": "4b70d90514b7a73d1863efa0aeae7908", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958146, "uuid": "5c5294f0-34b1-444d-aac2-61dc1d19391f", "comment": "Malware payload (ArkeiStealer)", "value": "56362cdfd0e92466e0531af9298b4efc0f2a2b4faa3352f41c3c77cf98cde54a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958146, "uuid": "96f17351-b7be-41b1-9f61-e4702344facb", "comment": "Malware payload (ArkeiStealer)", "value": "e86a84da28e6cda6efbb847b82ff5ec855428940", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958146, "uuid": "6313d9d6-cee9-46ac-bde9-b04f3c0b1cc7", "comment": "Malware payload (ArkeiStealer)", "value": "a752ad9b7c3b163dd7f465de8f2775769c0bf81803f084eb11535484b613c68d6495bd1a2f1528f4d65f3ca9ef8a747d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958146, "uuid": "6f1c53f1-8146-4bb1-ae65-1046807c2fca", "value": "T17E74F1F23652D471C04511348429EFA19ABEB832EA254AC737F4276DAF723819A7731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958146, "uuid": "efb5bed7-bdf7-405f-af63-994e64bef33a", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958146, "uuid": "fb231c82-c090-491d-946e-f284d77b4e24", "value": "6144:seYmHWLRCuIuMDNyWwkdGznOxv3DU2l3FarYfB+vBveQ1gtTq0VT:sebHW9bIdB4f7iJtfB+JtGA0VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958146, "uuid": "65881fba-10f0-403c-bdc2-18a277ca70c9", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958146, "uuid": "b7b5d3f2-c72b-4d4e-9a36-724371fe2010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958146, "uuid": "ce4c850f-a6fb-40d7-98c1-a26ed46b7fe9", "value": "4b70d90514b7a73d1863efa0aeae7908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6c100a-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938648, "uuid": "5d0288a5-56be-44c3-ae03-e8e4542cfb92", "comment": "Malware payload (Amadey)", "value": "fcbb1ec4cab8fe46fe96dda99fdf9ff6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938648, "uuid": "143b5968-2d12-430b-a53a-2ff723107f44", "comment": "Malware payload (Amadey)", "value": "5661c57982c13192ea6d9b5bf6a91cd7b9986dda3c0852ebdadbf12300790ee7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938648, "uuid": "5d6ee6d4-c4b6-473b-8236-28eea8696a64", "comment": "Malware payload (Amadey)", "value": "8362286cf0e304490b186b4e73066691c440d4ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938648, "uuid": "c45b21dd-241d-4735-8d88-000a04fa41ab", "comment": "Malware payload (Amadey)", "value": "1be87a1c21ae665487b35452b05a827fb6821faade2c33bf6df8e44ac649f77f555aa885e236530f32f9d27bbeb44bbe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938648, "uuid": "a69e9eb3-5444-42ef-9e75-f31fe258cfde", "value": "T14164DF3E75B2D871C0452130842ADFE41ABEFC3019624A4777A43BAEAE732D1717625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938648, "uuid": "c62e1772-727a-4c63-9d0c-a2c2ef714608", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938648, "uuid": "c9f69a41-accb-493e-a8c8-ba1aa0bf0a70", "value": "3072:xuXO8kq0sxZuiX15qtO3IAlSLXQps+83ltkGPLYyNktAWeRQNPCezeM/h31:8Tkq3CY3IJWK3ltlj7+8Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938648, "uuid": "563dc5c2-3c4b-42eb-a132-0e6199819aa5", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938648, "uuid": "57bba309-2983-47d1-a81e-88cd04aba595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938648, "uuid": "3943eed4-f2a5-46c3-a2c1-89eedf65213f", "value": "fcbb1ec4cab8fe46fe96dda99fdf9ff6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f453b9-56e1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666976025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976025, "uuid": "e96238d3-0e68-41d7-8b3b-644ddaa8080e", "comment": "Malware payload", "value": "9d0e8cf5c13f3aee08db0b14a4eb709f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976025, "uuid": "559aa942-3184-4568-bfbe-8ead32f9eb3c", "comment": "Malware payload", "value": "56718d47f3b1e48f257c1da71bc9723047bf714e91788769435d9f67c60e5b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976025, "uuid": "6a5310e0-1362-4e64-9e55-87598682780b", "comment": "Malware payload", "value": "78a676d313364857d7dc739a5a6450df96fa837b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976025, "uuid": "97fc40f2-1063-4200-8dc9-5e0c152eeeef", "comment": "Malware payload", "value": "e6d813be528861735aae2d2bb3b1983d53776f4e198bb3bfec1446a83f79f5879907e05c63508ca615e210f14944853d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976025, "uuid": "0454602e-fe13-4850-aee0-45b3a21b36bd", "value": "T1D0763341BECCCCB7E21359324B29B7C451B1EFCA4A31C5272369DA1CBA58536A2B3746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976025, "uuid": "fef167f8-6ad2-46e6-ab1f-aeb7fd67ef88", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976025, "uuid": "fd621d4b-0290-47f0-993a-90cbc4287ff7", "value": "196608:91Of9ka8WX92yb6mnv3jpmvussuSWB8sp:3Ol+WsK1vzp+bJBBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666976025, "uuid": "25d2d658-320b-4248-b06d-583fd745055e", "value": 7581461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666976025, "uuid": "39834121-c5dd-4b8f-90ca-12f742a40e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976025, "uuid": "ec7617c3-b0f3-4a31-bf72-2ec1f7836867", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218f1f92-56b0-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666954999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954999, "uuid": "9cb38cfd-67b3-48ee-9d68-f6f34bbfe5e4", "comment": "Malware payload (GootLoader)", "value": "75fb01670a93340899b2b3608e3c504d", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954999, "uuid": "1821cc45-4ce2-4aa2-a1bd-ede1221132c2", "comment": "Malware payload (GootLoader)", "value": "56c50f7fa7ebcd5a5f9aeab7e31b2e15c94d5c56438fed97b801147f907710d8", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954999, "uuid": "25d6cd9d-c779-48ac-bf15-85242fa2e6a5", "comment": "Malware payload (GootLoader)", "value": "68356b661a94437af56a9aa4a456d15d04336d2e", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954999, "uuid": "de13df10-73b3-46db-893a-36ec725f7560", "comment": "Malware payload (GootLoader)", "value": "92e6ce0301e4e72d5dfc6edc993000dbdef714bafb9f3100d1247d13a7e14fd26970b5a852cb3eb277e27bc1f9e7b412", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954999, "uuid": "9f872add-4276-45b6-9c69-226671a1c1bd", "value": "T11FA2D103E79EC66066A7F59FA47868471C76F8FDF07798A5E38AD1E883C87908103613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954999, "uuid": "0c4daba1-6d5e-4b49-9e5a-614c3a7ba357", "value": "384:42jYFpRKuu1WX28xO8tPLKWau2SnJ7TBZ1nHN0EkfLSMRPxLskeSNMYqigtsUj:42ynnu1WpO8FKjur3tHvbIjgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666954999, "uuid": "3b298fd6-4edc-42d9-a083-759068e58e77", "value": 22260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666954999, "uuid": "3f3228cf-1dbf-4118-9219-05e8f26417ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954999, "uuid": "3a5bdedd-6945-4bd6-b672-fe240f477d14", "value": "Which sentence has proper subject-verb agreement (64637).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffbcc8c-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666970941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970941, "uuid": "cee263e3-6e8b-4a51-a543-3cb8c7f026a4", "comment": "Malware payload", "value": "219d85e23e66b7394d089a737f1a234b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970941, "uuid": "ca8f7c2f-3cdb-4633-803a-b6ce0f4d5f2e", "comment": "Malware payload", "value": "57fe45f0fc41a547707e643735b89ab3df37ca3af178f504e5652de70ca51500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970941, "uuid": "13ec5959-5c77-407d-a133-dc68536ceb48", "comment": "Malware payload", "value": "9cbf89949250b304237594744112fda5d5307de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970941, "uuid": "4d5835cd-b5fb-44c2-880e-145007410026", "comment": "Malware payload", "value": "c466c22a558a608e0edca241bc8cb1d59928affb5f9b6eea4e4921e2caa7b467362b83188c1ab74af361f5798e230fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970941, "uuid": "a6f412bd-141f-4f61-98e6-5f3fdb65528d", "value": "T14F763301B2B0D6F0E68A09729A9D7BEF73F5D78A0B65095333C88D2D5F7868580057FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970941, "uuid": "37b3db33-79dd-4ff3-9f47-d02306931afb", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970941, "uuid": "3cecd9f0-2c9d-4d1a-80ac-5ea09b3feb18", "value": "196608:91OW1QNfE5UlgmsLeWYoOsUygJtBqmzjyoFVfcWfq+:3OW12rlXVWYoOZygPBTGacW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666970941, "uuid": "08feb049-e72c-4821-9bf1-4522d0e00cd5", "value": 7613380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666970941, "uuid": "d5f7d2e0-fa67-45f3-95a2-d2ff1e50b18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970941, "uuid": "f7d7f08e-a12e-46af-90bb-b382604c210c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690c975d-570c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666994633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994633, "uuid": "edb9ddf6-4d80-4968-a3bd-1c670298555d", "comment": "Malware payload", "value": "9912d75d6f279a667330d187aeecb51e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994633, "uuid": "1a10340a-ddec-4e3b-be57-33c398a87155", "comment": "Malware payload", "value": "584bd954035020f5bf4699ff5c1e345b915df35c618aaa85d70d8fd2666a5809", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994633, "uuid": "716cfd69-7be0-485a-9910-2ffd538ade19", "comment": "Malware payload", "value": "ffdb5a203dddc5fc4fcdf1295b14612ef12cd4c5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994633, "uuid": "29e750ab-3d63-487f-968d-64114312660b", "comment": "Malware payload", "value": "e5b0a7a5a66b814f5d6c80ad3fe86bf8cbd92904b1be6d2e10fbb8f525e68cbdccae3b7c38d9264a8d655a3a222575f9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994633, "uuid": "c4def34a-82b7-4ab8-a168-dd9c21af2918", "value": "T1B9144DA97AFA7999F1F796431E3BF8884B3F38D425209E0D46DC194C1AFE61040A57E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994633, "uuid": "0ad87004-4e3c-471e-a648-11e90e1af0be", "value": "768:5O1dsIKy3d5dwx385lSaPEfriF+uWD21rG2:5Bg9WbES2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994633, "uuid": "7159455e-30e8-4e88-ae42-71f763764517", "value": 197020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994633, "uuid": "569a2e36-c780-4883-906c-18c1e362100f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994633, "uuid": "016f8dd3-4be6-42a5-9439-aa6e62ac111f", "value": "documentos DHL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60fb9b0-5709-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666993527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993527, "uuid": "65a28a31-0238-4c31-8171-3520f80147be", "comment": "Malware payload (GCleaner)", "value": "5b35d0169f0864107dacd9b75bedbec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993527, "uuid": "40edc856-64f9-4f71-a1c9-b2d56555930c", "comment": "Malware payload (GCleaner)", "value": "585e5f3ba5d426578f4e658d39d17ef483b719e550631ca7e30464937928c9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993527, "uuid": "4e28f576-3ce3-4033-8aeb-7d557ee35cc8", "comment": "Malware payload (GCleaner)", "value": "46c87996389091fd4ea14cdfa01d373d99d2c167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993527, "uuid": "e253572f-7b73-4662-b876-99d2b3d4c096", "comment": "Malware payload (GCleaner)", "value": "cd414393100e353d39f81b08df274f194e9c9ae7091de5156d6c66d1e8320bf5ed998a353efb7dbc935709ec6beb7809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993527, "uuid": "d5489735-5539-479e-9b12-179d9511323d", "value": "T143C53316CBC14436C471F6719EF98F5CBA12B93088361AF6572C7A5C2B73FC124A9B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993527, "uuid": "5a3b5f98-0d00-49cb-9308-a2b96c60ae0e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993527, "uuid": "0dd1b525-8256-4a1f-b7af-1a2fd12fa5b4", "value": "49152:Z2zNCLnhjB5AEHdDTJublhhPT+4Wcm70Co24Suvj5M/ziAS3apiCbEJAFVMp1EnU:M0jBJpTcJhZT+Lcmddhuvd6/saMAFVMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666993527, "uuid": "e1e4e444-a4c8-4cd2-9105-c0f5c19c287a", "value": 2613939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666993527, "uuid": "047695bf-b0fd-4b3d-ad31-bf1a36dfc8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993527, "uuid": "dc8cf2ef-84e7-4f87-9d20-22969c0695b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e91bd8-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949129, "uuid": "772155f1-4e42-4ad6-878d-ae1ab9b45dc8", "comment": "Malware payload (SnakeKeylogger)", "value": "6cb8759cd2297fc7a248be0dd18db7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949129, "uuid": "734ce48f-75e4-4504-9f1c-972277790a1a", "comment": "Malware payload (SnakeKeylogger)", "value": "5a3c69ee6b4762ec4b6b9a5f7db9120e5ebcb6316dda39bb8e6c00184bb9c3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949129, "uuid": "fa7e8992-2105-4868-b3a4-13ddedbce5f2", "comment": "Malware payload (SnakeKeylogger)", "value": "032f4c7d4ba383922a31ea66ca79469d5cd6746c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949129, "uuid": "853359c2-ca8f-4155-af88-1dae710c7893", "comment": "Malware payload (SnakeKeylogger)", "value": "3a22757a660e93e3cbf536c83a97b96bf8c6d1379455369cbdfd2c4bc4d2eee81bd163ebd744fbfe9af75ce7645ccd03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949129, "uuid": "f0c5ffef-bc4b-4679-9cde-a2b0e7e81584", "value": "T176055CD1F15098DFEC6B49F1BD2AA93024937E9C94A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949129, "uuid": "87c053fc-a046-40b1-9b8b-1b652a0fbaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949129, "uuid": "2ea5cf85-a9cb-4538-bcbd-62269587a60a", "value": "12288:IJh7EA7H0k3X+0IvtE/Az1vP9sUvEyLhkl:ID7REtEoNXvEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949129, "uuid": "0ac5d749-a069-4153-809a-0ca8960b98a4", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949129, "uuid": "58009156-c305-4e9d-a6f1-7cf4daa54212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949129, "uuid": "b51e6a51-3add-4005-8df0-cce8cce22a96", "value": "pernyataan saat ini.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62007770-5690-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666941363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941363, "uuid": "cb08c311-554f-4d29-b419-ca0de850385b", "comment": "Malware payload (GCleaner)", "value": "4c0f9593e1dd69ef31f204717e920f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941363, "uuid": "8d9a1792-c4e8-4fa3-ade8-3ca49841559c", "comment": "Malware payload (GCleaner)", "value": "5ac75c017df0fbe03cd01d9413c9ddb8560712a07b942d4f639b4b2a3ecbdfa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941363, "uuid": "89e1fa13-5f38-4171-b9f1-d4270d2d6203", "comment": "Malware payload (GCleaner)", "value": "d862105c160b703777e4d325fcdc08cd29af8c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941363, "uuid": "30c42ed1-46b0-4c57-86ec-9b66ebb1d6a4", "comment": "Malware payload (GCleaner)", "value": "aacbc3ba06b502b6bca2ef5373292d0abc54000b8df205dca864f9fa5c571d36e08b14794fca756787505e92bcaf082a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941363, "uuid": "3e66e68d-1083-4851-a319-de6d3e5600ff", "value": "T13D64F156BD81D831C89830349836CBA02ABFFC7124259943B7B4376E6EB53E13A753D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941363, "uuid": "6c4b1936-e2e7-46ee-9efe-8ef4b71dd64b", "value": "ff6659a3b7adcc9d3b718a91e331c2a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941363, "uuid": "190db34b-bb6b-4482-9445-81a9d8b39b2f", "value": "3072:usXOYqIaxAnDK0ZN5A+ctIpctXWOGHPFVoNm1hXFCzCeMEZHc8zkqWjJKgfA9F+b:B7qG+ecepam5P4NuCzRMEwqaffjQ9w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941363, "uuid": "3052d3a6-cd02-4fb6-93f2-352e207ca361", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941363, "uuid": "2c6a23f2-9adc-4235-8501-337755f7be15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941363, "uuid": "1b0bdd5b-198b-4857-a79c-5d648ae72e93", "value": "4c0f9593e1dd69ef31f204717e920f27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8846ba-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666959076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959076, "uuid": "8ff71f90-6f3d-4827-b573-20c5f350071c", "comment": "Malware payload (Amadey)", "value": "ad444dcdadfe5ba7901ec58be714cf57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959076, "uuid": "4bfc22bb-353b-4900-9115-57711ad29ffd", "comment": "Malware payload (Amadey)", "value": "5aff860634fadee66a6e8220e67f7ebc88bfcde7a905a2753655706c0252afd1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959076, "uuid": "fbd21c66-9806-4138-ad0a-ae2d43225bb7", "comment": "Malware payload (Amadey)", "value": "61fed673833726bd8261c1c94963ff23c412735a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959076, "uuid": "ef581869-2ac0-4699-b272-115c7b2c29ae", "comment": "Malware payload (Amadey)", "value": "7cd24004ed8ce3de48f56e8f55d476b4f9c7f6925603962a3fd8f8bcac048db1e5aad7fb6247e99fa24753a1f3d761d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959076, "uuid": "6771a4f3-b035-4927-868f-a4c8818d4c2d", "value": "T164C36D73F1D08872D0B10E7CED5AE698663EFE202C351657B6E94E4C693B2C1296C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959076, "uuid": "74d8d40c-7b65-4e6f-b867-66e6ee9186c2", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959076, "uuid": "f80922ee-9d07-4abc-99e6-3908bd279fd9", "value": "3072:ox7pOYzBekymWDWCMq6As523HeS9FAiZ87vO2rlL3RnS9:ox7ZNhy/dMq6AO0a7vVlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959076, "uuid": "7ca5624d-4b1a-459e-b0a3-0c36f3d148c6", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959076, "uuid": "ec771206-4585-4157-b856-9e9ea5def6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959076, "uuid": "27807fab-280f-4dc6-a0c5-16253d433568", "value": "cred64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e116db-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666938654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938654, "uuid": "7fa92b43-7f9b-4541-8c31-2519a85b2e89", "comment": "Malware payload (TeamBot)", "value": "aeb9c63a862e3a5fbaa4c903eb1dfe4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938654, "uuid": "5a4c86a2-a03e-4913-87b0-4135ba5ed508", "comment": "Malware payload (TeamBot)", "value": "5b1238264babdd70a3f305472c1db98695b73afba3a0e2bce34314f7cc28f21d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938654, "uuid": "c5f90e10-f4f5-40cb-a64c-21a6213d4c82", "comment": "Malware payload (TeamBot)", "value": "65143bbf179a00dfbca201b2155134cc16033339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938654, "uuid": "122d9fbc-2a05-4987-9de5-4ca70ac67568", "comment": "Malware payload (TeamBot)", "value": "f75907575ec17f33ca482045494aa000a6b57999891658aa00e05e1a125d4cbf5fda308af3c6513f8fa6fada8cb21e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938654, "uuid": "538da1d2-d94d-4aaa-8dc3-0a099f5a093c", "value": "T18144CE327692C4B2C08221304826CFE52B7EEC315965468F77A43B5FAEB53C1A57672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938654, "uuid": "90b7c377-7b6a-49ea-85b2-6cd976134a7a", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938654, "uuid": "655cd20e-29d7-4ec8-a073-305f46b7323b", "value": "3072:xmHXOvHufLg58A8KKQG1fmlk5NwIZL28LbA/PGj5KyqMb13RWZsXEVy4sTM/h3gi:43UHYLg5pKT1uowQL2Mbg9A3RmFVoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938654, "uuid": "0c55ca92-8b12-4fea-948c-5fb0dc8efd51", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938654, "uuid": "92ddd74f-380f-4826-a363-fc68031f1c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938654, "uuid": "893aa9c5-4ae3-4655-971b-a1a4b4aeb874", "value": "aeb9c63a862e3a5fbaa4c903eb1dfe4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8201b18-5672-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666928730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928730, "uuid": "5a6fc8c3-c59f-4ddb-a764-a94ab080e06a", "comment": "Malware payload (ArkeiStealer)", "value": "046574dc17dca15013376cc8af4c799f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928730, "uuid": "6d21d3ef-feca-445b-86da-c121497e9c4b", "comment": "Malware payload (ArkeiStealer)", "value": "5b7761f34e35ebee0a4f76e3c4078c3d98e6f27840f981c5f3c7f47a8ba43e44", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928730, "uuid": "7ecd11d8-494c-412d-9343-dda9c06c5903", "comment": "Malware payload (ArkeiStealer)", "value": "68e3dc8ad4fce013bd822f95ff662252370e2800", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928730, "uuid": "4dc1fc91-f8df-4f4d-818b-5e4a29556f96", "comment": "Malware payload (ArkeiStealer)", "value": "ae397ce3a5d277a065b8a4ca03ca7ee127647dcf3d46b83cf7494950ee8a628661d65439d65b270f147ac50fcf8bafba", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928730, "uuid": "6ef5d182-fddf-42ca-8623-85b5bf42f025", "value": "T199F4122336C0C073E62215358C54C6799BAFB4B89A36659B7FE8572CAF31382DB25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928730, "uuid": "a098fe28-db71-4283-ace9-0e290bbbbaf1", "value": "9277faa69a3b2f155b9e8565ccbc8235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928730, "uuid": "746df3fa-be5b-40d4-bd38-6507f2119bfe", "value": "12288:rU4CZCW3vD4jj1/ySJ0dfA8B2qTHmNPPAPGOotJpbld7jQmP9DX+An3U:rTKBMjlySJ0dF2KGNPGotJpbltQ8CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666928730, "uuid": "773de059-4bbe-4814-b8b1-5e099defce87", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666928730, "uuid": "2dd3d3d3-e3c3-4305-9e59-5a5e010e1013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928730, "uuid": "82d8faef-5d26-402f-af87-5b3566cb3fab", "value": "046574dc17dca15013376cc8af4c799f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25433951-5693-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666942550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942550, "uuid": "f6e5ff91-6c3f-42f4-87b9-25ede6b00be8", "comment": "Malware payload (RedLineStealer)", "value": "3d5ca98b8fd257c263dee31cf88c8375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942550, "uuid": "fc34d02e-d19e-4a26-835e-2b990608018f", "comment": "Malware payload (RedLineStealer)", "value": "5bdc99834bb593ed40414902672683b1ffa778115150641c02518ea7244075ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942550, "uuid": "cdaaad95-6213-479d-ae93-6e9aa82a50c1", "comment": "Malware payload (RedLineStealer)", "value": "435178d2cd7bdf2eeab445531e25791cdf613ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942550, "uuid": "de0bb850-7d79-456e-ade5-2fe85fd7aeb4", "comment": "Malware payload (RedLineStealer)", "value": "12ac4cbe79e68ae272b854b4754c65a8a8a117e6537b57c808bc12f10f4c5540d6f56a2fbe4519255652c980422611b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942550, "uuid": "10466776-3464-4e4d-97f5-97272eeae8ae", "value": "T1A8141249E54C7A27E6BDCBB44CAF416817F418C090B2EBBFB58926191FA5B445B033E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942550, "uuid": "a68ba70e-49b7-455f-b07e-30eca547d402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942550, "uuid": "2a7b4218-1336-4a6a-88d2-5b3a59cae07e", "value": "6144:pzs6pvOcf/UKr6t9YgW2gVDLs0bG1LmqJGe:pzdhhfSzYRNDLsLlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942550, "uuid": "8cb3eeba-3d47-4ce3-85d8-24d427996783", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942550, "uuid": "42649add-e4ad-4d00-8307-b418afd86777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942550, "uuid": "04f8a2a1-3bd5-406a-af16-544173afdeb9", "value": "3d5ca98b8fd257c263dee31cf88c8375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b8832b-56a0-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666948349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948349, "uuid": "698b5829-f82e-4d66-a9a4-0f45e5d87001", "comment": "Malware payload (AgentTesla)", "value": "f78cac0616d61b6a2af4ea264733c344", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948349, "uuid": "9dc12fd4-8001-497f-9abf-441bed00dd25", "comment": "Malware payload (AgentTesla)", "value": "5bfac9b9768fbb0e1128aa6a5d64c7f9f91999cecf66948d2ba19cae322bc8de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948349, "uuid": "5f3b71ff-7291-428c-84e8-c9cef3cb847f", "comment": "Malware payload (AgentTesla)", "value": "4d30da66c87cfdf5b0ec7fff1b32d1494b0a7a81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948349, "uuid": "c8d0e015-af7e-4cdc-915b-e3158f770069", "comment": "Malware payload (AgentTesla)", "value": "093c24bdbbdf3105e906fdb3ec5e7f7a7458ecc3291b6fbf878ab3d262389db4ec73c6b11350a752abac255deb6259e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948349, "uuid": "5bcab184-fb10-4bca-98b4-98b0acd9e794", "value": "T13AC3F144BC6C5959D9D2D3F617DF8883CDB7DE8D7E09FA162672761C42F46C022038AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948349, "uuid": "e67502bc-b9dd-4932-9ae7-cb10f972bc13", "value": "3072:a2s+DwtwUfLjvMmO5+JS5vsTHwkw+SKmUCUmDJlhf1B/a/rb8oT/Fsy:JVDwtpM35+JWvsTSpKm2mDbhfva/38oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948349, "uuid": "4f80ff29-ebb0-4f42-bd1e-adad7e44f4db", "value": 126984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948349, "uuid": "ac5a4476-b073-4b84-afb2-7dcf4ac56fbb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948349, "uuid": "73cca1fc-d47b-4a7b-bc99-6a660c2020a5", "value": "bankXdetails.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09c7cb5-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666952635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952635, "uuid": "e9ad2597-cf95-4b30-8ff1-cb6062e3745a", "comment": "Malware payload (ArkeiStealer)", "value": "64ad537f849ede7dfb246fe43fbaa90d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952635, "uuid": "c469cb44-b80e-4546-ade4-900baf70b35a", "comment": "Malware payload (ArkeiStealer)", "value": "5c5945344f52ab9a2b1ca0a89c6da8a0c44e0435382286f6fabcd6eb92d4956b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952635, "uuid": "1b229e24-a9bf-47a2-b99d-e5651dd391c0", "comment": "Malware payload (ArkeiStealer)", "value": "fe9faac111ce264b04380f2d5566fd5eb1a6f10e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952635, "uuid": "db1209ec-53d9-45a4-8747-f94cf4cbbe4a", "comment": "Malware payload (ArkeiStealer)", "value": "2d97f24ebaa8d8b63c56c38fa518eed8874080cda3e48393e35a7750bed4f454afb0de5d9c63825e9c94a28495eb1f86", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952635, "uuid": "78a31c05-2611-440e-bae0-449cb9f0035b", "value": "T15AA61398DBC33EEAC9198E31E1813F703315D921F9259AB34B154AC56FEB660DE130E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952635, "uuid": "c4ac373b-3f29-4114-a3de-b2ba02e12e0f", "value": "196608:Q5VKJdy4aB9OK9STmtb8kASw/uJrD0qPsLN+xxctbYDJ16Ij:By46A/CWSHrpPuec5Y1Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952635, "uuid": "0616c80c-60a4-4647-915a-4d7426c8fd0b", "value": 10176685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952635, "uuid": "0009e8ba-4839-49f5-935a-e57495358495", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952635, "uuid": "9bcbcb97-e220-4678-b464-60c23d82a7f8", "value": "lnstaIIer_.x64 (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749299b8-5695-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943542, "uuid": "47076ded-c8b9-44ad-bd40-4493c38b3292", "comment": "Malware payload", "value": "b3e5493ad40faaedb9163827fa74ed49", "object_relation": "md5", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943542, "uuid": "c8c84db5-4692-4654-ba4e-41eb6ee374d2", "comment": "Malware payload", "value": "5c77fe60b234ea9c9e0769bf4cb74972a9997b1c09144e05a769b827db641616", "object_relation": "sha256", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943542, "uuid": "d757a0d6-8910-41d0-b89b-6b5c249ac14f", "comment": "Malware payload", "value": "87e7295d9303d170fc84e1b19a1e82f296c3863e", "object_relation": "sha1", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943542, "uuid": "82fbe0c7-7b80-4b99-80cf-f49380c1bc02", "comment": "Malware payload", "value": "353950a26dae6673f4c5cbe837bfe0888d0ca729bd08282b7b81b8f035410755d2faffc80478386bacfc079c8fb5363a", "object_relation": "sha3-384", "Tag": [ { "name": "appshigha-com", "colour": "#5A8E74", "exportable": true, "hide_tag": false }, { "name": "pw 2022", "colour": "#BB3AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943542, "uuid": "ffed1c43-ecba-4f4e-8d4b-3f95225c0c6b", "value": "T115761231F49836A1EC4CC4B806B00DA403E56D76237B9BC43275746F867BE7E9A68D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943542, "uuid": "4d95c187-fece-42d5-8654-8b3fe22c851e", "value": "98304:GHAUvoyhTtZXvqBJKRdWuFy67SfKYC6FWuO3zMjCefhCQqnqBcOm2WNDA+0uM22K:GHboyhtZoJKlokYCOE3Uh+9NDnNsJ5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943542, "uuid": "b723ef7e-4a7a-4d05-9e09-ff2d7c0f4508", "value": 7300990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943542, "uuid": "307a487b-1025-4bc8-84c2-dd3f146f199c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943542, "uuid": "c3be6aa0-7892-4a74-a168-50b51a9690a1", "value": "main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9088a68-56c9-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666966044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966044, "uuid": "bdb351ae-7bb2-4ed2-8186-1e936617f4c2", "comment": "Malware payload (GootLoader)", "value": "0fdead699b9b6fbd42459d81a44d1c33", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966044, "uuid": "2d438f9b-91e2-4bd2-bbe1-4ce9cacff297", "comment": "Malware payload (GootLoader)", "value": "5cef2e8253462a3d2974554143c04bb386c0e2f659ec552224e22af9e9720908", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966044, "uuid": "fd022590-7d3e-4da5-8dd6-8b123232ece7", "comment": "Malware payload (GootLoader)", "value": "e025a59b833c6cf2c69dc8ef1b068847fd38156b", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966044, "uuid": "12ec54ae-3a4f-4b90-b59e-fdc8f5fd4794", "comment": "Malware payload (GootLoader)", "value": "ad99d3491c4caa4842639406f4a3da5652902122b8b4b0497246b77ff98323772281e01c506dc6798015b45efde5a737", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966044, "uuid": "23215e3c-3cda-4fc2-8d85-e3bf4e26d4d2", "value": "T161A2D0F46DBD1C1697118C7AB32B3603FC602EB86793F641CF6439E25D6AB980174D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966044, "uuid": "9a415777-b49d-4df4-96dc-cb90163731e6", "value": "384:l84OaHLkNQ55XflbJ+2AjbHlAXP4dkkeSsh23MAS2PxHdF6EJTaAmPVUZmo:7OaHLaQ559FIflAFk1scMAS2JHaEJTHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966044, "uuid": "c662fbc8-fa73-4a4a-bcbf-a5a6fd75bad5", "value": 22342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966044, "uuid": "70cf0c17-4266-4d89-af43-d76012926eb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966044, "uuid": "cdcb67b5-1ca7-4686-9026-a94250a7bc55", "value": "Which sentence has proper subject-verb agreement (80270).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c324699e-56cb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666966867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966867, "uuid": "5809b589-2331-4211-a9ec-b5148d1f625b", "comment": "Malware payload (RedLineStealer)", "value": "5c124e7b59f3516c7c82dde587c7f53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966867, "uuid": "1e238fe9-4d36-46a9-bba9-766645404e3b", "comment": "Malware payload (RedLineStealer)", "value": "5cef9640646eaec46b8b42280f606155a0880cf815120bc022dce5d1ac324ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966867, "uuid": "5ffe0af7-dca6-4771-bbab-4cfa03e0b0c2", "comment": "Malware payload (RedLineStealer)", "value": "d9b2e1ef518eb0ca3100e93878faf39af704f782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966867, "uuid": "0b7c5275-128a-4ac1-9c09-6c5920f927a6", "comment": "Malware payload (RedLineStealer)", "value": "16e4d271fa4c0fda8493de5e53934f0b03f55f289a1f6119989937631d1496c45fd29ee2477a8497cd5a6c711eee7969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966867, "uuid": "2b61c8fe-7e8a-4745-8915-91d009788644", "value": "T14D84F0357582D471C4A225340429CFF92ABFFC3116A54A4B37A83B2E5EB17C16A7A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966867, "uuid": "dbb456c8-5f22-4d18-a5e3-d1474e1ab222", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966867, "uuid": "f0c97fe5-4818-4515-9fd9-b70941ceabbf", "value": "6144:frdHYLrjnOFlkHX/YcWnn06PsEoXnxleZvj7l+7YEggv4NA5:frdHYzn0lk3/Y9sEo3xlep7l+71v465", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966867, "uuid": "4aa0b0ab-345d-4fae-b9d2-88d1d9629e25", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966867, "uuid": "6fcaf46c-7ced-4145-bcb9-ac917cb1480e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966867, "uuid": "f83c9123-13e7-4703-85ea-23d0fed8f9c1", "value": "5c124e7b59f3516c7c82dde587c7f53e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6aaf64-56be-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1666961000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961000, "uuid": "22b3d3c9-c773-49d3-8191-6ab565bd2724", "comment": "Malware payload (Quakbot)", "value": "7070bc1d67d097b988caaa7fd5b9aa5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961000, "uuid": "b81b514b-f9c9-4d44-8a6d-399aa2ffb598", "comment": "Malware payload (Quakbot)", "value": "5d1bdf66ece3473c16835516d9800652cce0b12ad592e8b4a9a1bf6ebffc0b3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961000, "uuid": "e4e8ffb2-5c38-464d-a2b4-43278ffbba03", "comment": "Malware payload (Quakbot)", "value": "b2a47678e95ca49c1cb01d73468aae7366b19a66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961000, "uuid": "b3d77db9-4d7a-43ac-8c7f-a22165a65130", "comment": "Malware payload (Quakbot)", "value": "dd8a63384a994e3b82b6c32db06e4b3026b7e4042dbb1dfb43c7c63826afc979b2183fc137621b03b78c6aa5702f11de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961000, "uuid": "ee1477ce-924a-4d59-bdb2-37a163c499b0", "value": "T1D0D49E22B2E8C037D13256F99C3B46A85C7BFD0139299C096FD51F4D4E39A413B6A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961000, "uuid": "acf8e922-0c92-4317-9126-d5259d34b2fb", "value": "34d094cea0fc040405cd0327eba81d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961000, "uuid": "209470f2-193d-4143-b71e-400a21b428ef", "value": "12288:8x8IFmbH8yS5XXUrIVcxxE/5IOT2LY/O9bBoY//x:R6y8bRZAyhI/LoO9bBoY/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666961000, "uuid": "f46ceedd-f459-4e26-a941-f66b963227b7", "value": 643400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666961000, "uuid": "3c99d6db-1430-4744-9892-18b6d622ed78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961000, "uuid": "327d1769-6627-4705-8faf-4d6597922869", "value": "test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0712300c-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666938634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938634, "uuid": "175a59ca-3a6d-4db9-8b54-63792500ca66", "comment": "Malware payload (RedLineStealer)", "value": "28e46da6d5d7586437d64a24bb2e5df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938634, "uuid": "b6a5cd41-6ee7-4c84-8f34-52fd80149e02", "comment": "Malware payload (RedLineStealer)", "value": "5e4e4d6e9de5dddb20304d9ea4d14110ba04929b5306ce4b8226158aded7c27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938634, "uuid": "5783bc40-7de2-4200-82ed-1ff87bce8900", "comment": "Malware payload (RedLineStealer)", "value": "6920a28cbb79cd7868ffb1393e651d2fece76cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938634, "uuid": "6aa7226e-ded1-49a5-b6e1-363e38f80c53", "comment": "Malware payload (RedLineStealer)", "value": "135b6dcaa64833c3ac43406d8c75aa1c4ac239a880a70e99d26293cabb7bd619ae99dbe5a8b9896b05c1b2817e3482ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938634, "uuid": "7d02b064-dac0-49ce-9a55-7517780118ae", "value": "T1D244D016BA82C4BEC88100344C35FBB5BA7EAC721668494377643B6F5E713D2A6B3357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938634, "uuid": "0ea97817-20e3-4f4c-93bc-4fda51efec7c", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938634, "uuid": "1cbed991-4115-4675-81b7-2cf5bfa98a18", "value": "3072:+pXOoaqfrxRnenq5ht8uqeQJ5ST2vjw+DQZ7Ygg8N0Kv:0RaqOIGudQJ5ST2M+QJX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938634, "uuid": "a9c534a6-9dc3-4b15-b604-096b2347818c", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938634, "uuid": "56651c31-3ce4-4a78-98b5-f472e132284b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938634, "uuid": "8146e7f9-7a23-4935-b53c-336b3907e678", "value": "28e46da6d5d7586437d64a24bb2e5df7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4b0cfe-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666938643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938643, "uuid": "3c4fbff7-abea-49ac-abb5-183aa44eb8dd", "comment": "Malware payload (RedLineStealer)", "value": "2f1432c85410abbcc4bfaa2aeb0fa833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938643, "uuid": "25679771-f938-41dc-b59a-85a486d7713a", "comment": "Malware payload (RedLineStealer)", "value": "5ed4eab50535b5bf71c56bf2ddfbb30c7f67372afb077fec87bc652cc6d74018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938643, "uuid": "137ce302-aea1-45a4-951c-ccad55d2ee28", "comment": "Malware payload (RedLineStealer)", "value": "19b091a1e5d0f099725d0e52511db63cdf972a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938643, "uuid": "74f016f6-62f6-4e0e-abd2-db10138aa98b", "comment": "Malware payload (RedLineStealer)", "value": "6b92957126a13d8cca6fcc8ee33d5eec672c510533e22453e5b33e343be7868cb206692f8abda7217f76d913024b4166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938643, "uuid": "6bd53d2e-2176-475f-9456-b8b0a0c0fa2f", "value": "T1AA44D0F2B581C471C4852534483ACFE52ABEBC314A25464373A43BEEAF752D166B722F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938643, "uuid": "52678f5b-a57d-4ab7-ad90-4edf8ad6b8ea", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938643, "uuid": "0bb9d25b-ac65-45e7-bc93-ddf8ea184c18", "value": "3072:GkXOSbq42TxtUmX15hrnCWQHbqqccBdNT6v1gvb8bjHCGLD9ZEHdZX+M/h31:NlbqTL9MIIdNT6aU7FD9C/X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938643, "uuid": "c5cd12f6-0e13-49c1-bcee-4e3a80626de5", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938643, "uuid": "c53d12d2-af96-45ee-8cf4-7674d37e9856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938643, "uuid": "25303dad-1b95-4e7f-9d74-74ce3e6df947", "value": "2f1432c85410abbcc4bfaa2aeb0fa833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58517a17-5667-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666923738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923738, "uuid": "d98b6eec-ddea-45c6-b3c2-ce0fcae7b583", "comment": "Malware payload (RedLineStealer)", "value": "7d2cad0d3646f7087b271dea44587873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923738, "uuid": "6b487058-5dda-4a7d-8d32-b5b8929a579e", "comment": "Malware payload (RedLineStealer)", "value": "5f25f83229d7685cf7eec5f9fcce98e5f64c79f9e916327999ee6b5b7b015d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923738, "uuid": "c07a5f01-8507-44da-80c1-a8968953418e", "comment": "Malware payload (RedLineStealer)", "value": "9e7d4c506c15bbe09c14d2dd1ce0e0da030b4d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923738, "uuid": "1a253864-54fe-48e0-bd2a-a86e859907ff", "comment": "Malware payload (RedLineStealer)", "value": "08cec776490d48947afc6e61430e00e3764664d3df95b2d3271201ba7a7080d001dc5014eca18945ffef9589cd9c185e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923738, "uuid": "8bf6ae66-fde7-46e2-917e-935d662f056b", "value": "T18A94F131B982D471C08511704839EFE529BEBC7119258A473B943BFEBE707C6A6B621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923738, "uuid": "4e60e454-e79f-4130-9bb5-a64abb169185", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923738, "uuid": "df79c35a-9b07-4699-a13c-7ca1006945fb", "value": "6144:zFqb00SRbvQtWB30qGT7JKwUJx8xPTpswSN1v7EM5Po:zFqbTWbMW1RQUJYPTpKEUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666923738, "uuid": "06a269ce-9fc6-4a92-80c9-1eea241072e2", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666923738, "uuid": "ff62f350-77c5-4b18-b13d-9cf991eeba2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923738, "uuid": "72be9d00-8b4f-4c41-b373-a8f873fd9127", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dd9bf4-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666963725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963725, "uuid": "de2209db-9c69-4b04-9311-c3bea4f4acde", "comment": "Malware payload (RedLineStealer)", "value": "0d94dfa072b8f3d825b2112df703948e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963725, "uuid": "1183eec5-f4bf-4343-970c-ee248678739b", "comment": "Malware payload (RedLineStealer)", "value": "5f7be64cd64916c531655eafbdc55a88fb66f0d88e5a0a0f7e0bba5e98e411c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963725, "uuid": "e0296d54-666e-4482-b7c0-dfce4e733e07", "comment": "Malware payload (RedLineStealer)", "value": "f42134f3dc7dc72428e92fb520e7fefe9c7d1a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963725, "uuid": "ea5ae219-5cbd-4462-a071-9848c7d029ec", "comment": "Malware payload (RedLineStealer)", "value": "5b21e1bb36ed6e4d5a1e084e8ae7000f6b537cb55ef22824b0872998b97e1dff391095052d6475539bb93491d0b3b3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963725, "uuid": "68234b80-2845-48b2-a43a-6096414a0ead", "value": "T12E554C3AE70614B4D76356B1C19EFE77DB08B6348026AE3FFF46EA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963725, "uuid": "647c68f6-d481-4ddb-b51c-39522bcdcebf", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963725, "uuid": "fd9a6f75-f0c9-4a4c-bcf3-67202dea6892", "value": "24576:M+yPWRi/S6AJ9fkDSk0YCYl0kmiWMpL26gd+ePJj6nWAwgQo:9y+Ri/S6AJ9fcSPiW2Qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963725, "uuid": "902a419f-27ac-42b1-b6fb-0719ad27ae37", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963725, "uuid": "9e2cc350-80ea-4164-aca5-5fe243b2efc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963725, "uuid": "c25d3842-bab6-4947-a465-589c9a69d743", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5af6e53-569b-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666946201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946201, "uuid": "352bb388-a020-4c5d-b19c-444dc44ddbf4", "comment": "Malware payload (RemcosRAT)", "value": "1483c650c7aaa6d27338db16fc555a2d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946201, "uuid": "388614f7-6687-4131-938d-42c9949ef077", "comment": "Malware payload (RemcosRAT)", "value": "5fcd2b75332006a31b954cc43d15ff90e3f1b20baf45deee1577ad4a937fad24", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946201, "uuid": "19c15543-45d0-468f-a3ec-92ca8ce02715", "comment": "Malware payload (RemcosRAT)", "value": "08584cfd1d2d7971e12424e3dd3f5efb9b3334ff", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946201, "uuid": "0b7fba99-3274-4308-8908-d453655ff199", "comment": "Malware payload (RemcosRAT)", "value": "04f8e3e2f74b9034ac0530e0118aac17f2ed41b14a6c55d18e695a385c41fa0fab3fbc10caeae7ad1863d2ae183a80df", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946201, "uuid": "1f632a3d-3c3d-47b6-9c57-981c48134f6a", "value": "T1EAA423519B548AA8B206DD96C35FD8C80BF98C2E07D98FD5035D218CAFE5AE1DB2DD0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946201, "uuid": "0e20927b-439b-4f17-8055-58737dbe563c", "value": "6144:5+dricQkVnSf5jGzdUaY6KoU87GJWBzHvjmxUGlOUT8/TmRSbgpcXCV7aaMGJGWd:er1VSwLYVo2Jq0oj/TOSEpc+7aaFEZGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666946201, "uuid": "0fef9451-577b-4402-93f8-6f4a7e4f95aa", "value": 477823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666946201, "uuid": "f87f5e78-f88a-4040-ae60-944f0d0998e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946201, "uuid": "d3e9e895-9583-4ab5-8f21-87615254be5d", "value": "103_000RTGS224398_0571619530.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b5cad5-56c3-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666963435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963435, "uuid": "4e40e1c1-4bb7-4976-992f-e94e1d683ec0", "comment": "Malware payload (RedLineStealer)", "value": "257f1e9846e497b7dfebd5615af659a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963435, "uuid": "c813eac3-8aa6-4cb9-919d-c523caf877ad", "comment": "Malware payload (RedLineStealer)", "value": "608b3a3eecc04accf6315148614b200883a0977fdf5ba1990813b9e98f359686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963435, "uuid": "c7c6b443-b252-4f03-a9d2-a893b57bb321", "comment": "Malware payload (RedLineStealer)", "value": "3366f7c993bc49cc1bb62d8cd8d7ffc45cd53898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963435, "uuid": "c0df166f-298d-49e0-82b4-41175ee9a32c", "comment": "Malware payload (RedLineStealer)", "value": "8fecb816a110e2fb7b6806e98e4c3d464bd1d4bc37c3886f0ae03f717a242115943d6b9374d60917a226944b8eba2deb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963435, "uuid": "d587935d-ff8a-49ae-b788-1ca1263d381b", "value": "T1EDC5BF3AE70614B4D76357B1C19EFE7BDB48B6348022AE2FFF46DA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963435, "uuid": "98407608-6a1d-40b4-9e4c-af2cad80d3f1", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963435, "uuid": "87f2b6d6-1212-4cc6-a5c4-ef892d77147f", "value": "49152:UyNa5UKl7dQ6WFSPiwCT6nBoBkg3QJEjsKEpJ9WNxTVM1MADLYQwT:UyNa5UKlZQ6WFGiwE+GyEjwJ9Wjy1M4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963435, "uuid": "ddfe16a4-664a-4b34-9804-f9fab1d8dc9b", "value": 2513920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963435, "uuid": "4a8b099e-73dd-4453-af0e-c9c4cf3de3f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963435, "uuid": "16a80ee5-18c4-465f-93bf-d1f56ad8824f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1429e2-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666938907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938907, "uuid": "91710d28-5859-4a80-8a71-7f3c5e69d015", "comment": "Malware payload (AgentTesla)", "value": "b0310ae46b9ced3de3295364e0fc42d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938907, "uuid": "68567112-b8cb-4611-96d4-f9864c35adbd", "comment": "Malware payload (AgentTesla)", "value": "6093e65a3ed848632c3ea3f43152e5412f343be8202853abfe00e45e1bc7971f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938907, "uuid": "e355db27-4265-4be0-a041-35e7d0001caa", "comment": "Malware payload (AgentTesla)", "value": "f0205d634e6285604826cc33437fb25291d4e723", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938907, "uuid": "6ab75d91-cef6-4c60-8684-441dd19232d2", "comment": "Malware payload (AgentTesla)", "value": "28bc691f11f4a6cc41818676540deadeaea559046cc44dbf82ae92575d8376d1f32a4334b79812f11d02ae68e37b41f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938907, "uuid": "f0e611ec-9f92-4826-8963-9d8849a8ea47", "value": "T1EBC423B2DB339013CAFB53F4981E899513321F7A79F4A0DA1AC4724E2CF5949121B8F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938907, "uuid": "f622f0a0-9265-4197-98e6-b8ce618bf074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938907, "uuid": "3bd88624-7197-49e7-9789-a482a77d0bf3", "value": "6144:AHeaw7c7o3WMfzOp8ZTR8/YfQZf4m53xq0vf1UQXBHaY+9aLICmIGGCzQIcDi2KL:ph7RrTRgh35THaphDPQxDsEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938907, "uuid": "20f17203-b8df-4380-9313-c2df0df66000", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938907, "uuid": "b8e9600b-8c4b-4519-9536-439a0b036a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938907, "uuid": "daa81e85-e4ec-4e7f-a77a-a815c0c6502b", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3930f635-5692-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666942154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942154, "uuid": "7a52a2e6-ab26-4f8b-8307-441af61e906b", "comment": "Malware payload (AgentTesla)", "value": "761446eefdb3c1870cf330899bca88d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942154, "uuid": "7f3aa044-2e3f-474e-a911-9b6ade479b96", "comment": "Malware payload (AgentTesla)", "value": "6111943c89be7bf5972143ac598929e3c54eb518c7b10e8eea8241b44d57a699", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942154, "uuid": "19089330-c42f-442a-8107-e0dde3c41995", "comment": "Malware payload (AgentTesla)", "value": "6d2c0170e8e831339818841b2e2b6640dd35210a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942154, "uuid": "5d3a14b1-5124-4349-90bf-cf9ab1ded005", "comment": "Malware payload (AgentTesla)", "value": "ca05f3a2e31719a8bce95d806f5ee3f9eb7e78a4e1a4c2bc5c90c21684f4a0c92d1600afd03e968025a4637b2005018d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942154, "uuid": "d15b0950-3090-4834-96bb-c7f93eada05e", "value": "T19C65E0A170C6CE6BEB5C1930CCD3B2204369ADE59995D617B8CC339D88723537827B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942154, "uuid": "33592a8f-80d3-4316-801c-6901b0cd016a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942154, "uuid": "0ed6bc15-50ca-48b9-a718-d884718eaacf", "value": "24576:qCcyHb1VGorX3bU2WzEvOD49zY8dhH39NqmwEXrniUu:/71VGob32aODW/vNZw7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942154, "uuid": "6b91f8e9-4913-4112-a85f-791889cf8d6d", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942154, "uuid": "c25fd653-0465-4b45-ba80-d939930932c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942154, "uuid": "af750493-8749-443a-b887-f82a68521ad1", "value": "761446eefdb3c1870cf330899bca88d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dec1154-5699-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666945276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945276, "uuid": "3b92be41-4c23-4838-9d3c-25ee98dc8ffb", "comment": "Malware payload (RemcosRAT)", "value": "cdb0bd80beea1ccb7c8671a6177838c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945276, "uuid": "ff6afcc1-5ee2-4ccb-9f5a-ca0e34b167c9", "comment": "Malware payload (RemcosRAT)", "value": "61369d0ef913abff378814c73f8ace3f23692b90caa269e307bc985c8885f107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945276, "uuid": "5b49bd14-be28-4f9f-af0c-ed5a87a7a93d", "comment": "Malware payload (RemcosRAT)", "value": "3dc6d1bac1982e4724c7f7c26e1c367fc5904c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945276, "uuid": "3e0da08f-9d64-411b-8d25-e04ffcce29f4", "comment": "Malware payload (RemcosRAT)", "value": "4ec3041d7107b33d04a7b9c9b3bd8c0551ac6dee1811ae7ea3d1a0c8cd944743104cce3404c51d55693d9ea5a34ee434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945276, "uuid": "c1f19945-afa1-4cd1-ba2c-0061126c2269", "value": "T1EA52934BC3C45561CA3A463E785697B28721779A9CAD0E6A30BCB817BF733C24213D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945276, "uuid": "c44c665c-a453-4842-a334-50a93b7c54da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945276, "uuid": "b9ab6b03-ae55-4c7a-97c7-e089094617bf", "value": "192:w01QENUgyHhmPtWPnuAYITz0XQy88stYcFmVc03KY:ZrN+HhmPtWvuM0Ay8ptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945276, "uuid": "49e00ff4-ff4e-4a42-b473-a02988e8448f", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945276, "uuid": "fa84fbf9-f89f-47fb-a99d-215622ae36d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945276, "uuid": "3661280c-8d39-4e84-84e4-8981ed3973e2", "value": "SecuriteInfo.com.Win32.DropperX-gen.10603.27857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c83bfa9-569b-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666946052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946052, "uuid": "cd20022e-c91e-44f9-894b-f5d11a0a8e41", "comment": "Malware payload (Tofsee)", "value": "32842b08313ff890c9564566d8d3187d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946052, "uuid": "c2643561-e033-4525-96ce-20273c10488c", "comment": "Malware payload (Tofsee)", "value": "6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946052, "uuid": "7ac8f51c-df41-4dc5-a562-6b64d248340a", "comment": "Malware payload (Tofsee)", "value": "86a38a43c704017452d6f258a6c8372d65b9d186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666946052, "uuid": "52e7e035-149e-4e91-babb-13327ada5c24", "comment": "Malware payload (Tofsee)", "value": "4c539cfdb23c0c2b85fd4e76afa2aa6628fba7bf735bc11063df259eff013d432e2d5c6010437918844ea2522d2c127c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946052, "uuid": "f7e6c3e7-1a04-4679-8b80-ccb7f0cd1c91", "value": "T1D444BF257A92CDB2C0462130442ADFA0DBBEAF3116A4498777A4376DAF712C19677F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946052, "uuid": "2132473d-2fd9-4b2d-a7b0-849ee2ee336a", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946052, "uuid": "cd412c88-f40d-4495-9e40-78e5b1dc7d4c", "value": "3072:2XONHrELjqTABlvuGY3Z57R/2lpIOvGELdGbYByqF7Zl8tQ5M0VOCYyXV0M/h3:eWHwLjqIvRY/Rm1vCIyq/lPlE8XV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666946052, "uuid": "78519c17-4c71-415f-95e3-a3d86ffb41aa", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666946052, "uuid": "3bee2810-11c4-4585-8d48-6903845c09cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666946052, "uuid": "22cf2a17-0080-4a89-8345-b16f478186a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0016b7e7-5706-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666991880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991880, "uuid": "838429f8-c048-4bfb-962e-a1fbdd0a9683", "comment": "Malware payload (GCleaner)", "value": "f6019ce1a5cd8cf4d9bd8a41e9abf596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991880, "uuid": "6141d107-8f02-480c-a239-0298821d3206", "comment": "Malware payload (GCleaner)", "value": "614fa90242b5f7afe98a8537dc299278dc67c357ceae7cd832f61e4ac1ec7388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991880, "uuid": "3e54c1a9-e619-4b3f-aa5e-cb18bc7e524d", "comment": "Malware payload (GCleaner)", "value": "fcc97bd73710c25de15555fe5ea8f792c120dfff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991880, "uuid": "bed861f2-68bc-42ab-be63-35b1e9b717f7", "comment": "Malware payload (GCleaner)", "value": "2b3ec9a5748465b6418e9979a1105e46e49007d9e8d26824c5be8016de22a3651227d46b8b94a6487f11af2b7be7302a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991880, "uuid": "d33d7ec2-ee2f-4a12-bf0d-49b5f6a1fa7c", "value": "T13EB5333257404AF0F13048F49F326A1B8B63E997513EACB56EEC578E39AAF05C1D16B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991880, "uuid": "70bcbb3d-6931-442d-b0a0-09b91fce42a8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991880, "uuid": "3525664c-f336-430e-8fcc-b8feecc4425f", "value": "49152:Z2dDihAKYiSPpDN+yrXJQXR3h6FZr23Oi93o49FhpCEhfZpCvgA5hq:M0uiaDN+sZQFh6FZr3i9449RCEhfnCnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666991880, "uuid": "fe769982-43e3-469c-9a4d-a1a847aad9d5", "value": 2429177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666991880, "uuid": "7de32cc2-ee49-4f1d-917e-ca36dcede2c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991880, "uuid": "06d04e78-eabf-446c-81eb-a9c7ea47b8fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f361b9c-5666-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666923266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923266, "uuid": "773eaff6-c74b-48b8-b7b3-29d5b5250215", "comment": "Malware payload (AgentTesla)", "value": "76f7f07fceba81dd528ef9b10ecabfa0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923266, "uuid": "ab27862c-a7fb-486e-9590-c5a507645475", "comment": "Malware payload (AgentTesla)", "value": "61881ceb156b1061749e30c9e396bf12e94abedaebfe0acc723666c3f58e5ada", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923266, "uuid": "aef71a86-afcd-415b-bb07-d4fee366fe71", "comment": "Malware payload (AgentTesla)", "value": "6e5fea4625a773557cfc8cabd2df3bbeae41873b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923266, "uuid": "437bbcc9-4e2b-4250-abb3-5be4a27e51f2", "comment": "Malware payload (AgentTesla)", "value": "e2a89535e098fd0a7fdb6b565426f2fbfd6df90f9c8dcccdf1e6160a1fd67913481db6c654c351612ffe5b5a2ed30595", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923266, "uuid": "08672702-f4b2-499a-810e-cf7bceb9cf4b", "value": "T1A312FA0193D40232DAB102BB79678786D73597AB6847CFE974CC525E7F2264247233F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923266, "uuid": "35f2de66-aa75-43f7-8d42-881ea379168f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923266, "uuid": "c22581a8-a800-4b79-a564-a604da104cc5", "value": "192:mMLh7fWeLMRXgwdMrIC8stYcFmVc03KY:ZLgeLMRXgwdMsCptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666923266, "uuid": "0e2e8c59-1234-401d-bb37-c2a51c4d0c22", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666923266, "uuid": "ca9a1dd7-dc72-4dd9-9773-f585857a8fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923266, "uuid": "34eaf2ab-fdc0-47cf-81ff-11b966962235", "value": "SecuriteInfo.com.W32.MSIL_Downldr.I.gen.Eldorado.21497.7603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10c36c8-56bf-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666961763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961763, "uuid": "04659598-bc33-4be5-b5e8-37d2e4797c66", "comment": "Malware payload (RedLineStealer)", "value": "4f731aff69647d4320a96864cbedc075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961763, "uuid": "9e17ff58-d9ce-4fb1-846e-e8ddba039e20", "comment": "Malware payload (RedLineStealer)", "value": "61fe96e66c01ad5211b8796b52ff0065706bdf8ac93648e61898c732419b0e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961763, "uuid": "824eaf57-f2fc-46e3-80e2-94af6cdaa6ef", "comment": "Malware payload (RedLineStealer)", "value": "cf7e498f17474bdf47869ef17d74b8321211e6af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666961763, "uuid": "3cec7866-869f-41dd-b72b-c6e0b796285b", "comment": "Malware payload (RedLineStealer)", "value": "5f5ebc8ff3e5f5752095b3ef4a5bc5d1e4c887f3b98a4e59a661dc1c8b9d7b3ac41e0571e1d607ad27054266a91b8eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961763, "uuid": "a39c6282-cfad-4822-b999-31b19e749924", "value": "T1F044D0317A92C471CC862730406ACFA16E7EB8311965894777A8276EEF753C1B6B630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961763, "uuid": "2e7d3483-de46-4020-a343-0fe6c4a36fe7", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961763, "uuid": "88af0327-641a-4fab-98af-06114d26c697", "value": "6144:VxRH3LNbl3XeDN/n+PJdVVc1RSKDX33T:VxRH35h3OB/+RdrHKrHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666961763, "uuid": "e757a9f8-2bd9-481f-848f-5e693c51c6da", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666961763, "uuid": "2b0c1f26-42c0-49f4-a87b-2e45bf5b0940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666961763, "uuid": "65ae783f-10be-43fa-ae32-5168ff4ad548", "value": "4f731aff69647d4320a96864cbedc075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3be154e-5659-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666917932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917932, "uuid": "2424932e-b977-42eb-8cc3-b072f867c16d", "comment": "Malware payload (GCleaner)", "value": "13ac6a5ef66f3408af09ab5217cedb84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917932, "uuid": "0c6a2238-1fb1-4302-90cd-487e5653260a", "comment": "Malware payload (GCleaner)", "value": "6271354e0c53ac63b183849b910a637dc6965d82a559d0395978d63666c559d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917932, "uuid": "a1581bf6-ef3b-4ccd-a145-1be1010d3419", "comment": "Malware payload (GCleaner)", "value": "805f430b20a5e98ea47a4776d549c3e7b15ee22d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917932, "uuid": "235de530-98dc-4660-afcb-1ab5a59fea4a", "comment": "Malware payload (GCleaner)", "value": "455b0fd09b33394f6bd1acd6c6d8e396dfde9f4ebbebbbec64349a16bca106e592b47f453448039a8db866184f0ce8b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917932, "uuid": "43a0fa14-c135-49fa-ba6e-0dd3b1b1061f", "value": "T10CB53326A7988070C027C7792D66C51D6EF0683AAD722D39792D48D9CF70BD38C667F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917932, "uuid": "918a51e1-4588-43a4-b8f8-fe43919f6508", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917932, "uuid": "2202a11f-e687-4eea-94e2-7017d0122524", "value": "49152:Z2e8HSrI2HbcVWP6D3HsuN9ytgvSoQ7hrWor0iXOmyMJNsdUA5hq:MLHSrIGm9DzrhyJWorD/ynZDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666917932, "uuid": "172bed99-e159-44c4-ad7c-63432cbe7c45", "value": 2453308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666917932, "uuid": "47621da5-a882-4d56-bca9-6a0a8742c60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917932, "uuid": "65ab0e4a-0153-4794-933b-a864eb5fd59c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d0a593-56c9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666965745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965745, "uuid": "36146ddf-783e-494d-8f0a-70c11ec25858", "comment": "Malware payload (RedLineStealer)", "value": "434d146c1f139cb8dbbb36795275722b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965745, "uuid": "1e3c1fa4-3443-48db-bc46-ec29d793c3bc", "comment": "Malware payload (RedLineStealer)", "value": "62ecdd7b6b897f24f05846f21f5a78e25f43c7b25119fe1f9b3496fee1074339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965745, "uuid": "a93883ef-22af-4b66-8e87-62c4c08a4d1a", "comment": "Malware payload (RedLineStealer)", "value": "3ea5a88e8ecd97317acf405e8e1ca7ef40cf5b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666965745, "uuid": "b57e7154-3418-43e0-8a31-d96df7c48120", "comment": "Malware payload (RedLineStealer)", "value": "0033f9457a4132801963b75252ea95df4c2a259c65b2dbcd12eab805acb250f99fa73960a9528255e1bf3b25d61bfc74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965745, "uuid": "4866d88f-4c86-483e-b87f-9a9d565f74b4", "value": "T1C5C5BF3AEB0614B4D76356B1C18EFE7BDB54B6348022AE3FFF46DA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965745, "uuid": "e132a507-b2d6-4131-a9fa-7d24f4a266cb", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965745, "uuid": "afc736f5-f998-4b1b-9693-5e1ec8245a44", "value": "49152:BykRi/S6AJ9fcSPiVCT0Qo1aERU25uq7FhpzI88M+ATdGQ:BykRi/S6AJ9fcGiVEs359R/GMLTcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666965745, "uuid": "d2af493b-ab27-486d-9da2-38ded8e4577d", "value": 2540544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666965745, "uuid": "164cbda9-baa7-4647-a062-5cf338c1c7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666965745, "uuid": "c0263f0c-6385-42ee-88ce-9727f680c1f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2671bb-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937272, "uuid": "4b6fc3e8-89c3-4d63-af7a-94fba4744233", "comment": "Malware payload (SnakeKeylogger)", "value": "7c4acf3f9858cf84890888bc1830e32b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937272, "uuid": "22125ab7-744d-4a80-a702-58190a4a6827", "comment": "Malware payload (SnakeKeylogger)", "value": "6326a8dae7e332cd059ba1cab68aa5d50a517e7d09345cd1ccfb0f75c97bf4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937272, "uuid": "ac2f5aad-dc7f-4fc5-be63-d18b6bab3eaa", "comment": "Malware payload (SnakeKeylogger)", "value": "3a80552cf5817c7e100d524491b930761fd775eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937272, "uuid": "7d1ff3bc-a244-4488-b788-25c8edf220f8", "comment": "Malware payload (SnakeKeylogger)", "value": "1899b9659f8894a026d776059d8f3d0db2950391b921f0ceff874693882522e94dc33a035663f8e3d173cb6a56c46bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937272, "uuid": "f5dbfe42-7845-4744-ad0d-c647a4a8e0b6", "value": "T1BB357ED1F150DCDAED6B06F17D3AA83025A7AE5C94A4810C569E7B1B26B3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937272, "uuid": "64259ea0-6b50-4993-a3cb-ad7ffa82a424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937272, "uuid": "924a6fb7-ee4d-47d6-8404-50a66fc22b10", "value": "12288:yqh702iNpQYdKmZkROdbU31ZkZRvW+fpoB+1FMPHQusXTUVafs8vm8KFPOkmFp5U:G1amZ4OFU3nCxW+xosz7UcGAXb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937272, "uuid": "08bcd45c-6be3-4f81-83cd-e70bb018c070", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937272, "uuid": "af08c766-71f5-46d0-8226-3c3498b6dbf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937272, "uuid": "2b12fada-3aa9-4b3d-91a5-0e6830c48cc2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707c9c6c-570c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666994645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994645, "uuid": "8ef29b9b-b854-4c5b-84e8-437b1d9b812a", "comment": "Malware payload", "value": "a62e4376d16afbdb83487bfefce7bba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994645, "uuid": "473f3404-d7f2-4a96-b872-ece8ae757c86", "comment": "Malware payload", "value": "6350b45beef1ad7bf07963013232cd4cbc752fd68752e7ab58d801764b3d0102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994645, "uuid": "0b5a71c1-4b70-4c96-a933-3f87cdd51c06", "comment": "Malware payload", "value": "d9c974cbaa04f11084f87e5af3d7285de7cb95c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994645, "uuid": "2892da20-54c4-462a-b308-e2af58ccdee6", "comment": "Malware payload", "value": "e21941083e69af34f2eb68096103d5b5e714147a03255e1df89e3c80cf4cd6516a58ea326db45e668a873fb658c8b48e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994645, "uuid": "c088035b-5a8a-4005-b815-113cf4f900ba", "value": "T14135DC2A56D8B569E7F69B31BFF10193BE697C533838CC4E51D1030909A6B12FDA072E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994645, "uuid": "2c363476-b55e-46df-b2de-ba33e89985ff", "value": "4bbd4adfc99174f1d7d82430fab6116e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994645, "uuid": "0d197b71-74f5-4bb6-8a39-80e421f63315", "value": "12288:XkDB21/SsVIMrD6GFe6jhguSI7zu9eMb01JQntLOCTaTU8UQ:X40/SsVIIDhy9emTao8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994645, "uuid": "6122bf95-7fad-4c7d-b095-c78f19c51b60", "value": 1145680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994645, "uuid": "5871093b-4d31-4d91-8c75-68d8dec0e1cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994645, "uuid": "85ce36ea-1992-4676-b40f-df583a76fb85", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182ac586-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994497, "uuid": "8363a8a0-fde2-4a8f-a060-9ec5e1bcb56d", "comment": "Malware payload (Meterpreter)", "value": "29613e2dec4fc95380ceb7b7f9927ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994497, "uuid": "0771b487-babf-48c2-9b43-f84735edcbfe", "comment": "Malware payload (Meterpreter)", "value": "63ff8be9682621c56db43486aee61f6b86370417ab5d2a5375de2c4c9d336a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994497, "uuid": "0495cb72-60bd-4a35-9fff-66bbf71d0596", "comment": "Malware payload (Meterpreter)", "value": "0f13fb78d8a50e4801825ac1d211c557e5faaf62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994497, "uuid": "5a881c86-2178-4530-b66a-15739ff5ba23", "comment": "Malware payload (Meterpreter)", "value": "2282c7af911ef7fe2fb4576e6a61b4def3611eb32a824718ef6b74d644579f9a7c95a2e02ca72b7e864492d8b6863b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994497, "uuid": "50199fa1-b086-4cdc-afc9-a26d066080b8", "value": "T13573C042E9C02466D1A2127E17753BF59670F5B63602C19B7A8CCDE5EFC2CB0A3263C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994497, "uuid": "0b4f81b7-2c17-4d80-8e38-fb6f845a70af", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994497, "uuid": "87647ecb-52c2-4751-bd36-50693cbb06bd", "value": "1536:IVfxF+EDYwgg5N444tsL8cBmypKrwkaP5yMb+KR0Nc8QsJq39:KxF+EDYwzf4MnBmCAaP8e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994497, "uuid": "39429907-a43b-4ae8-8db8-1c3143d66aeb", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994497, "uuid": "dc4469b5-dcc2-4f55-9236-49d2e33c317e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994497, "uuid": "1030ab5f-e013-4078-bf10-711e47e60f9d", "value": "sfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e416465-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666949464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949464, "uuid": "33632a0b-5e23-49f5-8a67-a6574c46bd1b", "comment": "Malware payload (AgentTesla)", "value": "1b60a659e53a2c5aaffb5f2ed5fd3327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949464, "uuid": "78d736c2-7292-4991-acfb-6f676853dbfc", "comment": "Malware payload (AgentTesla)", "value": "64390f84bdda3e4ac71814cee7880fb0aef09efb2e33c5d885e6eba512c451ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949464, "uuid": "82e446f5-e091-4d3d-8bf2-f10764ca5155", "comment": "Malware payload (AgentTesla)", "value": "4c8b694979e79e6009ee6f0ce4b4192f9c0f5fb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949464, "uuid": "76120fed-98f2-461f-8698-4c2c2dbbb559", "comment": "Malware payload (AgentTesla)", "value": "208ae9bd0221919f72026c7d593b215b47c675ee3c31ee694c4437412f819f7cf63072c62e79c6cafde5f96d8a660fc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949464, "uuid": "568d45dd-e35f-4122-92dd-773ce4e45dda", "value": "T132F48B34239F4F07D0D9CE34A871D1B01A625DBBBD6ECA86CAD46CF7701A2E46A0D587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949464, "uuid": "af05cb94-8977-47b8-ad77-042308eebfb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949464, "uuid": "2c7f0033-e9d2-4c7f-bc1b-c625b1397328", "value": "12288:JLA+R9V1KEyGEX9/tTkN0Ap3brkv+h9VGJr7BmJTz:xR9vKr9WN0Alb1he7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949464, "uuid": "813082fd-8250-4962-bc46-6173758e8973", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949464, "uuid": "0e6eb6d0-0664-42bd-87b9-e2d2979bacc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949464, "uuid": "791d8fde-b1ed-474e-95ed-c26211e65426", "value": "1b60a659e53a2c5aaffb5f2ed5fd3327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a8a738-5692-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666942233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942233, "uuid": "47b6644e-83d3-4cc7-9af8-d1924900d151", "comment": "Malware payload (RedLineStealer)", "value": "a8b4c6a2c8396eb12f501f3ecf62d042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942233, "uuid": "a29e0421-6f8f-4f7c-9f6c-bbebeea25d5a", "comment": "Malware payload (RedLineStealer)", "value": "64a3c120cb987ccbb5228df2929a26e8e6b5a736bba86f133aec9a314c4ada47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942233, "uuid": "1d03491c-2ae5-4722-a7ef-00eae35c8f11", "comment": "Malware payload (RedLineStealer)", "value": "6827410c231c4ee2d43051125e3eaba51e4a0183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942233, "uuid": "6a2fee71-0652-4fb1-8496-4a7cbd13a1c1", "comment": "Malware payload (RedLineStealer)", "value": "771c1b1b793fffb33690c548ba3c9a5d25a214c2d4e259b9214280e1c0e5e7c48dc32655ebddbc113564754f3b6e87a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942233, "uuid": "3e431fa9-0df9-4e57-a51e-16bb4851399a", "value": "T1AD44CF217AB2C871C0875630842ACFE029FEFC315964498F77A43B5EAEB13D1696635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942233, "uuid": "0fdf1142-6425-4a0c-abd1-c9a22ccc39f4", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942233, "uuid": "08a5249a-7d02-4cbd-8ab7-5aa3ce6f1fba", "value": "3072:Fm0XOIHL6LyxuAhBAUGLfmlk5rqX8NG8zpT8bHraRt9AIDsP0mlpDKM/h3gU7:Ew7H+LyxzA/Ludsrp2yAz0wgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942233, "uuid": "ee8046c6-abd9-48df-9981-7d17a2934743", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942233, "uuid": "c8f0161d-0548-49c8-a1f8-c554e703c0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942233, "uuid": "40e4668d-ed39-47df-9165-20e779c01f1e", "value": "a8b4c6a2c8396eb12f501f3ecf62d042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90e1d54-5704-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666991304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991304, "uuid": "3d070732-b4bc-481d-8a7f-0f88c8b33505", "comment": "Malware payload", "value": "540643eecbdc441c9d720c3096092ff7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991304, "uuid": "2e13bf35-9123-4223-9197-630906d854e6", "comment": "Malware payload", "value": "64d15020fa60085966ed9e2cf4e332193d721f8008aeef38b646f6cf236a44e5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991304, "uuid": "d8000f83-8efe-4bc1-8881-18d81337f111", "comment": "Malware payload", "value": "7d4144b49d6252d5434cdfd3b2827ec619dde71e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991304, "uuid": "18d84682-a68e-4165-92b0-24215f66a95e", "comment": "Malware payload", "value": "b686365916a1b973146ed215433f1f603a451eedd4606edcc5f99509b8d2a7a28ea657c6b8ce0daf9ba2c818cce7c08b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991304, "uuid": "647fa29b-276d-4e6c-b1d2-6af3aa651a56", "value": "T19CF52317F262996BC8FAD23225791639507B8C28DB07E74A3D4877BD28B7DD80BC16D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991304, "uuid": "a365b061-acad-41bf-a027-32ec26742faf", "value": "49152://NUcSHe5UQtHy1fffEcy317sc1x7B3l0ZL7ZhJqswVSvsEFP2R7QBub9e3g5zpj:Xq16efffnRcj7jGPJq2kVQI5Dhpdns3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666991304, "uuid": "c3a29ce1-599c-4a35-8610-b0ff265e6ba4", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666991304, "uuid": "c9b4bd43-5b2a-4554-b06f-73296475f7fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991304, "uuid": "e36bf5bb-8d95-4d6d-9cda-7187edcebc3c", "value": "Lives (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae36fa72-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666949222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949222, "uuid": "6530d302-260f-4981-9d61-d0ef2cbec429", "comment": "Malware payload (Loki)", "value": "e0ba79671b9d15e286c875ab5369a1af", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949222, "uuid": "436481b3-5b10-47bd-8e9e-edb22f04d5d7", "comment": "Malware payload (Loki)", "value": "65069f8478127a897e8ebd0fce6725fe2954ec7f693f8c952b2eb61c68bbbaa5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949222, "uuid": "ffee2f05-e9f7-483a-9ac9-b9e4331c9353", "comment": "Malware payload (Loki)", "value": "f96a7275128a9e7404e87b2353af149f1ba8563b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949222, "uuid": "79631986-9cbb-428b-ba56-a44372ce6f82", "comment": "Malware payload (Loki)", "value": "d566aee9471e4fa20bbf0368dc5a3eb2f54bca499c4a311cf13f6a9525695e8b5fdedd68aa227677119e5e80d6e491ee", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949222, "uuid": "98dac2d1-0525-4e33-81df-e12146386134", "value": "T15D8422BC36A527D7CC7BAAB167521894032EECC9534AC45043AD3ADC9573718D2ECAF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949222, "uuid": "6155dcd1-f2ff-4987-b17a-7e2db3b6ee25", "value": "6144:e2uRk4/fTQlWahRlRxPTEZhcv9PR7CWXEswtdOhg1gC6CDZPH4VVWzdgRjS:7sTkXlD9PR7CWXej1gCPqAgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949222, "uuid": "3c917a5a-d325-45e6-8320-f091a919c656", "value": 372856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949222, "uuid": "b973cf9a-439d-4577-9b91-acb4a2fbf654", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949222, "uuid": "8267eb18-c7d9-4e56-95da-aaecea8dc605", "value": "Request1094107.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff30644-5692-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666942111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942111, "uuid": "0f02bb69-ca59-4665-88a7-1d2684fcf270", "comment": "Malware payload (Tofsee)", "value": "b2b5a017a87d0a6ff977ade7da7cb0fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942111, "uuid": "e2eb6340-96c8-4a3b-b9cc-eca6a127c00a", "comment": "Malware payload (Tofsee)", "value": "65b17753c736e064a4262aed488f6d98668cc533c465bc5f1e2147df03b840ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942111, "uuid": "b79c5ecc-a14f-4e85-8e8f-0f87de6d4505", "comment": "Malware payload (Tofsee)", "value": "602bd6860f8dc9ac2b7ff4e91762ead8925a7169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942111, "uuid": "81ce0071-4169-4619-b6ad-af3343618214", "comment": "Malware payload (Tofsee)", "value": "89b3bba6375d5b31304698557773647aec79b72dec80389b3cc078ee892854856570d8a8d6208e5647d4809a66abd955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942111, "uuid": "f38366f2-2c93-44fc-b088-3b4781b10357", "value": "T1AA44CF317A82D871C44612308826DFAC297EFCF11D65498777A83B9EAE713C1A97235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942111, "uuid": "1dddc9d1-acb3-421d-91f5-d20d852e8030", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942111, "uuid": "77f42d32-d5ec-449c-9183-e51d5eb158fa", "value": "3072:gmZXO6HkQLLB3Ax5OVGCfmlk57thdHCR0E80pXtVKfPJGIy/Vp8oy8M/h3gU7:99xH9LLBIOsCuGh5CXpXqPJVy4H8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942111, "uuid": "b9b92f8f-1f63-4fcb-a604-2467a6bde76c", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942111, "uuid": "e3689608-d77c-4bb6-ab38-8d3635d34b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942111, "uuid": "8bbddc13-f350-41ec-9fe2-f7123dc63c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1d0a64-56a9-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666952143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952143, "uuid": "bc943ead-3e9c-496b-9641-f6508146f296", "comment": "Malware payload (Formbook)", "value": "d2906d9e91c8533ee2ae4ed348986186", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952143, "uuid": "031a41db-c1fe-42f7-a836-a0c6ec0e3149", "comment": "Malware payload (Formbook)", "value": "660eb5f2811753c24ecbd5c0e08c68d83d7eca1b2827ed90e2a5189ed61f3a5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952143, "uuid": "6b26e2a7-899d-4d56-824c-a1fd47273a0f", "comment": "Malware payload (Formbook)", "value": "ec198516eaec1a0643ae65183d22cadb9ea40821", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952143, "uuid": "5a439eaa-4508-4691-9526-8e0cff39b605", "comment": "Malware payload (Formbook)", "value": "df57c98968c199b96221ce0a83dec63047822c0976762b8572055310ea9c0652ca9931bea1c6452b65b4943686fd2265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952143, "uuid": "19e005f5-47f3-43d6-b93e-52f752fbe740", "value": "T178552201BBC288B2D4734A32993AB7112E7D3D304E74CA1F93E49D98DB716C1A539B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952143, "uuid": "6685db03-0fb1-49fb-a35f-e301b53a0fc0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952143, "uuid": "2bb5307c-ecbf-4da2-8dd1-18d1812a89ac", "value": "24576:7AOcZX4crdAyARkKS6Exqxn62UoMDgo3X+ImEb3e9m1gRo0sIYyR+2t:dQuy0lEx0dwgo+zE7zO+W+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952143, "uuid": "911298f1-69bc-4eba-b37b-fd6595076146", "value": 1299490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952143, "uuid": "3f08c9c5-6907-4fbe-b199-9fc10a7854b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952143, "uuid": "0a5b63a0-b87d-4c43-80bb-18f4711ac1e0", "value": "d2906d9e91c8533ee2ae4ed348986186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96926356-5706-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666992132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992132, "uuid": "6370b973-e558-415e-a63c-985aa16f16e7", "comment": "Malware payload (AgentTesla)", "value": "125352f3fcc7c52f9337c4c8c717ead8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992132, "uuid": "ef342cb3-adf0-47ce-a875-be2c341d86f4", "comment": "Malware payload (AgentTesla)", "value": "662ab57932dc781f2f009bd5dc5da69859dd2ca85aa75275a4d9ed65105a7dd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992132, "uuid": "63b5a72e-e973-435e-af2c-0f9fce3b079d", "comment": "Malware payload (AgentTesla)", "value": "b3fff3ae88550e79e7aabe5b20975ed4c8e2527a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992132, "uuid": "984d4277-1c3a-460d-a36d-ec2358774a3e", "comment": "Malware payload (AgentTesla)", "value": "f55b9d525bf6dc41a5b53746d0c24dd9f650666e8a2d58a43d33c7daa9cecb2ec04f6c4b4ed7494c0f4ba62057195d83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992132, "uuid": "45251408-5adf-451b-b52d-cb1ce67cf573", "value": "T17674236736E0C0EBC8E607F7DFB68376C6B9E60C9206124B0F749F6E6E611919D192C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992132, "uuid": "4dbb9290-0236-4915-b6b1-b86394b37e71", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992132, "uuid": "08a10c92-6567-4705-9a7e-198a6eac1e2a", "value": "6144:qweEpf5pHM3toahYzeNQba0qkQ0N+Z5mZku0Mg5aDfhDx+sAvSN7SNsxX:bf5pHMiadEa0BQ0QOZkuNg5aDfr4i7hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666992132, "uuid": "884c1681-e999-4e31-b121-90890c5993b7", "value": 343330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666992132, "uuid": "2dde62a9-52bb-4c5c-9d23-c57fa720413e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992132, "uuid": "1e4b3895-2f67-4b79-a796-0b9e8852b49e", "value": "Swift MT103______________________________________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6a4312-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666949437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949437, "uuid": "653c1b05-b73a-461f-89d5-d3a060f4856c", "comment": "Malware payload (Loki)", "value": "4b7720e8901640c7da830ea6eb2c3f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949437, "uuid": "ebf71c68-0336-4f5a-9014-0d3e6ae1abb8", "comment": "Malware payload (Loki)", "value": "664fa909aa18b744809679fb4957cdb9e4d3d1c7ce1856c1833288e0aed3fbd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949437, "uuid": "5f6dc161-b60a-4cc3-99f1-ffa4381ca55e", "comment": "Malware payload (Loki)", "value": "2c299d11ed3d93bbf95b56ab12b7531adac8cf0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949437, "uuid": "e7c21a4a-577c-4549-97ce-f0be21da67c3", "comment": "Malware payload (Loki)", "value": "8f2d5a8f1e82b04a6041daf5594041dee20a7be25a7193d7c6a89cf5b88eb36d910ac3f5a4cecc09f1638e9dc18aa249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949437, "uuid": "84e7b21d-e877-4830-8c73-81525f3ff19f", "value": "T1E1A41299791172DFC94BDA36CD981C60EB7024BA635FC153A08726AC585ED9FCF060F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949437, "uuid": "0c7c3953-a016-4676-a6f3-b91fbc31de35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949437, "uuid": "b4b53118-7661-4758-ba55-a9e797d579ab", "value": "12288:qKHh7eEyLf+yXNgw/ZGMqjuVZPN9i5XT7uVo+P:qHEyLf7gKZGLKVZV9iJ7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949437, "uuid": "5fb29223-8f74-446e-b2cb-cae11b454da3", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949437, "uuid": "ad1fe291-82db-48db-a19b-0dc0edcbf346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949437, "uuid": "ce82674c-9b11-4a6a-a595-6460ad7b2ad1", "value": "4b7720e8901640c7da830ea6eb2c3f8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02859eeb-5691-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666941633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941633, "uuid": "a842dd07-0cc8-4399-b221-7d4b64b64d55", "comment": "Malware payload", "value": "bd75f14586bb89734291492d7ef94c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941633, "uuid": "411fa446-0d6f-42e6-8f79-dac894beb254", "comment": "Malware payload", "value": "668a72120e51a4c2c822c1e05b713608a4a8a2dac77f531b56b4be7a1943d1c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941633, "uuid": "e21ec4e9-3eff-4e7c-b14b-5e9e3fb937f4", "comment": "Malware payload", "value": "ef3e398d8b8d197aaad90f228e865a34b8633cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941633, "uuid": "4e4f9f4a-a35b-4dae-81e9-3afe7f06fbe6", "comment": "Malware payload", "value": "2ad87f6a4a1ff1356a945901eef0eb5c518857d59f14f55b25ddeb9d4962ff6e9a695afe8e72a5ce50115df694c66dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941633, "uuid": "9967d7ff-4d35-4176-b332-17b146a0b2c0", "value": "T1DEC36D4071D1827FEDB05A3198A486A4C9BEFE212A558FFB27CC113D6E346D1433BD6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941633, "uuid": "f9b438aa-5422-4669-b2dc-a3cad3f0deb3", "value": "ef24c75087fef63bee8e83d10a6f8654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941633, "uuid": "f3f913d6-155c-42c3-b1aa-a9836c88f895", "value": "3072:DYEMncE4fg2oD3i2mIzYA+2nuUoSRpH4WprbPfPe1QFRcI9r:DkncE8gLDi24vu3jV4sbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941633, "uuid": "f2f8e85f-fd27-4a2e-8b6a-98aaa4ba4a80", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941633, "uuid": "61d7bb93-c77d-41e9-9704-92ea1dd7fbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941633, "uuid": "6307c4a0-ba6d-403c-bdee-056200f77c98", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17442.4295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9366691-56f4-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666984513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984513, "uuid": "9def6ef0-320b-4874-b587-0bd061e355dc", "comment": "Malware payload (GCleaner)", "value": "610c2597ef8c38dd051382291134cec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984513, "uuid": "7ba2e936-19fb-4ada-976a-69fe8d7397b8", "comment": "Malware payload (GCleaner)", "value": "66da2fce1b9eb472cf52d47a3ed5d5ccf8fb1bd15b9b6dc809ac6a913a6f4c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984513, "uuid": "f6a00fbb-78dd-4128-8c4c-797a243b9199", "comment": "Malware payload (GCleaner)", "value": "30f8795164de19201eb3f9334ebf05261587a038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984513, "uuid": "f5756386-1e4d-4ab5-8ec4-e8a6611d5b08", "comment": "Malware payload (GCleaner)", "value": "5a386e0f80e6df173aadabb9026f6d965f56e61454d1b92977edee954511ee1e3c56bb5a0b89b485baf552f1c6ad7ba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984513, "uuid": "04019064-ab6c-48c2-a055-01c31b8e215d", "value": "T17EC5332BD7E6C8B1F81445F0AF76E23B0CB3B460453EA10662E551AE7867F0DC885BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984513, "uuid": "29677140-4a12-4c56-9207-ae28c7a88310", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984513, "uuid": "9f303599-ae62-474d-a638-a1a05cd484c8", "value": "49152:Z2G9By3esCTp2WInd7SU1WM5x9L+AZ7KxTRn76K5e7mANjNRA5hq:MG943xCTp2WIndPHzL+AsNf5eaANgDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666984513, "uuid": "e385e35a-2da8-4135-a548-667de42816c5", "value": 2590368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666984513, "uuid": "0140f832-f91f-46b1-b34e-517aec8bd5d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984513, "uuid": "e141b9a7-fddf-4009-847b-aa20c8b92712", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffb0f3d-56c1-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666962432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962432, "uuid": "b1edd183-7eff-4341-b65a-2573a111ebb7", "comment": "Malware payload (GootLoader)", "value": "524e5cb87ee567042f3ae8a6c6507c74", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962432, "uuid": "28fc84d3-c94d-4d6f-a8a3-124bd6a81441", "comment": "Malware payload (GootLoader)", "value": "66fca7ed83ffdd8f63bbbe78d29a4fcd23cbef67c47d82f875cad0d7482f8add", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962432, "uuid": "80b4414e-e11e-4b22-8573-70647f830c8d", "comment": "Malware payload (GootLoader)", "value": "172018f86f3efbdea6915c259eeb6ffa0cc30563", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962432, "uuid": "4e371d6f-56db-40a6-a295-338decb59ed3", "comment": "Malware payload (GootLoader)", "value": "cf9727a9b2ef06181c7aca00a2add0e71dbe02d32fb00ed73fa803f74196fcc8d3e75a6744789a4b42645d77937c50c2", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962432, "uuid": "3ff8a6bd-f3df-4589-bb5b-9c05370af4ff", "value": "T111A2E0A3D130584BCBF28EC01364A867B1A5D2200C79446F368A99B3FA4DA26BC97847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962432, "uuid": "96cd7a96-0b66-4e60-8dff-bc45266d00f4", "value": "384:ye9KRVhUMs6TG/SJoicbxr5aD8RksUNEUzc0lge/7ByWIpuVMCZHOFdk87yC4nfT:y3rh4SWbh5TRufkeULUZuj7y7t8qD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962432, "uuid": "158106df-8d07-4f5a-8228-aded622b9762", "value": 22403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962432, "uuid": "f584c303-6f0e-47fd-b4d8-0411d496c163", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962432, "uuid": "582c84ad-b9e9-4fac-8734-fe7d1d534c68", "value": "Which sentence has proper subject-verb agreement (13239).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830c5035-56ac-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666953445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953445, "uuid": "c3b44372-3e97-414a-b6e3-64a95e6e47ba", "comment": "Malware payload (Tofsee)", "value": "29c4f7975a92090a67d7e7a553be8c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953445, "uuid": "f457d292-25a5-41d8-a453-dfc652aa3e17", "comment": "Malware payload (Tofsee)", "value": "6724ddb4e9eead37ddda5526efa5484e37ade99449de76fc84b9dd2aa90648ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953445, "uuid": "6eeeb29b-1cd5-410b-9278-f32f35819d69", "comment": "Malware payload (Tofsee)", "value": "ccfc84730518ba202b596052bfe6a9db1228316f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953445, "uuid": "b3d2dd1a-1892-4130-a54a-188551132641", "comment": "Malware payload (Tofsee)", "value": "bcafdf078738606c242d2f0e50a271c32584ab52a48c59bf5f519e8c4aea88f2505176bb5835906a2c8cb79675948e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953445, "uuid": "c21dca08-37f2-4082-a12b-0104bff702ca", "value": "T1CC44CF317AB3C471C4512130442ADFA0297FBB3136638A8737A4265EAE71FD2967A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953445, "uuid": "dca39eea-0bfd-4809-9a3c-f7b00f1546ea", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953445, "uuid": "42d37dbf-fcf3-453f-ae86-bb59e9a037cf", "value": "6144:KktHzL2usorLDNdcYBOT2g7PcJpXbH0Nv2qKozEZT:KktHzqVoXBdcaOMVbHqOqwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666953445, "uuid": "737be0df-600c-499a-ab12-6c5de96d3030", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666953445, "uuid": "e2469bd3-de2d-4de9-959b-8b6dfeb7011a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953445, "uuid": "aa4998bf-3990-478b-9e55-7c67a4ec8da2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d09f949-567b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666932201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932201, "uuid": "cb381ecb-dcd2-4023-86b2-9ef1d48e7a56", "comment": "Malware payload", "value": "fd7c99840a8a0c74eb7b1420aacb010e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932201, "uuid": "5e623dac-0525-4552-bae7-8adfc5e6131c", "comment": "Malware payload", "value": "677817a0182db451275cf23a4c1b96bb9d00ca6c3c50b244723bc6c0ef96b219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932201, "uuid": "a703acb8-1ba6-4c7b-bf28-e0d7388e31b8", "comment": "Malware payload", "value": "dd89248d95ab45261b9549b18e7e6a7618f82327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932201, "uuid": "7cbf8de3-27da-4a7a-95e2-019a09083d2e", "comment": "Malware payload", "value": "7f88545a5e901fd972770d194c440b01b980c819c6fa6f405ac78a053a7cc9155af13dfc41155058ff2953894e391a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932201, "uuid": "34657fb3-f81b-4188-82ca-9cf94a000dc1", "value": "T172263344EB46F376CB823D3A39FF1198F8E535778EB44461A5CF0850B92EAB4A0522CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932201, "uuid": "3fbfe6bf-6c71-4965-8f6b-5d2aeabe784c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932201, "uuid": "8d975516-54d1-4206-95fb-2bfe8dbc5d4a", "value": "98304:1rQR3Nb+4KKzahDusI5+c2dodQDtXvirn+ri:6x+4PzsDTI5gdoWpM+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666932201, "uuid": "4db0095e-7eb7-4e6d-8a8f-9b7e123a287d", "value": 4490240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666932201, "uuid": "9c0ab4e4-af02-46f8-a1df-12d8e62f45a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932201, "uuid": "ba173055-d8db-4f18-862a-65ef37d98ced", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24021c09-5678-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666930951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930951, "uuid": "9a6cd769-2db7-46e5-aeca-9aa75e1aee68", "comment": "Malware payload (Formbook)", "value": "69d3c12568ffd4739dd4d71e9fa26e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930951, "uuid": "332d0ce1-114d-4e90-b464-a67bfc1e358c", "comment": "Malware payload (Formbook)", "value": "69c32e09bd27aaea6ed0b0b448e6332f18e67daa0ad5d7cbc74718f9b1236cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930951, "uuid": "7a4626ae-e1c0-478b-8a2d-06f6652ba104", "comment": "Malware payload (Formbook)", "value": "d8067775f70b4aba1e268848b671b42b64ef3b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930951, "uuid": "39b26294-6457-4aae-a0f7-049257cd69a7", "comment": "Malware payload (Formbook)", "value": "7c5923b68bd75706545062465c159b818b588392bdc8b7184e1becad4a5cd116713c85f7ae6f036a5bd6240415dc20a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930951, "uuid": "9583b0c5-1c97-4e86-9627-daf8bae8de6b", "value": "T139F46A35235F4F0BD0DACE74B8B0D1F41A625D7BA96ECA82CAD46CF7B4162A46D0D483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930951, "uuid": "5be7c507-89ef-4171-84db-4a185f32644e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930951, "uuid": "2a0d848a-ef3d-462c-95d0-c40e69bcc5de", "value": "12288:q2tq1IMCN18kcAB7c4XMl6ChpwM44GY27bmJF:Jg8SkB7cb6spwN4gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666930951, "uuid": "d3736b8f-077a-4959-8b05-215f35dab93c", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666930951, "uuid": "f519de50-cbfc-4e6e-9f0b-c3fd9fa4e43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930951, "uuid": "6b61987d-5d8a-47ca-8294-0f1c434e6d5e", "value": "RE REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fad0a4-567f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666934275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934275, "uuid": "92cec66f-69a1-47fa-b05f-a753822ffcdb", "comment": "Malware payload (AgentTesla)", "value": "b93cb1bd8d8c7b6eb74de0aeae807113", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934275, "uuid": "5cbb52f5-45cc-46a1-a18c-fd0a69a0dacf", "comment": "Malware payload (AgentTesla)", "value": "69c51c86b772ba7f5b00d394cdfba30997ac7fb962d8f4d09e6f1d40e3494da7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934275, "uuid": "681e34cf-1218-4e44-94cb-3f2d6c7ca461", "comment": "Malware payload (AgentTesla)", "value": "d3e875cd7db2a3f8442c60f963fd6f206a61b31e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934275, "uuid": "daacfff7-68d2-4fe3-a5f9-b6c7309317fb", "comment": "Malware payload (AgentTesla)", "value": "f11529ac0493e51f26271208519be5ec0ee790212e63b220a7971f7a7c46ef6059d764d3ffa642a3fdda4ba30e50e70f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934275, "uuid": "ab918587-878c-4552-9c36-d671dfc0b80b", "value": "T1EFF4D02029EF522DF277DF701FE4B9EE89EEF2322606B46D149107C64B12E41DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934275, "uuid": "206adab2-af5b-4836-b165-d2dfcafcc685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934275, "uuid": "0a677e4b-80f9-448e-985d-be0a1ecaf691", "value": "12288:uO0AgHtDg5xE1HMdVorLb355K2PfzL5kHOyLgwK1t9A9P9bZzmw0ahz3z5LErq:uv4cGorX3aUf35qOyZKv9k9bIw0Wz39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666934275, "uuid": "6823375d-9d88-46e6-8b29-dc210b313c67", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666934275, "uuid": "f5f493bd-b02c-4b12-ab53-102d844ef4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934275, "uuid": "2f1467cf-5e4c-4cef-9620-0119350b1711", "value": "Soa OCT. 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cc072a-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666943520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943520, "uuid": "29c67a15-2b25-4a8c-9c10-9b32c15038e3", "comment": "Malware payload (AsyncRAT)", "value": "26382e18cb1c231d03273af73cdeeb92", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943520, "uuid": "4631695c-165a-4c31-a6a6-5c75729f99c1", "comment": "Malware payload (AsyncRAT)", "value": "6b1263d2d5fecfbd34926b6649b01b0187c6790b8676fb0a43e7919cf175b5c2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943520, "uuid": "d09a8d09-bc80-4003-825d-52ea7206f93e", "comment": "Malware payload (AsyncRAT)", "value": "1119985ce8dd3f6102db4adfa242f55f5bc0f3d3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943520, "uuid": "ecebc844-3701-4ba4-9e88-310fa9021d86", "comment": "Malware payload (AsyncRAT)", "value": "2eb4349bf90cbaffa2be0e8c137d6e880714f24ecf7d4088c2081b0835a17ff87998f19a5d3234d1e2b847c7232cb102", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943520, "uuid": "992278e5-ad92-42d4-8dd5-b6a42c1dd5b7", "value": "T154645523BCDB26C63B0E67A3EB03D681DC23CDF66F94AC8C1887906966D47075F45686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943520, "uuid": "169104ac-5a3a-4331-bafb-dd4f95c93da8", "value": "6144:BVaV/b6ac4M2vegHgXDjRPZhM2EmIZRRtmo8ywmpkuuH40OoIjIt2IRDGKVLZnLI:GV/bA4Hvegq5JCFCcSQXE4CKDj3aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943520, "uuid": "f6c31827-be82-4418-9183-ae0a00ffada4", "value": 314899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943520, "uuid": "e919f26f-a044-4afb-b131-4174573ed0b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943520, "uuid": "b5fe413f-f39f-44b8-ab4e-0fdc2f96dd15", "value": "assync.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d86d43-5664-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666922492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922492, "uuid": "e06e5420-594d-4ce3-8763-62bbb2ca1afb", "comment": "Malware payload (Tofsee)", "value": "643dffd2cf34e325c81bd77922064247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922492, "uuid": "1c78d1d0-d5e6-4764-9b6e-6b650bc822f7", "comment": "Malware payload (Tofsee)", "value": "6c409184f9358994d051f2304fbea36c608a3b3eb7c415e6f757b4a0e34ab317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922492, "uuid": "1dda0529-6f7e-4576-8b92-af5567b8a5b1", "comment": "Malware payload (Tofsee)", "value": "fc253782d6613f45a9e8293fac48c5880a16e83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922492, "uuid": "e9571e1c-30a4-4fbe-818d-21feeee6581f", "comment": "Malware payload (Tofsee)", "value": "823fba5333ad61f7444ce03eff89c9701a84549f9bf75c0fda737614764f83119f766c09941f18af22b71a9e44b55bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922492, "uuid": "7241228f-fd06-4978-a692-830a090634a6", "value": "T18144D0317E81C471C44525304426DFA46ABEECF1C62D498373A43BAEEE713D16A7A25F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922492, "uuid": "ae97f3ff-9977-4f10-8250-a64d1bf23652", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922492, "uuid": "9ad638a5-d9ae-44f6-a80e-274b835ae701", "value": "3072:yyXOdyq1PxvreX15FxLkOI2uy5SVNkJRLqodNM3PM/h31:vUyqy9nIbSSVCJpTdNyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666922492, "uuid": "97b20692-9127-4f3a-b8af-3fa025fe97e8", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666922492, "uuid": "a7546296-5d1e-49d3-8287-132a97af06f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922492, "uuid": "9c478ba8-9713-487c-aac0-033fc0a2c386", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be6cd36-56a0-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666948306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948306, "uuid": "d4d308ec-2358-4113-b567-308c8b19aa31", "comment": "Malware payload (RedLineStealer)", "value": "76791dd4ed0805e8c9f42ba8dc1f5ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948306, "uuid": "48dc723c-9294-43cb-950a-f2c70d54aed8", "comment": "Malware payload (RedLineStealer)", "value": "6d28e2d6c8edbd2c097126c1ef18898e029e4fca0ffd479d4bb0d4bbd57b97d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948306, "uuid": "469afbb9-9ccc-4ee3-8775-d9bc7ef04b15", "comment": "Malware payload (RedLineStealer)", "value": "6dc78a7d306c6bdf19da854b2c715e5d86c6bd9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948306, "uuid": "4e8fddae-6e1a-4b37-9eb7-7d367c305b26", "comment": "Malware payload (RedLineStealer)", "value": "73bd21c2b918edb62a1c2975d6a8e040cff808d020605b6a44eedb7cd04899198cb4326b5d54e0a5f68d736da32ee175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948306, "uuid": "ae1f8d7b-9fb4-4d91-8afe-5de7818b6226", "value": "T17284F13275A2D4B1C49221740516CFA06E7FF43117B58A4727A8375DAF327C2A6BA31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948306, "uuid": "1c8f2c49-f34a-42e6-a447-510a1adb0815", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948306, "uuid": "218d39ee-1b8b-4de2-8805-e89fa8047b54", "value": "6144:ZjEHCL8DzSm2rNZp4/KtR3L98v/L+Z5fmAhduZ7e5iZ5aERfd8snsCLup:ZjEHCAvSbpnRp8v/iZ53Lu959dXshp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948306, "uuid": "f7e985b4-4eb9-4b85-a33b-cf5fa18c865a", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948306, "uuid": "c6f4949b-2baf-4d36-86eb-fc33f41601ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948306, "uuid": "103a5b08-271a-4f07-9929-007e1fcbe58f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f1b002-565d-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1666919419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919419, "uuid": "0d4d5aec-3f8d-4baa-8f33-4f44a360717e", "comment": "Malware payload (AveMariaRAT)", "value": "309dfa6206a4422b8e106f424e8c200f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919419, "uuid": "0dcbe3a1-5716-47ca-a87a-f4d2de0f3da5", "comment": "Malware payload (AveMariaRAT)", "value": "6d941754a2209cf2052447b315f065c263a98c8b248df71fa7ef8ea4d419f1c5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919419, "uuid": "71fef04f-8502-4b11-883d-608f3806a6bb", "comment": "Malware payload (AveMariaRAT)", "value": "0c569998648b660724d5d72440a489db4165066e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919419, "uuid": "325a0478-3cf0-4d83-a8c0-323e805e2ffd", "comment": "Malware payload (AveMariaRAT)", "value": "cc2ad77109d39110f1d9d5b0d6b04a3b761f888466aadfb425e484bd12ba74f3991a0826bd37f4ce3a14d31ee6ae9694", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919419, "uuid": "e221d8f4-522f-44b7-8917-a92da81e9dd2", "value": "T112F47A75234A0F0BE0DACF39B4B0C1B057A65D7B796E8B86CAD46CF379122E05A0C597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919419, "uuid": "1a1ae7fb-3ca7-4e51-a130-67bb4bfb1921", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919419, "uuid": "55374abe-ba26-4a84-bc51-669cfb6b0e74", "value": "12288:Ry10PPJaxEOCf5lpLR6AlAUbXmbhAYS2JGIe6RFtKtLjAaJTLfjI:7CbfSfIe6vtKtLjAYTLLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666919419, "uuid": "9f10e173-d5cb-4a4b-8519-793197162ef4", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666919419, "uuid": "432bc850-c8a9-465b-9078-b51a20995a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919419, "uuid": "6c97595a-ea82-46af-af27-808c5007e9d4", "value": "309dfa6206a4422b8e106f424e8c200f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee94f9d-56f3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666983878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983878, "uuid": "219b5f58-e7ca-41dd-970d-ec92392c1b17", "comment": "Malware payload (AgentTesla)", "value": "a191fd3c987625001ac6c1d2634c4bdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983878, "uuid": "b11b4989-ef77-46f5-86aa-d4449d4d8831", "comment": "Malware payload (AgentTesla)", "value": "6d9a9f34e4c8202aeadae8bcac497079fc486b01f70c80c545af76027b9fad9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983878, "uuid": "09751947-6fbe-4bbb-bf51-9b4990265741", "comment": "Malware payload (AgentTesla)", "value": "93307e2713c18b4b0f77ee63853e5fd0668747ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983878, "uuid": "9d591ca6-8adc-4d2c-b356-e19d976d03fa", "comment": "Malware payload (AgentTesla)", "value": "ec4aa7586074ed79e20869e77e316f8a76e802c2073efe9710fc2c1ca9ca5ea2c19b1ed600edac851b28c1696aa53e31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983878, "uuid": "fdffdb60-1767-4d50-8395-122aed2cca96", "value": "T1D0451201FFD3C8B2D0735A315936A7106DBC39301EA4E61FE3D05AADEA705905A2DBB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983878, "uuid": "8f5b3784-5055-4c5a-8b34-6c1bed1b0616", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983878, "uuid": "ca15419d-bbca-4e84-b077-6506e2984d98", "value": "24576:SAOcZXoIGt47YqIf12ep3iFtL3t5Mk2NMPogo3X+ImEb3e9m1gRo0sIYy+:4itc2eAJ3t5h2cogo+zE7zO+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983878, "uuid": "fd0f72e4-14ca-4e3b-a6a9-4653bef17918", "value": 1232496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983878, "uuid": "1782912d-40c7-4ca1-9c37-defb53b7f98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983878, "uuid": "16218a2b-ee31-48eb-8da0-ccc39a0d82b9", "value": "Re-order204506.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa72d59-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938935, "uuid": "a87ba914-2c2b-4748-a79f-0e320dc0202f", "comment": "Malware payload (Amadey)", "value": "bac8c495aecc167e1c4353d059623b2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938935, "uuid": "bde2d70f-3e13-4657-9f12-7b4fc8d1aada", "comment": "Malware payload (Amadey)", "value": "6df2cf2058dd5e79ba2db0d51dbc41d1e8decd6f73c0a86c2f46d16e31a123c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938935, "uuid": "689dbac6-58c1-407e-81ca-c9dfce9b4de9", "comment": "Malware payload (Amadey)", "value": "39a9c86eef1339eefe1ffd9cf83bab736f972c94", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938935, "uuid": "7a7dfdb6-4d4d-42f9-9344-139eba1a40ab", "comment": "Malware payload (Amadey)", "value": "2af43e493c8cfa216bfb0714f2c75e9dbfbc768824aa6e7161b41f4ef14075e0a3b732ca5ada9946e314a2f81c8b498c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938935, "uuid": "ef09765c-b5f2-4bd2-9f05-25c1acb8ab51", "value": "T16264CF717A51D4B1C4813230842ADFA0297EFC71D6614A43B3A43B6FAE713D1AAB635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938935, "uuid": "31de6b2f-17b6-4747-b059-2ebfafe78207", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938935, "uuid": "84803922-cb57-4a20-8575-49439836c0f5", "value": "6144:PuSHjLhpsSqquiIYK7A3YOy4wV9ynay1AfRR+NVoKj:PuSHjVmSjuGKl4wSIRWVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938935, "uuid": "381f9ef3-44ef-4800-a4bc-31d9c9339ef7", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938935, "uuid": "e378c8f9-aa49-404d-ada1-4fea60017619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938935, "uuid": "f6bcdd87-3a13-4fa5-9db4-54a2ef3a48fd", "value": "6df2cf2058dd5e79ba2db0d51dbc41d1e8decd6f73c0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccae16f7-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666939395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939395, "uuid": "9403e9cd-4d70-495f-a1c5-a121077ca207", "comment": "Malware payload (Formbook)", "value": "de71b27900f7579127026d55a251e0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939395, "uuid": "bb2f2f6d-b79c-4dc6-80cd-a65a93f9d862", "comment": "Malware payload (Formbook)", "value": "6fe803bdde3a20a85f6d441087386bbb2e0abc7e9b694b5324e3164f333e2357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939395, "uuid": "0952ae80-aa52-4646-9636-fb8dd6984dc8", "comment": "Malware payload (Formbook)", "value": "71584b6f757507b4b61b211e8f85fe0ea12ec107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939395, "uuid": "e4bbc16f-0ab1-4240-9060-4c8dceacc86c", "comment": "Malware payload (Formbook)", "value": "47fa5be9e9b02ce2800b45bcd6a2b92ba4d5f4fef4dbe4a6b86b63a8f8ab29d8e3cc2a3f53ad75d84f07bdd529dbfb2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939395, "uuid": "44f04bd2-2052-4e2f-996e-9f43bb54bac3", "value": "T1CB05C03439EB521DF277EF741FD4B8EE89EEF6322606E469185103C64B12E41CE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939395, "uuid": "80e77fc4-bb81-4c1e-a3e9-8451b9333e1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939395, "uuid": "792501c8-78a7-427b-9dd4-7d12b556186d", "value": "24576:vl4ZMm2zbZL0tNq0SkKmrj1bUjGorX3g39ZH:yZOitW9mrJ6Gob3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939395, "uuid": "b1062259-9f05-469b-a912-f7239f7c00dc", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939395, "uuid": "a742a1c6-69da-4c48-ae19-a8932f28d925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939395, "uuid": "b9adf9ad-bb93-4aae-9f8a-2dd73f1d4a17", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6839caa-570d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666995246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995246, "uuid": "9941b024-9741-46d7-a995-b4dde588cdce", "comment": "Malware payload (Mirai)", "value": "ea6255b1c60577c86fbeafd0e9927790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995246, "uuid": "352bb327-4603-46cd-8ca3-c9a1948e817c", "comment": "Malware payload (Mirai)", "value": "70b3f0a407118f046842ab3e6387f01dab640c3817315d1cf4c84505424c10d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995246, "uuid": "88489cee-2492-4eee-8849-38d9f577248f", "comment": "Malware payload (Mirai)", "value": "a02f92efb418a7efbd195e9bb0619cc8b91b7c4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995246, "uuid": "6e8d243b-fa63-4244-bb17-2cf92ee55625", "comment": "Malware payload (Mirai)", "value": "7b0b93281768c6caaef01826e1e5a1a1a1db5e60a4b5fa9cf403dd9451408dfc73621ea5f7bde7d906d0a7deda43834f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995246, "uuid": "983557e8-9e9f-4bfb-bf1d-18d0862f65fc", "value": "T12ED2E15DEB58378CE462573154AFC13B74D6ECA3A33E42C68BC88912183C84D2779ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995246, "uuid": "da804d2e-a3d7-4261-97fa-76816b7b2040", "value": "384:MpGclfUDwDsOAFImUQSAAHdB9TKcSLJY7eoayfsqxRFpDU7/2LfnmG3NyqF:PcmROmIIA9zKpLJY7Pa6tpI7/unmGEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666995246, "uuid": "996a6dc9-f5b4-4c1e-a4d4-090b0b74d760", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666995246, "uuid": "2c7142d6-1daf-4e58-bc1d-9843c0083d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995246, "uuid": "5ec2bd8e-d925-4b6b-80d5-79624f01359f", "value": "ea6255b1c60577c86fbeafd0e9927790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e459eb-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666949507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949507, "uuid": "924a8e3b-fab7-438c-b791-c5e8345f6164", "comment": "Malware payload (DanaBot)", "value": "7359f40e1100c0c800bc84977512e8f4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949507, "uuid": "92174609-3761-4524-87d1-80c2a6435528", "comment": "Malware payload (DanaBot)", "value": "711d37b4962ad4756eadd8b899c296cd7d43326f0d70f35854b7955439fa8c3b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949507, "uuid": "63df80b2-a7a5-4697-a204-eb75fd19cd02", "comment": "Malware payload (DanaBot)", "value": "89a37a9b35c1b085f405b002729294631adbaf96", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949507, "uuid": "8c1a9750-71ac-4d71-b858-5cbec706ac30", "comment": "Malware payload (DanaBot)", "value": "a68c15c704ee8e0f7f367ef333533cc559552a1791801910b170439ec8a4127515f146f4f5b12a8525026ef44ddcc367", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949507, "uuid": "299ddf33-3da5-4a1a-9552-38f2ca90ef05", "value": "T17A563307294210BDE1B604316079D6E867BE56C2AF3BC5773A0E5F5A4BF02CA3B5A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949507, "uuid": "68892510-b8d9-4c98-a223-d6a53c8f5def", "value": "ff6659a3b7adcc9d3b718a91e331c2a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949507, "uuid": "796eb087-9500-4847-8745-4ddd60cd83c6", "value": "98304:wIE4h3G2236vWMezwC7j0D4/zeq/YP9g2Clrx9/qXlcwpA4qd/R3f8yAg5DsVgm2:jJ2hpUxkq3PGPzyxGRkitsV2wh0KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949507, "uuid": "67b4ce95-20b6-404e-993d-127d6a77771b", "value": 6377984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949507, "uuid": "a387a61c-8200-45c3-aafb-cb38858399aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949507, "uuid": "4d4c57a4-c53e-4413-ae7e-aee20ecd74c8", "value": "7359f40e1100c0c800bc84977512e8f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304b90c1-56e6-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666978217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978217, "uuid": "4126e4ab-e10d-4506-b746-efb21eb6753d", "comment": "Malware payload", "value": "3889c60ee7b36742f66909bef61c4cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978217, "uuid": "d3be641d-f6f3-4dbe-a1d6-cc40e7ed44b8", "comment": "Malware payload", "value": "71274128cc5e3a87961fd54508c4c3fbc9f3affe740457745dfc792854f37e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978217, "uuid": "0bb9b76d-9d8f-41bf-b046-f9701007bdde", "comment": "Malware payload", "value": "24086fe729e3f663c33e0a5f055c0ad9583663fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978217, "uuid": "3eb97601-d339-4a0f-87c1-0bbfe74d7b2a", "comment": "Malware payload", "value": "d617289051dfc03b56d5676f09b8fda7d308541ff9da99ea3d7bee2adb8b155bcecb1d06dfdbf23ab5b7a85eba1d8cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978217, "uuid": "603ad061-bf59-4f9b-8fd4-c3d05ba3fa97", "value": "T118763321E4EC94BDC15E0E799D59276EBEB8E235562C49A31B924C5E1F3D0C2CB37B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978217, "uuid": "81cfab7e-220a-4b11-a345-eef247763e5c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978217, "uuid": "b0c0a867-f340-4967-adcd-e109710f0336", "value": "196608:91OPNpqMvbr2Sb532HGVTpM2at33WHpXQaR9UyFQx3zBSlPazxnaV/b:3OPNsMvbrbb2GzM3tWHpXRjy1lHzYV/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666978217, "uuid": "749176f6-fee0-46ab-9e20-bd9e26af825b", "value": 7588751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666978217, "uuid": "27844611-7820-4513-bbb8-605e326cc6f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978217, "uuid": "c73742f3-c199-43a1-a2cf-3abd1dfb5dac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247fa683-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666952427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952427, "uuid": "ba0844cc-4edc-4adf-b255-3e9c45f3e4db", "comment": "Malware payload", "value": "b276848cace7093613cd12709176db03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952427, "uuid": "105e8db9-7751-41de-aaef-9c0bdaac20ba", "comment": "Malware payload", "value": "718e0ac7657e93f6ceeb665231d9cf387688fe7f499be27b67831d6d570db419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952427, "uuid": "23994fb9-2203-4772-94ad-587349f11877", "comment": "Malware payload", "value": "9b7a346c3f5e458a248fabfdf60bb037c14ce582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952427, "uuid": "e0cae45e-e93c-4464-9a23-716b7fbe47e8", "comment": "Malware payload", "value": "98682f36364fb61a217c60bd4c65359908388da70a1ec886de7ec0fde5a79433b8441b7f22d06d057ef649eedf249822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952427, "uuid": "998e5ddf-e5c9-4004-9b74-e1c5b08191d4", "value": "T1BF76333334D8CFB6ED8346318FA92A94696AA4230F51541B73EDDD3C0B784479A79B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952427, "uuid": "07821c78-fbec-436d-a187-ce361b8acd59", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952427, "uuid": "4b8f1fec-360a-4d33-ad6a-5ef27fe1f0ca", "value": "196608:91OHqSWvMeSfcR17IEYOxZW9u+0HEVrTMa:3OHwMekc3o9wHsrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952427, "uuid": "038ce377-4d38-46c6-bb38-4b3f57667ba1", "value": 7581648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952427, "uuid": "0345a81b-d872-4a7e-ab9a-2b03a4111d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952427, "uuid": "8c50c7a4-c4a3-41e9-b4c3-7f888fc4a13e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9e2118-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666963799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963799, "uuid": "97190b58-2938-4873-9efe-b258d0899d40", "comment": "Malware payload (ArkeiStealer)", "value": "a480984f6dea05271c7af26bdecbdb73", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963799, "uuid": "83b032cf-b3cc-4a52-afa7-638558d83cdb", "comment": "Malware payload (ArkeiStealer)", "value": "71e90c9c40a3a18c3220d7cc3cd62735ef19a47e4f06563e3dc593745ffdb707", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963799, "uuid": "25c9b9b7-0e69-43b2-9a03-b15959f6160b", "comment": "Malware payload (ArkeiStealer)", "value": "ad0471ebc24fbe40acc8339384ed137e9acd7d49", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963799, "uuid": "72666fee-0318-4d15-994a-8a1d967bb7d0", "comment": "Malware payload (ArkeiStealer)", "value": "bc85b02123c00f52f570d20041f51da85231470f5d6194e7d94ca4bc2036bea8be14f3883a792a88d721d0f7b360d10c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963799, "uuid": "0fa73928-1fa8-4d32-83e9-9c74aba2825a", "value": "T13F74F131B692C471C3951130442ACFB15E7FBC302A658A8777A4276E9F723D159AA32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963799, "uuid": "41a287b1-f447-46f1-8583-0ac34f6c4670", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963799, "uuid": "6c52d3ec-d9fc-4d63-b83d-ee7dd6788963", "value": "6144:hZuHxL6T9Lj1DN858YrE/r4wCRsxFSf4WI6aT:hZuHx2pLxB855rEMhwFwIdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963799, "uuid": "b2e5ac3a-ebb8-4ac2-a232-9f0754f50d61", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963799, "uuid": "99aa79ac-8017-4e8d-b28d-68ce643beb01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963799, "uuid": "42898898-9789-4526-8559-876a398019d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85152af5-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666949153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949153, "uuid": "c317a9ae-b6b1-4db9-9b7b-6967c4da3e03", "comment": "Malware payload (Smoke Loader)", "value": "82325762a180422476ba6f3accfa2d80", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949153, "uuid": "13bf8e48-b025-4b6d-a5ea-25c46a04a442", "comment": "Malware payload (Smoke Loader)", "value": "720f2883b2571b10e2f0c6075053c52709bc49174c5602fe06aaeeef9e8eff41", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949153, "uuid": "b5410aea-a712-4519-b5c1-9004ca72f09c", "comment": "Malware payload (Smoke Loader)", "value": "2bb143f1221dda57180ee2afb845f01a572fe7f8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949153, "uuid": "1b07b8a4-2bd3-4605-8f14-6c78d1c381ce", "comment": "Malware payload (Smoke Loader)", "value": "8758a6cfe6787c464c349a86963d5d88b10a3fece537af19a252bf05ddc8b119ad2bcc8860a667ef801e6c4896100f40", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949153, "uuid": "d43f3afe-2495-4e19-86eb-b1a9baf9d74d", "value": "T1C744BE327592C4B1C0851230482ACFA42B7EFC30796545B377A73B6EFAF1291A67225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949153, "uuid": "2fb1dbde-a1f1-4706-8b10-7e6e9a225bb3", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949153, "uuid": "6b574d18-f830-489c-8747-0f6f9b51395b", "value": "3072:ym3XOBxHS7LYlcAEKuoGBfmlk5Kt0RkCtPadszAVwoBv/IOxvgooM/h3gU7:/n0HgLYlJubBupt0btDroBvYooj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949153, "uuid": "04f4db8f-26e0-4b6e-9e32-35b015c3d922", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949153, "uuid": "42541d0b-5803-4964-a1ac-57a8555b8b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949153, "uuid": "271351a3-4337-452b-85b1-d39f66344dc1", "value": "82325762a180422476ba6f3accfa2d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbffbf0-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (WSHRAT)", "timestamp": 1666949329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949329, "uuid": "1e506b95-9f2f-4931-af10-72f35e13f439", "comment": "Malware payload (WSHRAT)", "value": "bc2c4ce0e4cd1ae0b5b0af84b03d0a66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949329, "uuid": "ffe9efc4-9fb3-4a82-9e00-2d5360c6c0ed", "comment": "Malware payload (WSHRAT)", "value": "726d793d69e118eedfdb88458f8dbd241dfb931ce3819058ee53527b8ee32b15", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949329, "uuid": "20585abd-5cfa-465c-972e-44f6b3743653", "comment": "Malware payload (WSHRAT)", "value": "8d5fc4d413918b3750d1ed16c0ccc4d105a3c891", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949329, "uuid": "b46a58ce-9f30-4df0-920d-dab642a58828", "comment": "Malware payload (WSHRAT)", "value": "ddfe1f500236db5d48133ec2a6eb8dccd180d49175b5f41560e449318d2ebaef56910dcbc3c2fa6f8ac4197bc8aa14f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949329, "uuid": "2c7386e7-cab8-4400-aa40-763b78ca2f13", "value": "T1BD14CF45BF80E91E53C327BB361BE69AE1951C5F748188868384FC85AE15B72EFF1432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949329, "uuid": "ae4d0cba-2db4-40ae-85e4-4ad045d5b65b", "value": "3072:6E8ez9oru2wvhQ0bamBbIpklgVDSxGfmuZSZ7tvEzpVeGK/65TbURCF:61c9yMrAklgF2GuuZWpKeGKfRCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949329, "uuid": "f97e9cc4-79db-4a50-b4b9-286cd1cd291c", "value": 193659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949329, "uuid": "f82f5f43-642d-468b-8fd0-386f94bd14d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949329, "uuid": "5db9a2cc-c827-440a-aa93-9f4aeea1878b", "value": "wynlog (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec7305f-56ae-11ed-9266-42010a9c0072", "comment": "Malware payload (Joker)", "timestamp": 1666954484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954484, "uuid": "4f3fc1ac-2d18-452b-b240-20f3ca12e766", "comment": "Malware payload (Joker)", "value": "d404f3c7f4d7560bce2445b4331bf5a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "joker harly", "colour": "#F1594F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954484, "uuid": "c2e2b697-1db0-4778-94cd-db90ff394a9e", "comment": "Malware payload (Joker)", "value": "7276c4dce081017423e0f1a1ff8843616f45544c8037cd634de32ace0614c2a2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "joker harly", "colour": "#F1594F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954484, "uuid": "36737497-376a-4ca8-a359-45f24e7c3d93", "comment": "Malware payload (Joker)", "value": "e73df68c4031cc8d4ef884bebe4d6366d42352dd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "joker harly", "colour": "#F1594F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954484, "uuid": "57d5d539-5556-4200-8e61-fe010da86cb9", "comment": "Malware payload (Joker)", "value": "fd89c5e53727cc7c6694dd7a75445558c0f46d148c126823fc03502dd41802a1bcb77c3e6ad7e7b066e3187db17ece26", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "joker harly", "colour": "#F1594F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954484, "uuid": "f39da371-bd36-4e3b-8844-0f3350dc5b33", "value": "T1AA272257F359E96FC8F36332487A526656074C258B53D7C36A08B63C28B7AE04F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954484, "uuid": "5db1246b-4239-4797-9da2-03f4109b13c7", "value": "393216:/GyPSMyW3ADMQ+oF1HjSvdfK5p+1M6ZSU4hBdZZrXVzOGXPeX/6TB4:/GyPSvW3ADMloFJSxK5z6ZSXhBdZ5XVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666954484, "uuid": "e7eafcfb-dbc3-429a-bf20-4b1ad440457c", "value": 20696635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666954484, "uuid": "5a569ca1-e23c-4ea2-863a-0455c0197934", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954484, "uuid": "7eb166c9-4e55-4583-8dfd-fd821fc728c5", "value": "Hello Launcher-Live Wallpaper_2.57.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d7b915-56c2-11ed-9266-42010a9c0072", "comment": "Malware payload (N-W0rm)", "timestamp": 1666962932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962932, "uuid": "f689ebeb-dbbb-4677-8c33-e1b40c1990d5", "comment": "Malware payload (N-W0rm)", "value": "9f4c196e9c22b6635fdda64fc1f461d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962932, "uuid": "7367e860-3ad4-459a-84f9-a830d9ddb2a6", "comment": "Malware payload (N-W0rm)", "value": "72a953c2e228fc9954cf577578c41371dde13555359d9507060c205e4e2acc38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962932, "uuid": "e24b3bd4-2170-4559-a3aa-b55399376a5b", "comment": "Malware payload (N-W0rm)", "value": "891710f8fbcf7c35a67ba3dfd4a7d5c09670390e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962932, "uuid": "c982aa86-def0-4d99-a047-b8e52efa1064", "comment": "Malware payload (N-W0rm)", "value": "e29beff6e8f8027c45f1ebca1d69606032ba26114b8c9d9ad237c54933447826ae4a26bd39480c9e21fd5caffc5b70d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962932, "uuid": "de22ee8f-f0d0-43af-9f9a-40511b563258", "value": "T18E44CFF27692C4BDC0861570442ADFA01A7EB83116614B8773A4275EBE703D1A6EF36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962932, "uuid": "f33c046e-1bae-4898-a62b-34f12d252987", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962932, "uuid": "3c89f7b5-eca3-488a-a6b7-0cfc82970a56", "value": "3072:FXO7Hg8LZJAPtf7G0mj5rMo/39zHyk54UkhBUenFmPLZLoEtM/h3m:B0HhLZIfy0K5gkSUkg/xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962932, "uuid": "f5233f6a-bc0e-46e7-9d1d-790c50aff0bc", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962932, "uuid": "8475c0cd-1ab3-4126-81fb-6d287141d8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962932, "uuid": "a69cafcc-0c8d-49e7-9087-34c015c7a9ae", "value": "9f4c196e9c22b6635fdda64fc1f461d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec10817a-568c-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666939877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939877, "uuid": "25096974-a0a0-4d3a-abd2-65251bae587d", "comment": "Malware payload (GCleaner)", "value": "0b08a46e90da5ee6bc2d718df8c4d85a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939877, "uuid": "8e630b4f-b2f2-47ca-998c-edb26e127fbf", "comment": "Malware payload (GCleaner)", "value": "72b5089b21ef3661ddb5abedf871049e64f576f46fc32314730b7b366f627c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939877, "uuid": "f2a88b89-84b6-4929-a778-df8c542fe545", "comment": "Malware payload (GCleaner)", "value": "dc59e51b065c1736280a65933a993dfa92f83f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939877, "uuid": "3754aa1e-e88f-4e7a-be1c-8e74e77fbf75", "comment": "Malware payload (GCleaner)", "value": "fe5739953e26ad0744fc60a44b6988e8c72d7445e8e282079656654874707cbbc5f616c060b86e01eb9215417c1f5958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939877, "uuid": "1ae11fd1-f25b-4735-aaf0-fac1fbafc577", "value": "T1F6C5338214A2C231C0B4E9BCDEBD4D59F1366CA95237323AEADDDAEE4D33141F158399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939877, "uuid": "65595caa-1a41-4f9b-b4f0-aa5d1d72e0f3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939877, "uuid": "b96ecebf-7abf-4146-b3de-f2ad897ded00", "value": "49152:Z2okRbt/xhip+IDEjrizlpzYKZJzAqjNCpsjuew/ytXT9MVjFA5hq:MokfphigGe4BYozRNOqtD5Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939877, "uuid": "ba08f906-5880-48fb-876f-9e8c5dc38bbd", "value": 2543094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939877, "uuid": "0dd7d22f-42ec-4cf3-93f3-14e57916cba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939877, "uuid": "cc97bdf4-f589-4cec-8b63-90d3b9c4a85a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c60cb0-570b-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994350, "uuid": "43e5fe1a-4f43-4170-8150-2c1e4480adde", "comment": "Malware payload (Meterpreter)", "value": "4f3eb4cd6ae13a74d09f29aed9cd73f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994350, "uuid": "4b057dcb-b474-4d8d-a440-860f8a0f1afc", "comment": "Malware payload (Meterpreter)", "value": "74d4f10d14ea8b1fde313463e21678059dfc3f6626223a42620253ded5b9c74e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994350, "uuid": "8353b5fc-b74e-46a1-8056-619c22c80532", "comment": "Malware payload (Meterpreter)", "value": "265493045c26fcf1244f6e1068431691467afd86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994350, "uuid": "261213a3-f40b-4c91-89aa-fbd0a2a6bbdd", "comment": "Malware payload (Meterpreter)", "value": "7f8bef358ad299f33885d31c1c84a80ce8382689e48210d34e6da29768288d7b5c4470035dcb6cef8a8cb45e2bc7790e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994350, "uuid": "3515b975-dc0b-41f2-856e-4f51e1d2ab4d", "value": "T14073CF42EAC45525D156227D2B723AB6AD75F1F23641C2DA798CCDE4EFC1CB0A2323C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994350, "uuid": "37d5956c-40a9-42dc-b46e-c11c8203054c", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994350, "uuid": "563c8969-8605-4d31-be45-3b3aec0861f8", "value": "1536:IKFAWOSYC/u/054dYJqQAWDBckMb+KR0Nc8QsJq39:3NYC/vW2J5AuBcke0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994350, "uuid": "6cac9175-7244-4d3c-9980-f2cddcc99c9c", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994350, "uuid": "aae460c9-6c24-473f-88c5-98d7582af042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994350, "uuid": "2fe553ef-4ccf-419e-874d-f45e92d6feb0", "value": "sanki.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e59d0e-56fb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666987427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987427, "uuid": "7bc9bc8a-1e34-4e36-9363-993167cc6f9c", "comment": "Malware payload", "value": "5e17fa76e2a9e7e59e59df677c6c52d5", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987427, "uuid": "35ec9de1-85ff-4201-88c6-1d9260531a21", "comment": "Malware payload", "value": "74e84d9f5bff36ea239cda0f73c03b7e688e6b892e0368c843c74acf045f8498", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987427, "uuid": "42fc929b-2078-457b-88cf-ed01a2d9dfff", "comment": "Malware payload", "value": "a3d21431089661e81f6fbd3350a9081d929b30b1", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666987427, "uuid": "f7053942-634e-435b-bf3c-11c8c98d6f02", "comment": "Malware payload", "value": "11cee13b648a0093f1e2de36c339503468c7addc721a969809d0591c0da66f005f68dc7e8b2d5799ffc3e26566e82581", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987427, "uuid": "beb5fcb8-9303-476d-844e-f111e7224d85", "value": "T12EA2E1B8737B0E13F6423C4EE671B61752B24D388CEE6DAE18B867240504AEBED24095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987427, "uuid": "7935ee15-76a9-461e-ba52-26552b0b7be0", "value": "384:PwKee5BUXZ1cYw8It+xJ/d6CTCbTqY2VGh+fRIpQ97XddgQWgAHLgko9:Pbea4+YfBmn4AQhdgRLgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666987427, "uuid": "a32403be-366f-4ea7-a9da-b62f7f906d7d", "value": 22304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666987427, "uuid": "83e9d7de-9569-4787-acfc-ae68b01ed36e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666987427, "uuid": "deb3d52d-4198-4223-a53d-1c59139d26de", "value": "Which sentence has proper subject-verb agreement (1733).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54f5d57-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943704, "uuid": "f858997b-5f5b-487b-a5bf-ac368b2a18c5", "comment": "Malware payload (RedLineStealer)", "value": "ee0966fcb93dff85fbff2d99566883b2", "object_relation": "md5", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943704, "uuid": "3ae60d91-2a8d-499b-b539-74e38b6efcf3", "comment": "Malware payload (RedLineStealer)", "value": "750bf1eef3df6324e85274720952b7185e162ec71a17ae7277a2b683c7b731bf", "object_relation": "sha256", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943704, "uuid": "6a985ac0-4a93-493d-a5d9-a7d452f039ea", "comment": "Malware payload (RedLineStealer)", "value": "34083b8ef2934af92490463464aff1ab84b81abb", "object_relation": "sha1", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943704, "uuid": "7bfab47c-ec60-44d4-9c97-e394259330df", "comment": "Malware payload (RedLineStealer)", "value": "43e3e926cc0b54946e64034a011fbf6cd4c3c4958d56e84c5f98e6f1b9cac34916fc59e08c8322170b326d0b554aa17d", "object_relation": "sha3-384", "Tag": [ { "name": "cracked-guru", "colour": "#05AFEE", "exportable": true, "hide_tag": false }, { "name": "pw cracked", "colour": "#D8D983", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943704, "uuid": "3a050b04-e8ab-45c0-833d-c9d212a93e31", "value": "T11B9533CC35D52EF75B42CE50E847990153E9DFC343198A3DD96AA900F3E2A5D82B9BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943704, "uuid": "d91c7bdd-f270-4193-a782-61721bd2d019", "value": "49152:iZSHGySTJm38ocpCecqyr6rYFn+hBIkXK1R:qSHZmdPkeZyr6kojAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943704, "uuid": "1e8c5082-a6c7-4ad2-9494-0b829b2c7938", "value": 1901629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943704, "uuid": "a958f215-1b3e-452b-b5ad-dff13b6f361a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943704, "uuid": "17f1349b-1999-4e28-a634-8d6876302165", "value": "Setup pw cracked.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5141be0f-5709-11ed-9266-42010a9c0072", "comment": "Malware payload (Heodo)", "timestamp": 1666993304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993304, "uuid": "6650d299-875e-41f5-a2a9-a3d97cf71ee8", "comment": "Malware payload (Heodo)", "value": "90737f229f2314452f077ad677ca7e67", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993304, "uuid": "5f5f9c31-7094-4a94-9964-94e881e844bc", "comment": "Malware payload (Heodo)", "value": "7615a9e1126339985b418e5db900ad4844e598a8d6ce482d37a48ff9a93e22a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993304, "uuid": "458bc4f9-0f73-4a27-9f2d-458001805500", "comment": "Malware payload (Heodo)", "value": "aa13857dcf0d753aa016f4d4dc406388e36e6b73", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993304, "uuid": "ee7781ad-327d-4574-936c-d39f175d7219", "comment": "Malware payload (Heodo)", "value": "42b113f597fe0377dc3a2d42b8e8be2066cd1b4b7a81e8d7e0fe3f65bed4fa5aa6d7625fc90565fc36d55edd930ac234", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993304, "uuid": "41356a02-c127-467b-9d6b-7a424fe9874f", "value": "T1C6F47C5A72D3016DE06B81F58BD27965F673BB34072CA68B02AD57617E2339C573E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993304, "uuid": "eae8a1c9-ccf4-4ecb-b399-5f03ff66b3e3", "value": "6cc0be0d01417a15b61c3b6a580e87ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993304, "uuid": "8bf1dad4-d89a-4fd6-828e-08cbd521f957", "value": "12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSOjNwgraKRT61cKGNx:S4DzZKnH4bRGY61WN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666993304, "uuid": "c0fbbe6e-5631-41a4-a969-af300faa7a96", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666993304, "uuid": "54f4b0a4-52db-4259-b897-cd0dac2fa882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993304, "uuid": "3fbe6b59-7a66-48d4-aeff-9b99c6b2cfa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fc4945-5706-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666992161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992161, "uuid": "29b17b77-ab6c-4add-a355-ae8ff515a3a0", "comment": "Malware payload (Tofsee)", "value": "32a0c50370e88cd274964acd32d2b201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992161, "uuid": "38d50cc8-df61-4808-8274-8d807980c7c8", "comment": "Malware payload (Tofsee)", "value": "770ad0a1aed7298166f4f22150a64fe1af49703506002bb16bb5eb8fb5b9d980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992161, "uuid": "2cf59a33-28ed-428b-b613-bc543a941784", "comment": "Malware payload (Tofsee)", "value": "9fe6f92ba1cb6289eb280b7e21e7c0f985b6666a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666992161, "uuid": "510bdfc0-f2ba-4525-97d3-82ffede6fb59", "comment": "Malware payload (Tofsee)", "value": "114864f52b2f8a50db90e6451caa477134b79e80a28db08dcc4d917311f694d7feb0bb306dd655dbcb6e6e208190aef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992161, "uuid": "8928b1e0-cde4-4226-8213-1b8a6f09f0fa", "value": "T1E544CF707D90D43EC09215308926DFA059BEFC725E68854376A03B9ABE323C16666FDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992161, "uuid": "f6cdd1e1-1052-4b87-b719-f1637264eeb1", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992161, "uuid": "d763296f-3edd-4ab9-9b1d-f351decf94b0", "value": "3072:3jMvBpGl8HLnr7BWz5KBqz7umHSZFLNTevQUwIse9U6BPLR7BxM/h3:4vBE+HLr7lqf7WRevaGLPLRNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666992161, "uuid": "015b5fab-69ad-41f0-90b6-7842951d24aa", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666992161, "uuid": "5bdbee82-740d-430d-9859-9d3318ce596c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666992161, "uuid": "25abc861-3291-48c0-bf5f-0f551e8376fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b629930b-56a9-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666952242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952242, "uuid": "8328015e-0b4e-415c-9fb2-4a09be49d50b", "comment": "Malware payload (CoinMiner)", "value": "c1b5a50d3f310cd991fc060f46423b4a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952242, "uuid": "e6ba5693-fd5f-49ab-9c72-71b794195963", "comment": "Malware payload (CoinMiner)", "value": "78868f1ea724a3833ae0007f7ff986e1579a9ff51497d6b40fed5786f2726baf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952242, "uuid": "de6fc8fb-a92d-44ca-abe0-5499899c0dea", "comment": "Malware payload (CoinMiner)", "value": "3e89fa10b08c8955e4bc844fc85f5d6bcdfbe181", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952242, "uuid": "83796b2f-cfd5-4ecf-83e3-6adb29fd09b7", "comment": "Malware payload (CoinMiner)", "value": "9bbf81f96bca34e9fe3c74a49e8e4fdcd76a5d061201b85e824dd3a3e5cc825cd6a85a1bc2051addef631a6924ece58a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952242, "uuid": "b00bfbe7-8d8e-4d91-95a9-2b9c0a9d10f4", "value": "T13044D0317682D0B2C4B52130472ADFA02ABEF8315970898737E4276E9E753D19E7A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952242, "uuid": "eaca629d-a7fb-466a-93b4-d8b2465d7918", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952242, "uuid": "dfa228f8-3bd1-43d5-b07c-b08acfeb07ed", "value": "6144:hi/HHLhkkWxmCrNVeu2Cfn4klkqLaYx2bC9othSp:hi/HHtklxrpVeu3f4klMe5athSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952242, "uuid": "6783fa31-9fc1-4cdc-a999-54368bf65d5c", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952242, "uuid": "8eedbf09-0e07-4524-abe2-f943487dc9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952242, "uuid": "e0386f91-ce6d-4a34-b704-15d8712c0de8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf77ecf0-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666938943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938943, "uuid": "58b6adda-59e0-4aca-ac61-80db4d0fc614", "comment": "Malware payload (ArkeiStealer)", "value": "389225207ba356127263222954a68a16", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938943, "uuid": "c0c32d86-0050-406a-92a4-28e02bc4d976", "comment": "Malware payload (ArkeiStealer)", "value": "799f2747bfd32e55f313521cecf93182c6067f16edab15ab3f789601c33d50c9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938943, "uuid": "a600cf3b-7955-496c-886a-8023a05e0ec0", "comment": "Malware payload (ArkeiStealer)", "value": "a85970a73f5cb71c7481fbee46790edcc911b5f0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938943, "uuid": "d8c172ed-d2f7-4c89-8796-823591bd045e", "comment": "Malware payload (ArkeiStealer)", "value": "e93e48ed9c3cf2e89073cba9e7892ed2430b3207a066fe56beed98f874cce9f505d12e2971b34ae37250745badb2099c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938943, "uuid": "1e9b8a39-943f-4976-b76c-fb820e3acad0", "value": "T13C74F1167482F4B2C47600745B39CBB1AE7BBC32266049977B583B6F6F302D1AE72257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938943, "uuid": "2d4abfb9-054f-4951-9182-5d8d93e384c4", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938943, "uuid": "6b256f67-df0f-4f7c-97d6-428f6a01d5eb", "value": "6144:w5qeYoZ/ayrv56SISEDj80xxS5iXxlAquO0:w5qeJayz56SISEDjr+iXxlAqu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938943, "uuid": "bc2e0652-a573-4107-beec-98e238017059", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938943, "uuid": "19fc66fc-24c6-4005-b9bb-6e8748e21b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938943, "uuid": "ac1a7e33-5e80-4910-b15e-88be9522449a", "value": "799f2747bfd32e55f313521cecf93182c6067f16edab1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c96a9c6-568e-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666940603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940603, "uuid": "a1fb135c-7389-41e5-9f6d-2ac83893a293", "comment": "Malware payload (GootLoader)", "value": "d38839494e6e455752f86f06559c1347", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940603, "uuid": "db614ba8-8c8c-48d2-82ce-e9c168d6fc6a", "comment": "Malware payload (GootLoader)", "value": "79effa9b5c777d3d683e4d09fc48f4e2afaed8c97eba9e4a3ffef6ca74fa37a6", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940603, "uuid": "a90587d9-9e11-4315-b9d5-001a23537b8e", "comment": "Malware payload (GootLoader)", "value": "6a969803ac2a7d7b03bd763c96e567b53deab9a0", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940603, "uuid": "0b974f28-9705-4a8f-ad23-a71711d092c7", "comment": "Malware payload (GootLoader)", "value": "9425ae3a161fbee0ec16c4f898cde2215b6d863ed9db01bff062c2a43a63e838821edc850a374cf346be77cb765dc6bd", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940603, "uuid": "b633808d-318c-4cde-be80-69b2bde88146", "value": "T1C0A2F1C295758985E1E01CDF429843FAB82D9C4A62F4A6B970C12946D6FDE23F30B493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940603, "uuid": "8bdaf10f-0a6f-498a-b06a-79c4299efd6c", "value": "384:WIYAWi6vtYC7XNiV9QuUU3gVXJsWlFk6owp91H8K/qADurSFL4i3+wVTKQpv2o4X:+A/0tYC70V9QuHI+2ktEHt/DDu4L4ilC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666940603, "uuid": "71613347-1a9a-4ac4-b948-9c2eaca9f609", "value": 22400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666940603, "uuid": "2031dbc4-7987-41c3-bfb5-5cb1db5da6f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940603, "uuid": "e15ddbb2-74a0-4ca8-a967-8c947b07a4cc", "value": "Which sentence has proper subject-verb agreement (85848).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5765951-5692-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666942335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942335, "uuid": "0f5d0355-22fe-445b-95ea-221532249e66", "comment": "Malware payload (AgentTesla)", "value": "fcdcaab12d8dc6feb6b0dcddb01ab3ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942335, "uuid": "2ae80d90-6324-4996-b864-0f3f5f4ae175", "comment": "Malware payload (AgentTesla)", "value": "7a0d3a318c0efa535b778d889a40f5e36f10cc895ebb302538a40ed152345e4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942335, "uuid": "68401206-340d-4c06-ad16-0305ae6a3fe0", "comment": "Malware payload (AgentTesla)", "value": "04de9f0d6cfa62f3623fcb698d441be2656d2e44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942335, "uuid": "ac3a05cb-9051-4455-b394-7c9d19b82162", "comment": "Malware payload (AgentTesla)", "value": "1c1977941ca90ef2191e2a125265aadf974c658583d55bf60a187c0a2a6e7a29fbd96d40b679d14ff1707040d15751e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942335, "uuid": "3b784d5a-2d32-4b39-be97-698f04ae1865", "value": "T1D4F423755FE262ACECB2077E6A0E91DFF44116CBAE972E2C305BF31DE6A19D08156043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942335, "uuid": "34cc83a1-10fa-4d9e-ac25-5b545e75e521", "value": "12288:eNc5KP3TM7G+Dzg/7PLwETheMbYSiQHjeZayywB/YXuVRJZO4C8/gkNe0b:mc5KL2g/7PLwE8vKxHs/YDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942335, "uuid": "7ed6c308-eefe-45b3-86b6-027ec773d349", "value": 740128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942335, "uuid": "10e49859-02bf-4294-8043-cd9aadc76b0b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942335, "uuid": "7736e1cc-774a-49da-a87e-fd7a511a931d", "value": "SOA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d21c99-56ba-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666959466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959466, "uuid": "e6b4f07c-108d-4799-a9a2-72dd881b5066", "comment": "Malware payload (AgentTesla)", "value": "2cb4003eaa0ff598085698702986d294", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959466, "uuid": "31eba77d-b125-4dff-ab80-a09768e520af", "comment": "Malware payload (AgentTesla)", "value": "7af8a4616c0f5833b883fe664d6458ccf163f9e1a19c5e9fd28dab32238a05b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959466, "uuid": "9cddd283-f6f4-4897-8eea-27a699351cd2", "comment": "Malware payload (AgentTesla)", "value": "607ec006a9c958346418c8ccb6a04fd2aa5c280c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959466, "uuid": "14087ed6-2c21-4a99-86ee-e22c9091ad01", "comment": "Malware payload (AgentTesla)", "value": "0c4605b680f7ed1b3cf2483bc83d60ff7e53a6338aac0c5e029da2abd596712e680a1b21b5f324aa9ec75a28b03a7406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959466, "uuid": "e9505975-28f8-4e61-a96d-aecf3d812c44", "value": "T1971501EEB2EB8F13D3EC1B30C4D2A30463A9C6559263E31B554811E94C937A3FD869D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959466, "uuid": "5f8d5e89-f53d-4ade-9e25-d45c886306bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959466, "uuid": "99b73984-de0f-4a00-9b0b-29950229dc03", "value": "24576:XvnSXyRNxswQLWb94iDcSfYPorX3g39h74Qh:P2GNxnQWxcSQPob3GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959466, "uuid": "380a0851-a127-41d9-97fa-25ce492136f6", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959466, "uuid": "45db43ab-8873-4d67-865b-e2cb6ac4aa6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959466, "uuid": "ed200814-0af3-4ea3-a93e-24b08836fe74", "value": "FdkVnoV00im50pc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d10d98-570b-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994443, "uuid": "bd066d47-1b94-46ac-8ef6-b609bde00a06", "comment": "Malware payload (Meterpreter)", "value": "c12886ed570cc61fd178e690907cfb44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994443, "uuid": "7e86cf77-86c7-4800-8665-df72b4d5f497", "comment": "Malware payload (Meterpreter)", "value": "7d0e3751c18bb33f4c02e111bbb9ff5e6633cd10656d4408e4f083f6ed430095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994443, "uuid": "299dc4b3-f38e-4e02-85fa-65d7176330f8", "comment": "Malware payload (Meterpreter)", "value": "9a605aca919ec7164d50eb92b6adf43ca43090f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994443, "uuid": "2b228691-ed6c-4b13-adf1-2bee296fc74d", "comment": "Malware payload (Meterpreter)", "value": "86744084785dbebefe920d623dc817de1f874ba71dbe0b74ddd16a3a50605d29d754786da6ea112ba81bf393a8e404ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994443, "uuid": "015c9322-ae52-40cc-8a2d-8e78cccd5c00", "value": "T1EA73AF82D5C0583AD1A2217D1BB53BB65970F5F62116C1DB7A8CCDF5DBC28B0A3263C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994443, "uuid": "44cd01b4-277d-4da1-8fb6-0f43dde70dc9", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994443, "uuid": "88676698-45c9-4f24-8e2f-e4fbb95bf451", "value": "1536:ImjO+tVlSze1rMDSuHcimgxJMa81Y6Mb+KR0Nc8QsJq39:FO+UzQMzcilJD8Le0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994443, "uuid": "8f60201c-9f96-4fbb-a5c3-0d9c8efb1ce5", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994443, "uuid": "1dd20786-a729-4209-8d7e-f89fc228ddaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994443, "uuid": "23b8e282-f712-4c58-ad4b-d857f07bd4eb", "value": "baba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8e4ad6-5654-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666915826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915826, "uuid": "2ccb4a7f-00bb-4ab5-a1bc-3cd33ddafab4", "comment": "Malware payload (GootLoader)", "value": "bdf8a9a168c52fcc9f9b99728d94d341", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915826, "uuid": "fb5c36c5-8aa1-499d-b098-dea77401e7b4", "comment": "Malware payload (GootLoader)", "value": "7eb7a124c407c76a10151cf1103ad7b711fbd9e921109a99db2bf3d1d1125b14", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915826, "uuid": "8b41412d-7f51-4880-b438-9c9ec031c86f", "comment": "Malware payload (GootLoader)", "value": "1fd8dafcfe421e846072e41b99b25bff873fb82f", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666915826, "uuid": "f3c3aaa5-6bfe-44b2-a1b6-779fc5013134", "comment": "Malware payload (GootLoader)", "value": "fda83cb62793faff4e272d440011f1323fc7c54a1c8d5d168d482e51ef3fa169385ad2e1a499d3b5c7d8db0cb7b239b3", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915826, "uuid": "2b72ece5-d463-40d4-b61e-70d2cb682dc4", "value": "T1A1A2D0190A0137841BFA05A08B66E3C85AF4FACA1416E15A06ADF37664FDF40A1E4C3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915826, "uuid": "05ca7fcf-de59-4086-8395-c2850c10dd6a", "value": "384:wHSA3X6xpnwINAjFB2HhKSzfT+Qb5hKi9Jk9ey7ggagHB5sMvs1O:wHH6xpnhM2Hhhzb3rUeyUgHyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666915826, "uuid": "8354d50b-8697-4e04-aba3-463c287b580c", "value": 22327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666915826, "uuid": "b29c5444-a5d8-424e-9091-782741d64dac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666915826, "uuid": "126d02cf-4bd0-4933-9c6d-6ad114e10530", "value": "Which sentence has proper subject-verb agreement (29937).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612607b6-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949093, "uuid": "6fa2e6ab-11d1-441b-a627-a5001f6c3622", "comment": "Malware payload (SnakeKeylogger)", "value": "81c890481ad3a6a2fa356ab7149a4b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949093, "uuid": "bc515a9b-2159-468b-a652-786c1e1f10c3", "comment": "Malware payload (SnakeKeylogger)", "value": "7f827d0f713c56d3ea862dd32fe8a25ad442218818d24cf68f30d29e2d2833ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949093, "uuid": "fca6c55e-537e-47c7-b197-49df55d26d02", "comment": "Malware payload (SnakeKeylogger)", "value": "b693d30e5b31033c3da22df9511fee7fa50da5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949093, "uuid": "79d50de8-3305-46c8-b634-b5e72917f016", "comment": "Malware payload (SnakeKeylogger)", "value": "0352798c72c7d82815358e6b33ed20d55e864c70d9b720e055dfd55db708dca5d541cabcc5dd7427a0e27204d65c9726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949093, "uuid": "3bebda6d-3785-4d3c-b50d-6dca936fa0f3", "value": "T1F7054CD1F15088DFEC6B49F2AD2AA93024937E9D94A4410C569E7B1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949093, "uuid": "cde439c4-342e-44d4-988a-bc20eb55ed22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949093, "uuid": "ea05d5b5-1794-4736-8eaf-6e7e872ca860", "value": "12288:W2Xh7rXvnS2OFlkfLmMqqNJbVAMTiEyLGr89O:WS5O/kfSLCLHmEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949093, "uuid": "1d0d4d27-c637-4680-a455-112d56940afa", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949093, "uuid": "47c2f5e7-5da0-4c8c-8d8c-9fd67ef6ed19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949093, "uuid": "65bc67c0-95dc-4d09-a177-c21831f5d86b", "value": "PO_4260031166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17c9a0a-56cb-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666966837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966837, "uuid": "b78c9186-e279-4c6b-b9f2-86624ef5666c", "comment": "Malware payload (Amadey)", "value": "d3c4224a575201e32dd4a93fd847a315", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966837, "uuid": "c95085a1-0906-427c-b2ed-2a089043cae4", "comment": "Malware payload (Amadey)", "value": "7f8b8d9e3b80d6d422926703cc009e5fc4dedde461be55f895d9cfceee1d1db4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966837, "uuid": "0fbf1fe4-df2e-45f4-b964-0c134aa03771", "comment": "Malware payload (Amadey)", "value": "c60dbe76534898c09b20b36d3c8adbeb698c0c58", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966837, "uuid": "1babf007-b27a-4a32-a062-19ef87c4bb4e", "comment": "Malware payload (Amadey)", "value": "58e2b8f58a6cd8e8fec9a09cd1c9b372d63268b09d259bda611cb3b51afb4603e5af8b6e2662d227adc9c65bb53c85a2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966837, "uuid": "18ed4b51-7c66-43ca-b8ec-91019c6633d3", "value": "T17344CF317682C4B1C4722130075AFFE11ABFB8311A64CA8737A4279DAFB539196663DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966837, "uuid": "f737ffa1-d7ea-42f6-8145-94e91ed63327", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966837, "uuid": "b5539405-0cd7-4039-bc60-0a23459be659", "value": "3072:1XOjHCbLJ1AkOwfGZmj592m3CtD4rImbceGuDis+JoqLSidkz0o7/EM/h3m:xoHsLJywuZo34DOImdngeqG4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966837, "uuid": "0ace7e4b-7234-4d04-939c-0c0e247df951", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966837, "uuid": "032ecf12-8256-4c5e-8527-4d202fac6d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966837, "uuid": "035b2adb-a4ff-41b2-a709-b5550a09c483", "value": "7f8b8d9e3b80d6d422926703cc009e5fc4dedde461be5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad380d8c-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666949650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949650, "uuid": "bdb0293e-cf37-46ab-90e8-2ea26cef2c88", "comment": "Malware payload", "value": "8c1d9f3104950ec106930e009d9e04a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949650, "uuid": "a0579cb4-9ac3-4ec9-9f18-96caeb45d282", "comment": "Malware payload", "value": "7fb0ba02228819f3f3774286d387cd02fae09fca7e6a0e456f92d1704f67e2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949650, "uuid": "7e0c6822-4f45-4d2b-8eda-aa3a57a457aa", "comment": "Malware payload", "value": "dbea0827d43a7d1a7e1898b899634a700b7bf8cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949650, "uuid": "ab437a41-60c6-4f28-9b50-d9d6b268826a", "comment": "Malware payload", "value": "cf75b9d61b4424f8600b50ba81cc3e24091567d139136cacf6d1429aae380060ed3fe78cde28b8e6f271561facfd65cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949650, "uuid": "1482592d-c588-4ea2-9254-85ad5a953991", "value": "T192458CF4A0BB04C6D8076EC5697C7DD6077172B3CED80224237E7A484FBB9B9960895B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949650, "uuid": "ba1e3cb0-7e70-4d08-888c-fa8ada4d4303", "value": "12288:BnjoxXIB0nWZQzjFeM6DJOjB9sTTHyDErTTFyxhRz3Zws3OOo:AIqnYQb6VO3Er2ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949650, "uuid": "355291e1-9932-4654-9147-bf897eab4824", "value": 1173108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949650, "uuid": "ef18e5fe-5cf7-46db-b2ae-283c5385838f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949650, "uuid": "cb548a38-9384-41d6-9ed3-9ee4b1ca39da", "value": "8c1d9f3104950ec106930e009d9e04a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defd6427-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666952740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952740, "uuid": "22fdbbaf-1d68-45e5-9d21-e0e6ce7de118", "comment": "Malware payload (Amadey)", "value": "0161354bd90e7ecaa675ef41a624b2de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952740, "uuid": "63ebda68-fa34-4941-af59-73570e4cde28", "comment": "Malware payload (Amadey)", "value": "7fcca1952873cca9b7877623fbcc72bfa6cd7f960f454ebc28f922ff52372883", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952740, "uuid": "442c8438-51f8-49c5-9f18-378ffc7ac93b", "comment": "Malware payload (Amadey)", "value": "0d6e8082dfc2d6a03f3884d34f1223646608968c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952740, "uuid": "e1fbe5c8-6b83-490a-92f0-167b105daa54", "comment": "Malware payload (Amadey)", "value": "1fb7917291dd5b156de890f3b26470f06d629ff31b5da3f91d77f76e94af006a399602629face23a26bdb22c4e2f97ea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952740, "uuid": "d8597f62-50e9-45c3-9951-949ff7889805", "value": "T11544CF313692C3F3C0421130752ACFA00ABEF83D1961798767A8276E5E7D791BA6671F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952740, "uuid": "d7ed1f6c-88df-421d-a451-159be408ad09", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952740, "uuid": "3c636f0b-e8ab-4358-aa8f-83a444059ce3", "value": "6144:g9F3HqLTJbyVgrN9GIlb8zSaRHxhW8yp:g9F3HqPVyOp0qbbaBXWRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952740, "uuid": "cafec5aa-7916-40c0-95ac-6e70e4321d48", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952740, "uuid": "381bbf51-bec1-4500-922c-0658e6d38366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952740, "uuid": "bb0a66a4-ee47-4c91-92a2-a2b153adbe68", "value": "0161354bd90e7ecaa675ef41a624b2de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b69f75d-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666970988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970988, "uuid": "3a796106-5ae5-410a-800d-bb39dcafbb8c", "comment": "Malware payload (Smoke Loader)", "value": "d081d36c0eac6d412bfd509f6c604a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970988, "uuid": "57bed6db-909c-4e6a-a140-a785858ce275", "comment": "Malware payload (Smoke Loader)", "value": "807e887aed61541d80bec20588a33a0a295f3d8362cabb41b6351d224ac3f435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970988, "uuid": "2f794a01-f767-4e82-98e8-f0808d950dd2", "comment": "Malware payload (Smoke Loader)", "value": "6d68a4bc0897113255283910df5cf95c39e5461d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970988, "uuid": "1e0acb2f-e923-4a7c-8a3f-bf2078104fcc", "comment": "Malware payload (Smoke Loader)", "value": "7d15ab716dfce95aa8c469fa8fe5dd98787cbf173b65dc659612d65a410f1ec7fe147b8a674cd11bb2e1b62a56bb4fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970988, "uuid": "1962cacf-a286-4190-b267-20500b9bc1d6", "value": "T19B44DF317992C471C4922630443ADFE02EBEBC3216758A8777A42B5EAFB13E1557632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970988, "uuid": "a058748c-9c19-45c6-8874-71f2712903d3", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970988, "uuid": "3087ccf2-97ba-4c06-bc90-48e7ea11f712", "value": "3072:vXOV+HXnLwt9Aka/fG5mj5fpq3NUyrX1qg9Sp9DWRWGtCdiSlQi7YQVFiGv2y7ds:f++HXLwt+/u5Q0NxqgE9DbGt/SRi8n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666970988, "uuid": "45c56260-3334-4c70-a7ee-ee092b83d959", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666970988, "uuid": "bf42bc13-97db-4e92-bde6-07832c2c2a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970988, "uuid": "8cd88eca-d33d-4ecb-8539-82ceab0878fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d509a32b-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937261, "uuid": "6eddf96f-6ecc-4a57-a46c-0971428e98d6", "comment": "Malware payload (SnakeKeylogger)", "value": "a33a4e49899ef178f386c040bbd1aa5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937261, "uuid": "52aeea35-384c-405b-ae84-3cee2e8af9e5", "comment": "Malware payload (SnakeKeylogger)", "value": "809e5448573bc3e752920fa6d4230b7837c3b522c5ee8199bdf3f1680f162412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937261, "uuid": "6b595837-64bd-4eb9-9518-81f1c1f4edb7", "comment": "Malware payload (SnakeKeylogger)", "value": "ad4041c77565c078183c1b68e95b0b8bd61637a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937261, "uuid": "0b51e9e8-f752-420a-b410-8b1bfcd160a9", "comment": "Malware payload (SnakeKeylogger)", "value": "46f3aca34f2d73b20ceed57fb2b5c8cf8a713afa26b4590902e220225606ab05c39300eccff5c8099e144e7b7263ac29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937261, "uuid": "981464bb-23dd-4f23-a493-cbd3abd34f42", "value": "T13BA42275F917B2B3CA873770740D09955FBA08E874EAA5E822DE74492DB0F0B12178F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937261, "uuid": "c2a87de5-d259-4d13-8d8b-328ef2159ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937261, "uuid": "57168a3a-4212-48cc-9b73-de6dfcb4457d", "value": "6144:XmEaw7c7ofrk0e+OGRdaxlO9hDqnxE6n5rE2ShNeY/ZrJ20mcjxF+57t1LRwAdd8:nh75BOAd1HDcqzTxF+NLR4EyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937261, "uuid": "8df6cfa8-2d9e-4443-b792-95ae410e1ef2", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937261, "uuid": "855dbd54-691a-4d8f-8757-08dd880b29cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937261, "uuid": "ebd2ec45-636d-42bf-8963-6597aa5f3dbf", "value": "sJ6SWcoYscLhJTm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be35663-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943474, "uuid": "b3e5713e-b22c-489b-99b4-0e937499f58f", "comment": "Malware payload (RedLineStealer)", "value": "6885faeb2a2578f413f45b33084691f7", "object_relation": "md5", "Tag": [ { "name": "placeofreesoft_com", "colour": "#808AD6", "exportable": true, "hide_tag": false }, { "name": "pw freepass", "colour": "#01856D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943474, "uuid": "c5e0be0d-7ffb-42ec-9e15-1cbe93136610", "comment": "Malware payload (RedLineStealer)", "value": "8145f2891a223c594f928a860eb930f281f81e0892964f41189fc1bda6059bf7", "object_relation": "sha256", "Tag": [ { "name": "placeofreesoft_com", "colour": "#808AD6", "exportable": true, "hide_tag": false }, { "name": "pw freepass", "colour": "#01856D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943474, "uuid": "c546a9c1-c289-4715-b8f9-5d73a81022b3", "comment": "Malware payload (RedLineStealer)", "value": "527c05f54c4ec95f199c0a61ca17fc14d06300d2", "object_relation": "sha1", "Tag": [ { "name": "placeofreesoft_com", "colour": "#808AD6", "exportable": true, "hide_tag": false }, { "name": "pw freepass", "colour": "#01856D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943474, "uuid": "cf6a6491-404b-4478-8fc5-0b399fd0b2ba", "comment": "Malware payload (RedLineStealer)", "value": "223516d816de3da19527aeccb15a18890fa317770fb1ea9c38f63f69d05d0052c84a379a95179e6a0a2a4c70d95c6898", "object_relation": "sha3-384", "Tag": [ { "name": "placeofreesoft_com", "colour": "#808AD6", "exportable": true, "hide_tag": false }, { "name": "pw freepass", "colour": "#01856D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943474, "uuid": "b5060ffc-ae4e-46d4-8e91-eb6a0b8bef1b", "value": "T100756726F4143B61E88DC6B402B01DE403F52DB8136F67C82276762FDA27E7D9AB4935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943474, "uuid": "c657fbf6-0102-4dd9-9a7a-84029655f847", "value": "12288:JML5598CYZnMuIqOk1MtbdyOW++WMwDjd34cHp9qEpRZgePAzjjeVoksYZO1LQXY:J+5+3hrItkGFdyOWkMw1BrBASV2G2SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943474, "uuid": "33ed902b-0bb9-4778-8c40-8d75ee4df120", "value": 1662029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943474, "uuid": "6e615ee7-e09a-4a1a-8499-57c6a9a75474", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943474, "uuid": "c0bc67de-c353-44da-87cc-d1e3c071d2a8", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa471482-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666949350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949350, "uuid": "15121072-50b1-4cc8-84ec-c587d4079b4b", "comment": "Malware payload (Formbook)", "value": "5d0704142349c70304df4a3e2a401d6b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949350, "uuid": "4a18a328-8604-4a56-9a13-02d4b13b5352", "comment": "Malware payload (Formbook)", "value": "8206e029f0266ea051b039afc8b9427f70079ee9d9ba4cb7cacd9f944fd2e9c2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949350, "uuid": "532b0b19-24aa-4e7c-b059-e888971c3ce5", "comment": "Malware payload (Formbook)", "value": "d8c0caf793b78713ac02dcd09e0e326d6bd45b18", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949350, "uuid": "7971715a-28ee-47d5-8efa-d2271c9ea1af", "comment": "Malware payload (Formbook)", "value": "da14859e819c0dbc208cbeb7b6157a5890cd0eddd23e67366a0b1ac1af9ee886f36a15bc38d75ec336645cec16fbaf02", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949350, "uuid": "5d5fd7bd-33ae-4a95-a2d5-d271079f4434", "value": "T1F2C412A8760071AFC967E9B6CD4D0DA4FE1168F653AB8303A4D326EC8D5D94BDE050F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949350, "uuid": "077c813e-901e-4df9-9637-e1ba347bdad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949350, "uuid": "a045c19f-9551-4260-a785-2b55b3e413e2", "value": "12288:th7vEV0mHpuSvMvEahAaWP7IneAdvB3RwkdK0t95/KLEyLONLb/:kPTaGknvvB3Rwko0P52EyLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949350, "uuid": "bc3f8a7e-52a0-4b70-8fc9-4d17635b2428", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949350, "uuid": "4c6564f1-c3d8-4e6d-8635-835dddfbedcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949350, "uuid": "19ab4c6f-e4ab-4be1-a88e-dd3746555e56", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c68916c-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1666949487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949487, "uuid": "627c1080-ed74-4a5c-be11-7b1f1f5783ad", "comment": "Malware payload (CryptOne)", "value": "56051224b296f71feedc4f71bd0aa26d", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949487, "uuid": "320b52d4-a564-4bb6-a76a-b75671787202", "comment": "Malware payload (CryptOne)", "value": "82d9c76f30d48e2fd8e8beaed17022779b9cd6d2c4f24fb4646b990d3372fca9", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949487, "uuid": "410b8d25-5ae1-44ee-8bb8-bc78ecff539e", "comment": "Malware payload (CryptOne)", "value": "128544ccb5629d684648ede734de5bfddd49ee42", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949487, "uuid": "5f22523f-6b0f-42f0-9214-3f480542dc30", "comment": "Malware payload (CryptOne)", "value": "3eae73233db3b78b50c56cca90c0549d1b8e58b06d2a6fc82c02f13886eb30b7c1099887da0b6420f200e991c10e2d2c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949487, "uuid": "427e0d5b-f54c-457f-8162-b40d6f03afb5", "value": "T14A85231177C68572C65309315EB587A03979BC361F338BDB63A4A62DEEB14C18E38B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949487, "uuid": "8c3ad245-293c-435c-a3ff-aef4dacaa916", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949487, "uuid": "955b1f2a-6873-4611-9b1a-c93ba89d1ac4", "value": "24576:rconAINPy/Cxax86Jmsf5rR5Lg6K+38MdgPurN1TsrtBjgWHP6JeXEtWrtf8UTYh:bRxdv4zcy5K0Dsr7jgSPG4rx8UTkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949487, "uuid": "17837735-e7a1-4749-b95f-d41f0c28ff89", "value": 1861313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949487, "uuid": "0044abcd-9528-4050-a4b8-f980bf61da47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949487, "uuid": "dd262bbd-eb32-498d-b5e0-51fe2b0182b8", "value": "56051224b296f71feedc4f71bd0aa26d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2dc318-5717-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666999609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999609, "uuid": "ed89d4f8-7eab-4e0b-b130-5f16d6f24000", "comment": "Malware payload (Formbook)", "value": "b270eccd029358514ab53037ad3819db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999609, "uuid": "460d7ff3-274b-4cf4-9bb7-37c9ab1f17ba", "comment": "Malware payload (Formbook)", "value": "835e1593489cc0a4bcb5d8758abe436a5e8c9d7061cecda2ca7f3f10dc3ea99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999609, "uuid": "3c843a13-7ece-4459-ad82-406a6260de02", "comment": "Malware payload (Formbook)", "value": "fbd7eeafbcb8f1c9143c8b397cbe0942c9806c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999609, "uuid": "24515f98-abc0-408e-8f49-7519297ba44c", "comment": "Malware payload (Formbook)", "value": "bf62ab5aacf1ba93bc0fbded9dab7809567eb7114d32673704768e722653c2efa637d2f0a645a66395f9881f393a1b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999609, "uuid": "1b77ff8d-303e-4db4-aaa9-e4a0a66b31d3", "value": "T1D6C41299760031CFCDABD576DA994C70AF22247B1B4BE247A01736AC0D6C56BCF0A1F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999609, "uuid": "80054ff4-6484-477a-834c-d5972f7c9caf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999609, "uuid": "8550173d-89d9-45b0-917b-e7e53991dd18", "value": "12288:Gkh7vhWo89y/4bLHkjpRKOYpu+HXROU/Vg1EyLgwDR7TM7R:+oOyAbLHyRFYpuIhdg1EyLRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666999609, "uuid": "448c3690-279f-4e02-860a-cf3e15fb1cab", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666999609, "uuid": "ed2865ba-a793-45b9-9bee-0c4cc6dbcfb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999609, "uuid": "5a4b390c-1437-4c5c-96cf-1cb9176b95d4", "value": "Deposit_Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a78a631-56a8-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666951766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951766, "uuid": "d4507c34-067d-4229-a708-514724569f65", "comment": "Malware payload (GootLoader)", "value": "b349bd02d012c28a198d6edd8491eb7f", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951766, "uuid": "d84b4d06-80cd-48f3-bb9e-6f5448dc5de5", "comment": "Malware payload (GootLoader)", "value": "8373a2ae2684edb240cf34c161362641518a078e1dab0ace25d309f5651ad4d8", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951766, "uuid": "e7c6ad60-e446-4f03-9dde-119f34bbf71b", "comment": "Malware payload (GootLoader)", "value": "26fa1608622686ee0cbf20c31fd7ce48586c4fc3", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951766, "uuid": "30eef83b-e1c3-4785-bb29-4160a22a72fd", "comment": "Malware payload (GootLoader)", "value": "3233c20db66ea438f002dd3cd17f3dbca8d5a13e44c065f7d9f0578cb0db2b3864c395777f1e4c4db35f2ac02b9ab348", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951766, "uuid": "7009c33a-78ba-4534-8905-dcb6227fdbdb", "value": "T102A2E1C0E19D5ABBC3A5C27479AB5E48B63D56FC81BFB88A633E2D7C46DC5804324439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951766, "uuid": "f28beb5f-9a9d-471d-939b-f2308be75ee2", "value": "384:Fd2CZZHjoct8z6XMcp+BIW4bWveRmGlZvo1Qm6p+ecTVlvrrKD7ZIVAmzkP4z1NV:yDctQ6cceD4bJMyAxdfruD9g7s4z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666951766, "uuid": "320ffadd-fd49-4a75-992d-d8e9755c7712", "value": 22255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666951766, "uuid": "2d44cd43-d559-40f9-8772-eb1c29e11355", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951766, "uuid": "db432643-8882-4891-a15b-bab4e51ebaf5", "value": "Which sentence has proper subject-verb agreement (79164).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99385fc7-5704-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666991278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991278, "uuid": "393633ba-c613-4f72-90cc-5e4256b74b4d", "comment": "Malware payload", "value": "2aba2766ceb64cfdd9f30be2eee724f4", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991278, "uuid": "f9e76327-7c94-40e9-8459-5027d070ddd3", "comment": "Malware payload", "value": "83db6198d47c70e30dcd1f8a4da14d8a2b989125a6181bb5d13eeb4a6bd024c6", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991278, "uuid": "48435f6d-eea0-40d9-bb1a-875bf3d2ba06", "comment": "Malware payload", "value": "8f974a04041f28d36da1178e941e2fed39c95240", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991278, "uuid": "81fe4321-68d8-4716-91d4-45b6ad0417ba", "comment": "Malware payload", "value": "c743a9dbc1acd4a0eee361ec94eeb4fe4de46e3b3ad1a3bdd222c0314de2f26947ba91580bb9f5b01722dcf55f2acab7", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991278, "uuid": "08e53691-d76f-4113-ae26-c26db64ad09a", "value": "T11FA2F2277609FE0291B9D1FB1326D8C671CFFF13AA567E9D1306397D5060A7AC8A5402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991278, "uuid": "a0027c1b-9046-4904-97f9-b4488ccc436d", "value": "384:Wiy8xxNbhe9xBpMl8c0QVHfOiZfizs+ilf9Du3bI49VJUFQTjQ3q/KizKMGRRyfa:Xy8bNbim10Q55r8XBUkjONeK92f41h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666991278, "uuid": "65b6f1c9-582a-4b29-90f0-9d0f6e31545a", "value": 22348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666991278, "uuid": "ee3b548e-e811-45a2-a086-5d04ab304452", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991278, "uuid": "1b21a848-7261-4743-9c7e-65e8f3535a6c", "value": "Which sentence has proper subject-verb agreement (80838).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5337a81-56ea-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666980158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980158, "uuid": "a639b185-6892-46ea-a5bc-5e19eebc6cf8", "comment": "Malware payload (SnakeKeylogger)", "value": "15e37f89fc3da80372346445c7efd579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980158, "uuid": "3c3056dd-4c44-4218-90c3-912c69874da9", "comment": "Malware payload (SnakeKeylogger)", "value": "8414a2b799387045388139ba2b42085b6293cfef47df716a3d6960819d990dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980158, "uuid": "a3d4335e-d2b5-4245-ac98-5fd381a97726", "comment": "Malware payload (SnakeKeylogger)", "value": "ced8d98e17046d608deafe2457d56987d2dfe1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980158, "uuid": "ea27cb43-2601-448e-8309-2c1e0049844d", "comment": "Malware payload (SnakeKeylogger)", "value": "785fc559a535a11968c4c98776921c38ae92efdeecf043cb11e46eb921299ef08fa680d1a43d652b92e2d8b36ef33c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980158, "uuid": "75b2cc73-8d68-4d26-a7ad-bb964119f913", "value": "T1C32529A1F2558E9BE89B8EB1BC36D43015936DADA8AC410C85D97E7735B3352208FD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980158, "uuid": "579da3a4-956c-4152-9bc1-0b2ef8973bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980158, "uuid": "d73d2bba-2300-4364-ad76-7d256a04cb94", "value": "12288:LkOa00m7yMYFbzHYDiELu0WGbFcBVngNCo+pL:L+0z7ylRUD1u0TFiiN1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980158, "uuid": "20f48d13-e2c6-42f5-a00a-c72ec210eaa1", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980158, "uuid": "50bcc1e9-2fda-4bcf-a12e-b233317d805e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980158, "uuid": "f4c172a3-6340-4be6-bd5b-bdb3f6220894", "value": "0372YT591445-22 -72450,00-USD-SWIFT MESAJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b9412c-568c-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666939536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939536, "uuid": "5293a38a-5d9f-4ff1-ae5b-9940f023cc31", "comment": "Malware payload (Amadey)", "value": "850f589fb64bc6834215eb3afa49bcad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939536, "uuid": "4f793b90-ae7c-4774-8118-a9e08674f60c", "comment": "Malware payload (Amadey)", "value": "84cff26dd6320a6fbd8a7193d420ff4dc0fa590494b5c34cd2ff409d1e9c3dea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939536, "uuid": "cea8cd92-f8d1-4613-b57c-4f3349a7c396", "comment": "Malware payload (Amadey)", "value": "052e81e3f46ade6b310adcfdf12d605cab5c0ae0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939536, "uuid": "5280c297-785b-4103-8ec7-6e7352aa5e45", "comment": "Malware payload (Amadey)", "value": "2d1f07b5ffed7050a234d850d424dd125cc1811d3dff4aa559de0fd8210750eebba8acdbb9a2b44fde7d8b4ac8c14e51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939536, "uuid": "82fd40c7-4159-43c1-9e7c-55893059152a", "value": "T17064CEF17651D879C08DD130842ACFA0297EBC365925468773B83B5EAE713906AEE31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939536, "uuid": "6ba1b644-d18f-4b3f-9233-72bce8194baf", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939536, "uuid": "b2149a4d-511e-47a5-a920-074adf9eb2d9", "value": "6144:5QoH5LUXyy+fuXxWguMPyCVkATFUgyKtIwXEYKl:5QoH5IiyKuZPyC/TFUgdIwXEVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939536, "uuid": "75d57253-9129-4a18-bf01-005e33a93cda", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939536, "uuid": "6b001175-48e4-411f-bf62-585f5e63fd2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939536, "uuid": "3925d15e-8732-4d86-8ab1-3ebacad33b2a", "value": "850f589fb64bc6834215eb3afa49bcad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436afd86-56e6-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666978249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978249, "uuid": "fc941468-1e82-4796-8cd9-c62d0e081e6a", "comment": "Malware payload (ArkeiStealer)", "value": "187fd27e198d95ef64209f5dd7c31fe6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978249, "uuid": "48c1d34d-094d-4a1f-a213-8a805d38c6b2", "comment": "Malware payload (ArkeiStealer)", "value": "84d14647668d5c7b9658be5ee0b28ed4e6809d2df12f63ee07d9384e263bc624", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978249, "uuid": "6b894e50-3e9c-4ab5-8966-04ee8a18b05d", "comment": "Malware payload (ArkeiStealer)", "value": "f847287ad341b0b5dc5452e521806ddfa2201a74", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978249, "uuid": "5c92fcf0-4979-44ce-8df4-b64ee00f5ca8", "comment": "Malware payload (ArkeiStealer)", "value": "3981ab9421af7a4396b11b9c9d98bc4b2423bc3fbf4ab847021ba3b6d6c03689b1d573833ff96f2542cce52ce72247f8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978249, "uuid": "db688e00-6a68-43e0-86d4-6220e193bda0", "value": "T1DE44D0317592C0B2C455253C042ADFA01ABEF8312B61494B37A7276FAFB63D19A6731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978249, "uuid": "1099e9d2-5b28-4821-adbd-f70dc65b3aed", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978249, "uuid": "e8e62307-d343-45bd-83d4-416a48fd1fcb", "value": "3072:AXOSHpyLZtAg0fDGomj5xeS5NmMyZQnfPd/boXmHnt0wNRHYfoM/h3i:0hHULZMfKoirN/y+nnd/ymHttP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666978249, "uuid": "1ad85af3-84c3-4cbc-8f78-51b01579d40c", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666978249, "uuid": "f5b9d2e3-e76c-4f5c-9010-03ef57144c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978249, "uuid": "427a6e5e-243c-451e-95b6-7415077427ab", "value": "187fd27e198d95ef64209f5dd7c31fe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31aaa34-5681-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666935084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935084, "uuid": "4a84d5c1-1d50-4b90-9797-d70cae48ee91", "comment": "Malware payload (GCleaner)", "value": "96eee428f53a9ce40a3685c103c36483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935084, "uuid": "2ea7a2e1-ccb6-4909-9c1d-9c8a22a58d86", "comment": "Malware payload (GCleaner)", "value": "84d3accf1b0cae9580ee4705711fe1e90d3376aab4d9d9ee544307d01d532e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935084, "uuid": "e7dc1d49-c8ed-4679-b488-694914cfb00e", "comment": "Malware payload (GCleaner)", "value": "8b06eae55a5f0bc9a2d40686e240facad3958ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935084, "uuid": "cca7ebd6-1967-455e-b398-25aedd8d0c75", "comment": "Malware payload (GCleaner)", "value": "bba6cd85a4fdd1df9beec941170d6e30cf5caff295b494726f8d1da2f95730bd8ab8dbb734f5d1eccaf321184b7ff338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935084, "uuid": "155fbf0e-89a6-4daf-8d24-c78b1abdf8ee", "value": "T104C533D3C3D28137C40AEC31AF2CEA85D6A7379220216D4C7EDD4DBD49AC6DD20A176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935084, "uuid": "449d5e8a-3528-49be-82c1-ba3a308319a3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935084, "uuid": "f203f7f4-5534-47a5-bcfa-2603e83aac86", "value": "49152:Z2uiq7+afccJGPe+ZZ5gcOc2ZmAeeq9IPJyrXKYdA+zDqPmnzse3A5hq:Mu97+Vc0zZzgxVlaIxUHnmUoNDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666935084, "uuid": "0a765ec8-6f7f-4749-8a82-a6e7c3117a04", "value": 2598238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666935084, "uuid": "860b76aa-afd4-402b-a538-8c81b4a39cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935084, "uuid": "43c56bfd-8bba-45d0-b1c4-6ab42b8be2fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c13d051-5719-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1667000087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000087, "uuid": "026167d2-d3eb-400a-a872-6fe0097e7cba", "comment": "Malware payload", "value": "87c29d93280e7aa9227433028a6dd4cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000087, "uuid": "f970c418-d20e-4a10-ab56-f9a7f6c0ffe8", "comment": "Malware payload", "value": "85537e9ad82ca39984b8a818d4c7abc163b2c40b348c72d455a1c9ecfcf60a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000087, "uuid": "78dc5114-e9ab-42b3-85c4-fbcfbe330f1c", "comment": "Malware payload", "value": "aff77bd7826c67c254470eed2e2938224109e6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1667000087, "uuid": "60dfd938-1a30-40bc-a8b5-1999bed595dd", "comment": "Malware payload", "value": "af1aa3d923efc5b3b6b1136e7ff2278701ddc3c155eba7fbec5b817d14085b252b715f93fdaabb221f67ea4842aec363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000087, "uuid": "fbb7cedd-e7eb-4b99-b345-19ef352e32a1", "value": "T11744BE317990D472C48657309835CEA1297EFC616D688A83F3A03B5EBE723C166F621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000087, "uuid": "4afaac16-1a6a-4c7b-9030-ebd291908b55", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000087, "uuid": "ad4068bf-3582-4dee-b193-b0beb7c187a8", "value": "3072:+biuBThNLab+ogz5t4l2Kk29HXSv1R4ELc8UMlnvOmumAb9ZMYyCXM/h3:HuBdNLs+6XjHk+EjUMBvkfM5CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1667000087, "uuid": "8c6595a0-317f-488b-85b3-b3cd276b75ee", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1667000087, "uuid": "5bf4eeb7-0af4-413b-8a8f-9885e8038955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1667000087, "uuid": "07565e76-d1da-409e-b325-3b8982cf4364", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ca22a6-569f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666947725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947725, "uuid": "16e9d465-a567-430b-b1e5-09356fc8befe", "comment": "Malware payload", "value": "04e3d00bcbc5242dab3b23e19f627a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947725, "uuid": "c093cc4f-9759-4d7c-82d4-69d3d53f0663", "comment": "Malware payload", "value": "858ada526004c87d7dffb98ab24e7bfb80fa432874caf5d3a1995a1ed69bb29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947725, "uuid": "ca94e97e-9d34-4669-af7e-f7dee05a7686", "comment": "Malware payload", "value": "c6aaf07c855aa81957b3e9638eed62ce832662c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947725, "uuid": "a9c4d49b-a647-47bb-b36d-a1fc2b67b760", "comment": "Malware payload", "value": "543e9b4048492f0598cb3f7c32d6ab0cca47f400b628cf988e0adbaaa9ed866bf3ac557062d1297a7a9f1f6ea6fbad43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947725, "uuid": "1d0f1c34-b2e1-4a43-93d9-9741073d5d3b", "value": "T15D76335DB0E6E03BE15B0F39426B17C8F0EA07644E6285BF07C82555667F3A19EBE702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947725, "uuid": "92be626c-7996-4da8-a1bf-ba517d53bac9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947725, "uuid": "6f73ab23-fed5-4c11-8cc4-3644af9943d7", "value": "196608:91OHxkuV5Igbnx/fPcbErfyglwcjB2QDxvuf:3ORkuhBXcbEWSBbDxvuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666947725, "uuid": "4a764753-5fa2-47b6-946c-9db3f554260f", "value": 7600189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666947725, "uuid": "61912f3a-0507-4b96-bf93-0a90560d3b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947725, "uuid": "e8b141b2-08c5-4402-bcad-4a515d3e5318", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb92f5c-5697-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666944334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944334, "uuid": "e374c36d-de31-4d2c-b219-e32f4f5ee1d4", "comment": "Malware payload (Amadey)", "value": "407e48d7239724cbb558d7268328b4e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944334, "uuid": "96fbda35-a6a0-425d-98e9-87c17698c8ff", "comment": "Malware payload (Amadey)", "value": "85a9763a6c84664cdbc0dc52e75fac7f028179f58662d4f612ff1877348cac01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944334, "uuid": "a127bdcd-12e9-44da-a987-d452b7976d8b", "comment": "Malware payload (Amadey)", "value": "6fe877f9159157a29fd6188b8e38b240eb621dbe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944334, "uuid": "6717aac7-c190-42a8-ad2a-081700b89038", "comment": "Malware payload (Amadey)", "value": "c005694f209b53591c8a16acaf8cc17a2140af26b5dec99e0597a69e773142ebead9aecccf81fac4fdc1bc0a7b3cc997", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944334, "uuid": "036376d4-4df3-4d7a-9e04-8597dc4f06a2", "value": "T11264CF327682CC72C09111308439CFE169BEBC35D9604A877768379EAA753D1A6F636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944334, "uuid": "8470bcd5-f91d-4eb1-9605-a19fda07bf58", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944334, "uuid": "a96f0039-a2e1-468d-aa10-d587c6075381", "value": "6144:GQmHJLS2wzqMubCSc0KDiHjLcXuPVP+H8MbFBj:GQmHJOpz9ubrKDOjQaVTMbFBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944334, "uuid": "412b211c-7707-4ec8-b6af-22891e11fc91", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944334, "uuid": "dd4d0d54-bc1e-4552-a930-0d65310443bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944334, "uuid": "c0cda676-9b53-498a-8924-acbfeb0ea0fc", "value": "85a9763a6c84664cdbc0dc52e75fac7f028179f58662d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31df28f2-56b8-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666958462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958462, "uuid": "301088d2-0710-4bfd-b8f9-842daa7a5ee7", "comment": "Malware payload (GCleaner)", "value": "e57cbd949db00eabb2a3cbecf5abc167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958462, "uuid": "8abb6578-9b06-463f-bdc7-3ab098cb4493", "comment": "Malware payload (GCleaner)", "value": "8833c3849cc93b5363aed515dab12e4509df0a679d7e8bf41f748fca0247c13d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958462, "uuid": "33d3b7b4-3fa2-4150-8c59-6c927b257914", "comment": "Malware payload (GCleaner)", "value": "8445d373eeeb107c12b2c5b6abfef412d12ed865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958462, "uuid": "b5ea840c-de2c-4f3c-97f4-3d8928ede963", "comment": "Malware payload (GCleaner)", "value": "2073e2bc5827f9693567cfaa87f64155e6219ffbad8ad7c4f37973782218e4df601db8afeff3146808b0a91530350398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958462, "uuid": "460a6df1-c212-4302-8179-2db7e30b9a68", "value": "T18CB53313CB92C975C581C4F145256ABD0CFF7E6003373F5B66ECA6ED8EA26C680DA621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958462, "uuid": "e4117b64-cbbc-47a2-8611-7846e8149bdb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958462, "uuid": "17f3b271-8e9b-497a-b6e4-3d3e346d7258", "value": "49152:Z2uV+JZ58mCpC379gl8ohQx5H53OBMszhAyQuGGg0WX+XN5m7QoA5hq:MBXCG79glV+x7OBMsqyQEgvuXDm6Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958462, "uuid": "7df8e7dd-bc67-4f23-ad9e-51061a4189b9", "value": 2412551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958462, "uuid": "31429697-1007-4dea-9907-045e56f7dd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958462, "uuid": "8c752bc2-f246-486a-bbbb-71745ac2bfc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff23088-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666971022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971022, "uuid": "ba0f6d63-3016-4a3b-aece-d69c1fb8c001", "comment": "Malware payload", "value": "169b89848426bb0d051d8cb13972c251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971022, "uuid": "9da9ac90-c386-4ff5-9eb8-f8ddec6d294d", "comment": "Malware payload", "value": "8847a0e33180494d34439bd327c2c1a5a6e59d977ced499f4f78991761e845ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971022, "uuid": "ed91c70f-3588-4b29-a39d-4235b437ab18", "comment": "Malware payload", "value": "4e14c5f5374d7a703e03dec7dbf22c95d3125943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971022, "uuid": "d01489d3-8db8-478a-bea1-fa306b7e9d13", "comment": "Malware payload", "value": "7bef3787216d1b7dd7ddb5301bbb2788d67d39c187fd94cbdc2381b4094f50f9cb5ed554d79748fb1bca0ee112bf5f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971022, "uuid": "c5c3e56a-1b21-48d7-8e2c-5b7256270d09", "value": "T1EE2633B7B3D2C58DC2222435C3A8793974570BFD7C49C0AB16DD0149E8E7297BE8266E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971022, "uuid": "adb199d1-5ff5-4d1c-9d8c-487a31d4651f", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971022, "uuid": "832254aa-dbb9-4938-8ba3-e0ccaa5301e9", "value": "98304:p21W1oZ1dHB0FrBDDUGqImbs4crHhMJ/7vB9ZP0GYSL:p2IWj4rbqlb+HG7Zsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666971022, "uuid": "ba82f904-e9dc-4377-88b8-45c2c9512606", "value": 4486144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666971022, "uuid": "a246b830-ce01-4cd7-85ca-0c1d53c7722d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971022, "uuid": "a0832653-5b5a-4e92-8b81-acad31cca143", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d589a8e-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938644, "uuid": "4179b1d7-4df7-4edc-a8d9-69e91f1a39ad", "comment": "Malware payload (Amadey)", "value": "c490126852a53344b4a667827b679f9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938644, "uuid": "4f1da388-890e-4fa4-bc46-01e3be819ed8", "comment": "Malware payload (Amadey)", "value": "89191c64341812ba89680b34176609cdf81abfea120553d22333e687f5ef135b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938644, "uuid": "54b21ce3-d80c-4ca4-ac2d-a3d9eeebf358", "comment": "Malware payload (Amadey)", "value": "fadb04de333e3f66f39f555de6f85636d3ca5a96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938644, "uuid": "38a8d606-0c62-4da7-bc36-a8085be985c0", "comment": "Malware payload (Amadey)", "value": "8f7862944385e7feb4a20fbcd9a413f323ca2a65f17f0484ddf378fc7df4cd688a81175377bcb73a9000bf7f7fb43273", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938644, "uuid": "7a1a8e53-f6a2-475e-a2f1-220220f38a8f", "value": "T12164D0317992C872C4852130842AEFE05AFEFC3015694A4377A43FAEBFB5391A57625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938644, "uuid": "a90ea428-f012-483b-8a1a-04a2c8d794c4", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938644, "uuid": "71134ba3-1e20-4ed0-97d1-f6cc4b8f49bc", "value": "3072:SZXO7q3Sx4IsX15dETFSrhu8v+gQD5engxTwR/40c+W1D6jU2l7/BXMrTUwiUApq:EoqXVEZdT5+DhLBe/iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938644, "uuid": "2ab7b1da-04b0-4e67-8e8f-1ac360d48689", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938644, "uuid": "34370127-e2ce-43ae-b0d2-7d4aa486efd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938644, "uuid": "a209c2a7-38d6-476a-a6fd-0467cf2c8688", "value": "c490126852a53344b4a667827b679f9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9c7afe-570d-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666995018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995018, "uuid": "99f1de01-4d7e-45f2-8a97-0c1c81925440", "comment": "Malware payload (CoinMiner)", "value": "3b3abb87e490934b2fa01fcaf6d4dc8e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995018, "uuid": "7ad0183e-257e-4302-9051-cb606f2df47a", "comment": "Malware payload (CoinMiner)", "value": "89be1483f7f40e08b04db65dffe5d8bde05997c07febfe78fca863fd00d14966", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995018, "uuid": "42cbdfe7-4564-4368-8a93-61ac323dc680", "comment": "Malware payload (CoinMiner)", "value": "e75882f88d8a04fb339f2700af6719820eeb86f6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995018, "uuid": "100957b0-e615-415a-89c6-c4f238f8517f", "comment": "Malware payload (CoinMiner)", "value": "7c0ce5eddea89ec5bb81e9a2cd98119666d21683df5c3078ce045e5a6363f95577778e3a58c35a595476ae7716895f7e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995018, "uuid": "4252df3b-ebe2-4a01-ae8e-cc09d6b77204", "value": "T19D44BE217AD0C732C49355304935CFA06A7EFC311D788A8F76B83B5EAE72291626635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995018, "uuid": "581933ec-c80b-4ba7-9f8c-9016660dbfaa", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995018, "uuid": "ffc478fa-8d2e-41a0-8ef1-38057ad0907a", "value": "3072:F6H+BCRjL5EeY1z5ShLfC69DRQGIBFisPk64q4t8TbRM/h3:q+BujLieV3BIB5MZuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666995018, "uuid": "def4800d-3fae-4a83-9d3c-eca2cb442746", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666995018, "uuid": "e589f51c-876c-400c-b2ef-333d8e5b5fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995018, "uuid": "b4905cfc-a994-4815-b6d0-90540c3c985a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c2ec94-5696-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666943918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943918, "uuid": "56fdc187-6a0f-477c-b41a-7f1f5f3376e9", "comment": "Malware payload (RemcosRAT)", "value": "c25596767692a921d735ed5413aee088", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943918, "uuid": "fb91a612-c52c-4e28-adbd-fdc91cf8d027", "comment": "Malware payload (RemcosRAT)", "value": "8ac751d835d0559e2a9a757c04e1713d37ff8ae4d7ebd83cf2e6a67009b2bdec", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943918, "uuid": "4c0f29f9-2c15-477b-857a-ad25f03287c2", "comment": "Malware payload (RemcosRAT)", "value": "bc65fe8789b175e607bc8c4899ab0a7b3b4ba31a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943918, "uuid": "ba3faea8-39a8-474a-8c8f-71a1353a9bcb", "comment": "Malware payload (RemcosRAT)", "value": "ad663cc2bcfab0f84724b3dbb2e0f3005eb61a7b7c3920205f3a3e931a23cd0280ae64c89fc27a05ade1a8d4453c40d6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943918, "uuid": "bb23b8f7-cc24-4da3-b1b0-cb7931b93d6f", "value": "T146411886DA159B73D048D73D78582B480AA7F276615963EEA43F87A201B5C047A22B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943918, "uuid": "6ec2653d-ac34-4af2-8bb6-f72d773db1c5", "value": "48:9MbFXKEQu+Ixh5U+GSAk3e75oOKVzdQZm9X7js:qXKEQuXxfU6fe7wV5QYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943918, "uuid": "e50a6b57-de36-4fe5-8adb-1789b7141308", "value": 2073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943918, "uuid": "ea60b0c2-27fe-412e-8e3e-848b2052525b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943918, "uuid": "02fff95a-4173-4f2d-9ea0-5eaea0ee0f41", "value": "RFQ_01.300.TRGVH.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1639d43b-56e5-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666977743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977743, "uuid": "91a45d58-9e40-490b-8eb5-654a3de2cbbd", "comment": "Malware payload (AgentTesla)", "value": "028c6f21c0cb4b989858a826e598db2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977743, "uuid": "f400c8ec-cd8e-40ff-94b4-0aa0a573a841", "comment": "Malware payload (AgentTesla)", "value": "8bcbeaea3f59e76ef9f3da304b57d2d6066e5590285c15c9eede33d229eb6e81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977743, "uuid": "4dc8ee35-afc1-47d6-ba84-acd81661561f", "comment": "Malware payload (AgentTesla)", "value": "ce8d9cfb31fb80cfe7a39e76e7037077ecefd1a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977743, "uuid": "8d1a5054-d09b-47a8-9373-fe422834e19e", "comment": "Malware payload (AgentTesla)", "value": "91212828974172b8177bc0bbcdc5d6332c4e49358b38b6fca36fe3f4e8d8b6763ecbbeb943ce3fc7820d78e6a2a9e370", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977743, "uuid": "1ec2af28-7c87-4a73-9d08-03222fb0629a", "value": "T1A3258D2537CE0F07E1DECF74A475C9B29AA5AC7AA81ECB8DD8D02CBB34517A1980C553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977743, "uuid": "bb682b8c-48af-4ea3-960b-1e4d2e0ba211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977743, "uuid": "b3b35175-9575-46b9-b9b0-ab860de7fd47", "value": "12288:gLESzD6V2ZuccGJE3iVnhSxNLJEogZ2k4A4+w8XYfXYi2pqlT+/xyh0Ju4C++:g9J+iVnhSTLJE9h4A4QXdylToEhYuy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666977743, "uuid": "bc005f7a-24ff-4fca-a183-83f5ae1b6b64", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666977743, "uuid": "879f2a79-0d7a-4d81-86a3-7f772bca5ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977743, "uuid": "8cfa6985-248b-43ba-a55f-7cbb82d6ee16", "value": "BOQ and Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4f487b-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943664, "uuid": "e7b9a3b1-08c1-4b23-b19e-9394739c0456", "comment": "Malware payload (RedLineStealer)", "value": "2c88309f2633bcc5552032942df175fa", "object_relation": "md5", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943664, "uuid": "44463d49-4872-45c0-824d-6ddd225b1731", "comment": "Malware payload (RedLineStealer)", "value": "8c97d2b4ccb894e32129aed7f3d0cc6874ce97ca6ff9bf35c8db4fb5f61c0700", "object_relation": "sha256", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943664, "uuid": "952d953c-59aa-440b-93eb-9411248ca4bb", "comment": "Malware payload (RedLineStealer)", "value": "76c5d6d91a41de928b56dc41f61af4ca0e8180ae", "object_relation": "sha1", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943664, "uuid": "999aff4f-107e-4852-8385-89288cabb223", "comment": "Malware payload (RedLineStealer)", "value": "682af34b1ea6ca6b71abc910af93cd8f54157dd95983e6cc0c254f2bdad5b956f31209c49e951a6739e02cafe6cf62ca", "object_relation": "sha3-384", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943664, "uuid": "aec2f803-e36d-4e8b-8af2-075bdeb26dc4", "value": "T142463343D19C3DC3C2AD610D9681AA6F39CD41F97B986771B7A7F370E222C8E49431A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943664, "uuid": "1d56a261-1e5d-4fb9-add2-1c8ff7e4d5cd", "value": "98304:ki1YcZHiRCnThzeRsUNav2PbkSRNhpL0ohNMDsLgv70CfIaGTrLaf:kiWcZCInlCRgwgmNLY3Ycrf0+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943664, "uuid": "70566ba3-4146-4c17-831a-b65e1b4c3ccc", "value": 5470030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943664, "uuid": "0a157c65-dbe9-41af-a277-cb5fbab23ea9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943664, "uuid": "bdaccfe9-f96d-49f6-bcf2-7beb9a493930", "value": "Setup pw 1515.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ad6a3c-56b6-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666957789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957789, "uuid": "691f7b70-fad0-4444-a128-a5c4c0947263", "comment": "Malware payload (Loki)", "value": "10215dddffc086202b23f3069eb14a1c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957789, "uuid": "a9892e81-2e1b-45ef-be2b-dc496ec6ea48", "comment": "Malware payload (Loki)", "value": "8d3ead1a4149580c6019ff682e2e77c40391cb01799aec3d25f1c7e6d369517e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957789, "uuid": "bd1d55fa-2f91-41cb-95d3-99a0fe4e4fd4", "comment": "Malware payload (Loki)", "value": "a93ef33d7b7aef8b2e4296e6644922dc96393e70", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957789, "uuid": "c159aca5-c59f-487b-aa7a-7a58ac749e05", "comment": "Malware payload (Loki)", "value": "b4c1195a592acbca0bfeac2419c9f32ec2c9418e3640f5a6bb07593a4908476ff88d6aa0ce9695e3fdf37711a8876834", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666957789, "uuid": "4fe9e7b5-6504-400c-85e8-c7a067c3ede3", "value": "T15874016D838F85A8CF54A773531A4E0942FCB33EB6055272B86C933137ED92E1AA157C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666957789, "uuid": "52f8167a-5020-4dc7-8419-c2908612a62d", "value": "384:OLJshTShevdvGyuRx6KI8y9d+v1ZsPWWJZ:mJshmhevAyMx6YZaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666957789, "uuid": "be782651-b4b4-4564-af7d-98d3141f88ee", "value": 367603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666957789, "uuid": "85068cb1-0353-4091-a976-a18e72c32c3e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666957789, "uuid": "4deb0c05-1d33-4244-bd8d-04e45cdffd76", "value": "New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcd6172-56e1-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666976088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976088, "uuid": "178bd995-d746-4f47-a0e8-4b8a4afe9216", "comment": "Malware payload (Amadey)", "value": "33679a6953e16d206b6c94fbea4f92fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976088, "uuid": "c874133d-e6d4-451c-8479-e7d8fda48d62", "comment": "Malware payload (Amadey)", "value": "8d5784cc80c8a083dffe683787b82c8d770c78c95f7f51b942d3a97ca5dc0c8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976088, "uuid": "3e1c4f5f-cb3b-4972-88ac-01956f0d383f", "comment": "Malware payload (Amadey)", "value": "ac991e8ba7d59ccaa89a94c7431dc08c8837c91e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666976088, "uuid": "1e201fe6-ddb4-496e-b5a8-4a0d94b58864", "comment": "Malware payload (Amadey)", "value": "330a12d3fb98b078cd4bfed2ae7d912d5ccc00e1eed86667863abd47ab4c725194c59eed817fcac487b70e0ee3e42594", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976088, "uuid": "0dfccae2-3580-491d-b142-d62ea272f398", "value": "T1BA54D0327593D572C09711F4442ACFA12A7EA83019608A7F77A42F6D9F7338095AA3DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976088, "uuid": "fda20c1a-86ea-42ef-9e88-67f7e8b7e9c7", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976088, "uuid": "319d5c23-90b1-4b66-a5b2-3fae2d0e2b1a", "value": "3072:iXO9BH8/LUcAnRIUGDmj5ntvcUj8A4F5SrLLHKhrOy59DTEE045345f2GCtM/h3i:ikBHeLUbI/DWUUE5SrShCqtT504ZaCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666976088, "uuid": "91ebacd6-b783-4ad3-89b7-19196d44e8d8", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666976088, "uuid": "f0a75f92-4ecf-4066-858f-140fa82186e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666976088, "uuid": "a0939060-ee8d-45fb-bb67-592f48f37741", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440097d8-5679-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666931435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931435, "uuid": "8cc737e6-fe85-4bc5-bd2c-b341d6829aeb", "comment": "Malware payload", "value": "c515485d307962cfe0067711cb2a717f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931435, "uuid": "42342102-7300-4b7f-996a-e4065beef3fe", "comment": "Malware payload", "value": "8d7c7bbca31f8638103fcdf0c3ef940ce7797ce7d1f0b4fb124bf528538814c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931435, "uuid": "53f3e8f6-ab01-4937-8a8b-fb88aa574134", "comment": "Malware payload", "value": "5eb3584a2424f613d984d2c99c5e53f741e605e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931435, "uuid": "97af3168-be46-43ec-9b8c-7452ebcc402e", "comment": "Malware payload", "value": "1b9d66bc887a138aba8d5928986c0ea95156f9c82bb8865319f3127e95bb12e291467949fbe9dfd36b6a3e4b6fda97fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931435, "uuid": "67cfc748-fab1-415e-8cfd-8e6d94b7dabe", "value": "T1F776333135D3467CE4B7057347F81BB9A1E9FA641A312D87A7EB8C296D3DB22C116A0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931435, "uuid": "f0859b46-1c40-4c80-91ec-d82617d7fde3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931435, "uuid": "02325d60-8c68-4e0d-8ef6-e1029c5ac6b0", "value": "98304:91OSX597+Q0IGLPVjhD5o+0lhqTj8c0+AVGwTq9icf/hOXRNwfn3es63VvJU2tdn:91OO7+qkw+0cjf0pVGw+cKPtKJCtHFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666931435, "uuid": "d55da641-996d-4eb3-8e4a-ffd1b164ef53", "value": 7641853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666931435, "uuid": "df049739-f839-4cdb-b6ca-68f55330b464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931435, "uuid": "4a5a3220-4721-4641-b17f-ae6db8234f7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365aafdb-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666949450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949450, "uuid": "29732f3e-7a1f-4e4f-89c3-746c1e392851", "comment": "Malware payload (AgentTesla)", "value": "a4c016e6740a69b2cc032760009499ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949450, "uuid": "86394369-a659-4d0f-983e-73883807542a", "comment": "Malware payload (AgentTesla)", "value": "8dd3c68c3daf80083bf06fc30af657798c44ed65b9c857110813930b0543d236", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949450, "uuid": "9187f615-a030-4f71-a7de-29328b49cfc3", "comment": "Malware payload (AgentTesla)", "value": "31106d21447cf0500944b408430f24c1e92f91d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949450, "uuid": "c765f14b-51bb-420d-a7d4-3929142544a0", "comment": "Malware payload (AgentTesla)", "value": "b652aad105c0921e19d6117995d4f1024a3a6cac1166476053275989161634490e1c8eb4796eb084b1fa3fdbd2f1fe19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949450, "uuid": "9e17baa4-9073-4a5b-99e0-ee2cf0092b4a", "value": "T108A4DFA1E355ACB7DC1A13B68D36CB11622AFE984AB5421F651EB5211DF338330E3D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949450, "uuid": "513dc3d7-d208-485c-af58-42a586a85582", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949450, "uuid": "1ad932c4-41c9-4446-acc9-c033679e5303", "value": "12288:EaQ5+i2/JHObKzP1gQa0IfSLk9ifJofBA+mHfZNVxUkI:En5+VlObKzKQHLgixofB4//I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949450, "uuid": "9b086473-b03c-4453-ba22-14bdf2c7a0e8", "value": 467218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949450, "uuid": "8c94a519-1bf6-4646-8af1-34280c8564a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949450, "uuid": "5592e088-360f-4318-9387-e913d5cf0421", "value": "a4c016e6740a69b2cc032760009499ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24652be-567d-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666933445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933445, "uuid": "27e420c5-e4a3-46b9-b7e0-1ea968ec3f8c", "comment": "Malware payload (GootLoader)", "value": "b62f225d08f0f5ad33a69e895fca38de", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933445, "uuid": "19a59866-b4e1-48ab-ad88-c6246fec126d", "comment": "Malware payload (GootLoader)", "value": "8ded495e61f81615a058fe795dd691dc9a2ca62d9cd5587d1e0b8326ac382eaa", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933445, "uuid": "fca2cdb9-219e-464a-b053-ab302f37d6c8", "comment": "Malware payload (GootLoader)", "value": "55ddcecd3539d6e40c805474733e78753a3333f3", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933445, "uuid": "99c4596e-ae52-46b1-90d8-ab065c019887", "comment": "Malware payload (GootLoader)", "value": "a14275d15de06f0a29f9e22a79638c3cdfdb6ac7545c583fd85f8046cb9d56cf045c4013318d8d0894a958cff12f8675", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933445, "uuid": "011f4fbc-714e-45df-b6de-e52b59e0407d", "value": "T158A2E199AB7C2931CF479960E9BB878D0C482491C3FC392946A7099DB10E09F1A77B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933445, "uuid": "e77c3753-b0fd-4576-bfd9-d99e19f09af1", "value": "384:PlZ8T38f6knDNZsU8s3+MR+2MVEJBu2xN0e0XYctyjEi7XB0BNA6ju14iY:NRDou8VEJBx0e0XYsi7sA6jU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666933445, "uuid": "c65ecf7f-3a53-4ec6-a4ed-6e1101b6f6ad", "value": 22291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666933445, "uuid": "f3508880-71fd-42fb-988d-8e02b88acf99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933445, "uuid": "69a66888-eba6-4601-8fd3-5ce091c75b86", "value": "Which sentence has proper subject-verb agreement (97168).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700fbf37-56da-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666973170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666973170, "uuid": "5a878724-a069-4a86-ad37-dd545151eb83", "comment": "Malware payload (GootLoader)", "value": "d248b5b42a69cfdaae01cbea5ca281dc", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666973170, "uuid": "5229c207-2000-4fb4-9b06-5c3d3c9c7988", "comment": "Malware payload (GootLoader)", "value": "8e472d2f79707c938ec9aebb6c006d2ac4734062866dae5ccf1536cef7aab508", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666973170, "uuid": "fb7655a9-0cae-4822-8958-e53ed61fcd6f", "comment": "Malware payload (GootLoader)", "value": "2135604a5dcb830ce4a1d57764f64c66faee3f48", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666973170, "uuid": "eae5fffb-09c1-4bf1-b72c-df79827ab19b", "comment": "Malware payload (GootLoader)", "value": "5cd41cd98593a132ecfcd8cbbed2db154d140822147215391e5d666b71c7a764f5b817d78d5135132025c5180d57d162", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666973170, "uuid": "1d713f05-8152-4492-bc3d-dfd6b2dba485", "value": "T119A2E106072BA35E855334E0CB3B72CDA1B0D99EE5C97F46CAADB0BD025E500A4436DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666973170, "uuid": "ef679498-0eb1-4ee6-bb51-3098f6ef0410", "value": "384:exAdx701JLFPg5ex1jgG4t7N30EZ9G6bFQTpuMelmIwxYbvWG/SVSw3oRZ:eW8/hx1UG4tx9bFQTpuMyvy3ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666973170, "uuid": "a1b9abe6-956d-402f-a2cd-38523b3b24a2", "value": 22410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666973170, "uuid": "36691ae5-4ebb-4ce9-93c2-853dfb2defb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666973170, "uuid": "2705d0aa-de80-4cc3-8d9b-63a7efd3c5e3", "value": "Which sentence has proper subject-verb agreement (18173).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1f5f3e-5699-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666945269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945269, "uuid": "f728efd1-bb85-4c1d-b21f-151fd47d8002", "comment": "Malware payload (Formbook)", "value": "26099a1f699dc43eb938f3356987d24b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945269, "uuid": "a3f0e83c-8be6-42b5-88d7-b3e0432a7489", "comment": "Malware payload (Formbook)", "value": "8f1d42fe6c8fe68559531f7f8184b92db752da85c931552200d22b5dc4fb45bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945269, "uuid": "a4d30f21-0cfe-4412-bb9a-0c7a00444c0c", "comment": "Malware payload (Formbook)", "value": "f9e82988018f5bf0734eb7fa1605f20704e6023f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945269, "uuid": "53e470b7-68bb-4ae6-a967-ae9561e67678", "comment": "Malware payload (Formbook)", "value": "889e131ecaa2747772f0de1be6663b92bc684d5effa7cf84aed65d41aa1d4d3bd5c8ab3bfd56dea086d191d84246c57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945269, "uuid": "f88ac626-d96e-43ef-b280-d4462a8e3dc3", "value": "T1FAC42372B3117137CBEB2775151B6A2CFB7A5780FDF0906E4A49790E08E4E09930AEE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945269, "uuid": "e04292dc-a079-4d6e-84b0-3565c9c86c12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945269, "uuid": "3e57f874-a8cc-4580-a000-a63d37a13944", "value": "12288:Ph7vPdzw/w2rxhR+pGKGpAle6PZ0v5ATlxTiJGEyL:9e/w2rfR+pGKCAMuTlxTiQEyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945269, "uuid": "6fe694ea-5e4b-4ca7-8ff6-b13aa1d1663f", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945269, "uuid": "bd095c47-2dfd-4ff0-b2f0-8bac0806e153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945269, "uuid": "4fbad9db-f137-4d13-9888-af267c734d0c", "value": "SecuriteInfo.com.Trojan.PackedNET.738.28728.9843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf59abb7-5689-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666938540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938540, "uuid": "7f55ed8d-d4f6-4270-ad37-cfba6e3ac254", "comment": "Malware payload (Tofsee)", "value": "3df8f7b50f85b7238cce1e2f44472462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938540, "uuid": "accb915e-1e4f-4fda-b02a-9adba0a22f49", "comment": "Malware payload (Tofsee)", "value": "8fcd9feefb86d07c1b696f34912b15de9000d7889a7ea842c66ddd6eae524d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938540, "uuid": "0a89f9b5-dda2-447f-85f2-2b75c681b73f", "comment": "Malware payload (Tofsee)", "value": "1a8796883a00f64f98f7112a9b0aeed1ca713bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938540, "uuid": "c591f2ba-b270-438d-9aad-f93f2e3de1f5", "comment": "Malware payload (Tofsee)", "value": "b1f3aee27db60d0251367a76592d0cf013ec584b3e2d111408e2eee9eeee773a50aa0b2481b35d35305da2b128a3dcc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938540, "uuid": "7144aaed-1107-4778-8510-29eeaaed8c2b", "value": "T16344CE317692C471C08526F4443AFFA12A7EFC311961498777A8375EBEB23C1AA6631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938540, "uuid": "b08e43b2-930a-4dd8-9ebc-866bc70771aa", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938540, "uuid": "2db7a9f1-68de-4d31-84ab-6f0a3201444a", "value": "3072:qmJXORHAtLqcTAAgRIGIfmlk584Qxn+WaIMzIb+YZvRZkSjxQRCQuS81mguM/h3T:Ht+HkLqcSR7IuYbWF+mVZvRZkGRScgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938540, "uuid": "7b575878-df84-4b09-97d5-a296e9cd9eac", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938540, "uuid": "1314ec02-8d91-4031-820e-5b23e52862e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938540, "uuid": "3112ff13-6818-47c7-88f8-bb85ca673a29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ff4615-5692-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666942182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942182, "uuid": "2271427d-89ba-4702-a9be-c10b06dac8dd", "comment": "Malware payload (Amadey)", "value": "bfacce53f01ebd06ccba44c280e9655b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942182, "uuid": "28598de1-00e5-4f52-bf5d-57c39f6eb0b2", "comment": "Malware payload (Amadey)", "value": "9137772379933cb1eabc47531789d02c49330f84c3e4881e9a9817978f2ecaf0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942182, "uuid": "bbd9b374-b650-4890-ac31-34b61b1785d1", "comment": "Malware payload (Amadey)", "value": "bb96b08d9384307726f4f793d12182494b695ed2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942182, "uuid": "44b7324b-d9c5-434f-8fae-485f22d2c2c6", "comment": "Malware payload (Amadey)", "value": "1d235ba50abfafb903638ac14a846799b28762eb449a991c36b179e22a43311e40ab73f91aecdaa4724a172893cb954f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942182, "uuid": "695395d9-8cdb-4f6f-901d-46857ed9cc0a", "value": "T1C3357D1BA26501BCD4ABD178CA275A47E775740603309BEB17E05AAA3F13FE16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942182, "uuid": "331a7887-cffd-43b7-9a42-66f5afde44dd", "value": "ac2df2dc7c630be615074ad7752202c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942182, "uuid": "a3c865cf-bec9-4a2d-82d8-be9a22a31d5f", "value": "12288:wjfbTkHXzJxX+my1Rplg62Orw+dQUYMDRTulZwgs0TRPcANHAgoFTWpJgg2PE:0fbTEX7p62Orw+d/zF+ZwgPDNHXxWg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942182, "uuid": "395c9f46-d798-4de3-b411-4ac8aa4a6e4c", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942182, "uuid": "941b6c30-72b4-46ef-ba7c-f5c5e62cea7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942182, "uuid": "111ea27e-cf33-4e2f-9ad3-6143af19618c", "value": "bfacce53f01ebd06ccba44c280e9655b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01418c5-56f2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666983639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983639, "uuid": "f4791a41-e633-43b3-b39e-9f2ab2c327b4", "comment": "Malware payload", "value": "6ecf287cf8d64e1efb5282166ca5c848", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983639, "uuid": "d70fbc7e-9d58-41e8-a14f-c4c92e86414c", "comment": "Malware payload", "value": "91c9e06e0ff399a4eff06cbd2a5512a6144af70de685a26239b02194412faa28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983639, "uuid": "c8134291-2332-4ec9-b425-6a20b03c4a38", "comment": "Malware payload", "value": "44c04b9927d0ff82901205d53e274369a1dbcdc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983639, "uuid": "ad518cd1-b8be-45ab-afbc-76ad8f5f7a1b", "comment": "Malware payload", "value": "fe76b9b487e256688776f54279fd26ec7b853333711032ada955c19bed1280e1677780dc41237d4d479ece2cbfa13357", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983639, "uuid": "6ee6f3d0-5644-444c-be18-ddc53de6b078", "value": "T145937C59F5804ABAFA71407164EBFB7A827FBE281B1D1CD3A458364689325C317323DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983639, "uuid": "c7f1abd6-c62e-439f-aac1-b42bfdf79fd9", "value": "bbe50c736d38300e4f4288101e19a7c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983639, "uuid": "f4ada544-1986-4416-979d-642aa53531c0", "value": "1536:oDk2FTfrEMFyWXHuQlrYesejnPRq5xemr7kwTmB5j/+mQ8L8Ev:oDk0rhFTXuQegnPyecgw6B5D+mZL82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983639, "uuid": "01425a7f-1bfe-4393-b886-325e0089441b", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983639, "uuid": "ae6e8009-02ea-46af-a845-9bd838c41855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983639, "uuid": "937ef29f-2bde-4adf-883e-d5dded326d60", "value": "6ecf287cf8d64e1efb5282166ca5c848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60400411-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994618, "uuid": "c6cb6d34-ec73-4ea5-9072-0a827d39d6fd", "comment": "Malware payload (Meterpreter)", "value": "d5f0a0bf41182aa382b53c9758588086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994618, "uuid": "2537a802-eceb-455e-93d4-4afdc880cce2", "comment": "Malware payload (Meterpreter)", "value": "9224242dca841fb727ce700da0ba64ab303698518d10a7d6d250805142d3cb2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994618, "uuid": "4b90841b-dd11-4f93-874a-30f7ee545353", "comment": "Malware payload (Meterpreter)", "value": "55551e53d43f213fd0e48b5f986935d86c1f4f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994618, "uuid": "530c878b-66cc-4ed2-ac74-b4456b648a76", "comment": "Malware payload (Meterpreter)", "value": "1f11ed5d0f8263dced7fc416b0b1dfad88b9bf898b5e3b12f065963dc285b0637bdb0eb37a4793587d4262ebfd8b242d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994618, "uuid": "d2dbf90d-4346-40bc-933b-1a2efb1760b6", "value": "T11773BF42EDC05026C1A2213D67763F7599B5F1BB2245C1DA7A8CCDE5DBC1CB0A22A7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994618, "uuid": "eb5c6253-cf7a-482f-bcc2-d115df1bdfc6", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994618, "uuid": "75cb2eb5-f774-4db3-b3c7-3125248f6c6f", "value": "1536:IodRZPHESxZeQi4dL0XfXvZVyLMb+KR0Nc8QsJq39:THVLiakXvZVyLe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994618, "uuid": "8098dac8-b4b1-40fb-a319-98ae5aea6776", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994618, "uuid": "dda05c25-c0fc-4d84-b43a-4e287759ca82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994618, "uuid": "b66c8134-2ad8-42d2-b959-0f2dfe798e00", "value": "dox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9bfd82-56b2-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666956061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956061, "uuid": "568e832e-1422-4987-b89f-1f884ad22c0b", "comment": "Malware payload (RecordBreaker)", "value": "4d41b46f525fc578a052c2bacfe98636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956061, "uuid": "ddb6a019-b9a8-44a5-8245-6a52168ac0d5", "comment": "Malware payload (RecordBreaker)", "value": "932156e94f720df6981fcba817e2ccfbad3165c19bf5cc81e061d7de665d6673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956061, "uuid": "40295d5a-d236-4db3-8493-e511ecebf897", "comment": "Malware payload (RecordBreaker)", "value": "7438be1e4480ffcf0462b5ad4f6fe6d53d9241dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666956061, "uuid": "215802d1-d1fb-41ff-8576-16b0705f427c", "comment": "Malware payload (RecordBreaker)", "value": "09313807129b7f433c74799f31abc21d77fe36731f777bd8d512225d8ac7a9d1fd1d9c10b9e9ba7c15b83326d150dfec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956061, "uuid": "263cdd69-0193-4461-85f7-850268e36164", "value": "T19B761237D30510B4D5939932C52FFE77B7B5273A8612AD3BAF8ADE883433492B845252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956061, "uuid": "d048de2a-604b-4f47-a1a8-3a792862e3d5", "value": "d595c71e053ec8d7be452fb016a19859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956061, "uuid": "7b3d9b2f-d4c1-4629-b1f6-19c944eec846", "value": "196608:0AAnL7oGD2B0IiIAGxY8gkScFv6yMrFJQ:0o7iJ2SWEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666956061, "uuid": "e6dacb7c-7d89-4b18-b619-7d4a0cd5b476", "value": 7810048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666956061, "uuid": "358f7a26-7907-454a-9412-e2a89b6b492e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666956061, "uuid": "72188761-7614-47ac-a564-bc62b8bb83b3", "value": "4d41b46f525fc578a052c2bacfe98636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef67412a-570b-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994429, "uuid": "e45f98bc-1737-4855-a55d-17e2e234ccac", "comment": "Malware payload (Meterpreter)", "value": "2b75c349e90df1fc14b38873992ec3af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994429, "uuid": "08d3f5e5-189f-4a29-b4fe-730d5ce8d2e9", "comment": "Malware payload (Meterpreter)", "value": "93740b8631c4af3ccbe2cffec9e5e58618d3d026de003a44994882f302c27731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994429, "uuid": "6e8dc725-2c46-4a76-a88d-7b782784215b", "comment": "Malware payload (Meterpreter)", "value": "a0f05da4dc376499f17907bd5592f26aeaa8ca9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994429, "uuid": "c7a1806c-af4d-4bb3-b793-7a97a405e595", "comment": "Malware payload (Meterpreter)", "value": "dc1d0753cf86d36f698f31cae4758366af3674cc4df5650ddf1bed0b36f78032630f24d26da8dbbb7e0347a4180e3766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994429, "uuid": "52761307-dc4f-4b32-bbbc-3632deae2442", "value": "T19373BF43E9C41466D261123D27B12BB559B1E5FB7611C19A368CCDE4DBC1C70BA3A3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994429, "uuid": "b6d4c5a3-4107-4f79-a7bf-abed46256dfa", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994429, "uuid": "5b770bf7-8578-4e34-9943-07935142a354", "value": "1536:IsAAj7oLMwd2+b4AmAsETv0Q8/KMb+KR0Nc8QsJq39:Joh7mA/v0Q2Ke0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994429, "uuid": "d4236381-7879-4079-ab5e-78f56fcd6199", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994429, "uuid": "60b1affb-a11b-4584-a789-b959d28f5a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994429, "uuid": "cd4c23f4-8e5e-4032-a6da-99c09d825ea3", "value": "tornado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e74de67-5698-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666944740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944740, "uuid": "36240a1e-c57e-4404-a02f-90b01430d185", "comment": "Malware payload (Tofsee)", "value": "9c45d687197b08b27b615f1a519ce00a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944740, "uuid": "33a634c3-89da-41cc-a096-ee4d212bab87", "comment": "Malware payload (Tofsee)", "value": "93e5b7e354cef9fd9cff41959a7583a7607c31eb54b848a4ab23af4b11c3988f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944740, "uuid": "840a793c-f143-495c-9464-d41b65ff1a95", "comment": "Malware payload (Tofsee)", "value": "7cc77024cb1aa360a1dc76a082c45da0cd5c1da5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944740, "uuid": "bfb411d5-e8a0-4d01-92b9-2d1c7833a932", "comment": "Malware payload (Tofsee)", "value": "9c43736a03a375d932d22c2bd11c852bdf71820c421f7713558c2aeae3deef66b350b61ea66c586a22626c4e19838986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944740, "uuid": "f0bc1ce6-5e9b-4ade-8a25-16081ff0daf6", "value": "T14D44C03276B2C471CC452230443ADFE12ABFAC3169714A8B37A4276DAF75391A57631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944740, "uuid": "a7576047-58bf-459d-b5b4-2de45465ce9b", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944740, "uuid": "17f56ed1-1dcc-4a95-90e6-701d6f74a055", "value": "3072:XPXO1HLaLOhSAhpIwG7dVZ5Va6GG2Ztdvp8A5zCd8wfw6pRqusY2u+CPM/h3CU7:X/OH+LOhXIz7dq6CZB8Zd8w/8UPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944740, "uuid": "ca99b3d3-3f82-4e1b-bc5c-7d9670825a75", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944740, "uuid": "3b89868b-662a-4746-b080-8e4e3f4c6344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944740, "uuid": "3de273ec-e366-450e-8eb9-9aadf9b1f1e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0496f07d-569f-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666947649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947649, "uuid": "ac8365ce-c9a9-424c-a9e0-400e2a7a5a60", "comment": "Malware payload (TeamBot)", "value": "55cc2eba27a491218b7d57649241f550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947649, "uuid": "d3516828-ef12-4928-a729-d44c75bf10b7", "comment": "Malware payload (TeamBot)", "value": "94b22b3c399530aa0947ebd4dbcf710e76c67aa8355c18618a26a750d143442d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947649, "uuid": "a9bf5928-6a7a-4be8-84cc-c909c88821e1", "comment": "Malware payload (TeamBot)", "value": "2d60cd3f6f1f987414a5de5d28e84036657a4559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947649, "uuid": "7efe9600-d96c-403b-b0e4-d0eff3820684", "comment": "Malware payload (TeamBot)", "value": "28f2c59d1653841e500ebd9225c22bf588274fd1462d676a66c736ec5c22117868527d0c391d48921e9ec85de05dac21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947649, "uuid": "089bea71-0136-47e3-9de2-ff6f9e1d7b6f", "value": "T18944DF317A91C472C0451E30442ACFA11ABEB8311AB5494737A827EEAEF13F196677DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947649, "uuid": "727cccc1-08ab-426e-873b-7210763d78dc", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947649, "uuid": "56913a69-742f-44b9-baac-450f95950d1e", "value": "3072:1dXOEHv2LfWYAUAbIGWdVZ5tFB53ahr44NvU7O5pjyj4rGFztoMRxMt3M/h3CU7:1ZfHOLfWnb7WdBw4i/XK4czOMPMVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666947649, "uuid": "3aed37a5-a3f3-4f34-8bcd-4600ff2f7ef5", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666947649, "uuid": "9649a6df-f20c-459f-98b9-6531d71b9f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947649, "uuid": "eac9ca9e-50a0-45fe-8109-9f8698bad2e1", "value": "55cc2eba27a491218b7d57649241f550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcd69eb-5671-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666928203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928203, "uuid": "afcdf785-2aea-44d9-b313-4c5c73144231", "comment": "Malware payload", "value": "486b0b890f76baefb7c2c19081a0a522", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928203, "uuid": "20ed5577-de58-4147-a681-a940e5226f6b", "comment": "Malware payload", "value": "94f8a5624cb3f222aa4f681771514ed373478256d4aacd246a9c8de1f036bb9a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928203, "uuid": "2b040498-7884-4c5e-8d6d-246304147f9b", "comment": "Malware payload", "value": "ff0bd42969476bf3b2b45d0fcf38d4f7a705efa9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666928203, "uuid": "2f544cec-41bf-4f30-8b46-635ef1e84333", "comment": "Malware payload", "value": "42acd0d0351e54e5ae58ab0a5044cdd81191221f8789640558e2a0b9a9d350c74e9e31fb103dfd0e7cca62a23517c690", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928203, "uuid": "443a22a5-ab56-4bd4-bb0d-4e7efe7aa438", "value": "T1DAE63382F7D9BD2FCC7380324BB5167661864C5ACB13E2436965736C99F7AD08E81BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928203, "uuid": "a80bdf2a-cc89-4aa1-9eaa-89a345a63086", "value": "393216:imaBC9u9O4X9uGtUNCK54bOZkLx0hb2r2fZRpoR6:mBVc4X9uGtUXzset2r2ffp26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666928203, "uuid": "a7f5bfd3-78bd-44c2-8cc4-14df5867158f", "value": 14004085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666928203, "uuid": "46f3b0fc-1189-4751-b250-492f8ff0c8d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666928203, "uuid": "28a1697a-7ad7-4387-9cb2-23c401f73bc5", "value": "94f8a5624cb3f222aa4f681771514ed373478256d4aacd246a9c8de1f036bb9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19b612b-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666949201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949201, "uuid": "c571f253-f80d-4319-8508-5ddfd7301b7a", "comment": "Malware payload (AgentTesla)", "value": "dfd930a7c36216d310790b32ccef6c29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949201, "uuid": "a1df9377-f8be-405a-be93-c1f519291038", "comment": "Malware payload (AgentTesla)", "value": "94fe39bf350541415016932b9a09fd8027348068f1b94e2ad5f4fac80e7c3823", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949201, "uuid": "ad990706-08e3-4eea-a3ba-77c0ac98f5f8", "comment": "Malware payload (AgentTesla)", "value": "6dff7fa5212506d43b7a9c85985d267af7169d89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949201, "uuid": "b24c4666-f6ec-4c2b-b8a5-cee61dec4b4b", "comment": "Malware payload (AgentTesla)", "value": "ea488a9b3ea6c9ca829a7afe3b80b06cb74521a1f65b3ccd29713f5018b29630f3d6ae6a7a8d04bd2bd5c52f271cd615", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949201, "uuid": "ba6f1f3f-a2ad-4636-bc6e-e61f3ab0f669", "value": "T168C301B8367063CFEC6A03350E0D56B395655E886B2B9330FC8DF62F89735A8B144A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949201, "uuid": "918c0afa-40cd-468e-ba24-e87527466f22", "value": "3072:CuJejcsJ9S9gkeKAjaXyoaRZ0ysJmkZ3/:qjl9S2S1aRZ0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949201, "uuid": "79eac891-be79-48f7-96bb-0508bc298b2d", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949201, "uuid": "f9d32ee3-820a-4448-9d62-e0509cc2584f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949201, "uuid": "dc12f25e-48f3-40fc-8465-ca97418fe8df", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462c2111-5697-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666944323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944323, "uuid": "ee8edd5e-ac0d-422e-8292-a42b3daa2df3", "comment": "Malware payload", "value": "ef527888050e5384b5011beac2f840a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944323, "uuid": "ff196130-a3c2-4f52-93c2-a3819b902a50", "comment": "Malware payload", "value": "96aacd88063e79757441e9b96ec3c6bd4e6e2555c916cfb6db1527384425430b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944323, "uuid": "40cf6337-6be4-4116-a47b-34373c5fd842", "comment": "Malware payload", "value": "2cbf904da064e244285fbc5537aa81324e67bbc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944323, "uuid": "c55e8a14-62fe-415c-843c-7a6a98f6ea72", "comment": "Malware payload", "value": "c73ffed72a8299e0793456d73c8e6006bed971c897b19801bb8d23fe73c32e9c97a751734f7af6435708e39fcada432e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944323, "uuid": "59f4173d-b7d4-49cd-a408-47819f317bb7", "value": "T12A055E593A0749B2FD4E01FCC3213D4B5F70DC6AAB3492E63961D4C9AA4E543AC9DC8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944323, "uuid": "c8539cfe-46ff-4eda-a481-dab018bdc21b", "value": "12288:qxq452L1bjzMVwaVfo1hC4hHTUt6WBkKybZt:qxqcNVbVfo1M4hy6P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944323, "uuid": "0e119311-ee61-4ac1-9adb-0130290551a1", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944323, "uuid": "de2659f4-2400-47ae-9857-7f0970eb0dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944323, "uuid": "dd893929-6338-45f1-97bc-5c47d3719c59", "value": "jRatFerEef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873867d9-5718-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666999837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999837, "uuid": "68a16cda-d0cf-420e-95bb-a53edb36a6ec", "comment": "Malware payload", "value": "fd0a0a97671c6bb36ec16f97960cfbe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999837, "uuid": "5fdcf68a-3628-40c7-a527-627214fcec75", "comment": "Malware payload", "value": "9720072d27e04801f4171f6845b8df94bf0a98c457f73b9884ad2a19192b5488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999837, "uuid": "bd4db7f4-99dc-46c9-85ed-bf83692a6d36", "comment": "Malware payload", "value": "72a5a9f0346c30bf049651c8ffcbeb5922f63301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666999837, "uuid": "5b542db7-fab5-40e5-b4f9-a381bddc75b5", "comment": "Malware payload", "value": "a7c98ada34dafef93a2158d3a6721e9dc35299a1ae49187a74c50da160e2a4d813b46f9f764cbd64d291469844bcd862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999837, "uuid": "df749687-87a2-43fd-ba70-f472742cc1b5", "value": "T186C5333104B0C9B5D1939E720E66C5095B3BB5741F2EF81CF74CE6AC9A1ABE2A50835F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999837, "uuid": "974b2785-32cf-4aad-83d5-b5fb1bf70414", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999837, "uuid": "24bbf39d-5369-47c6-9773-fc5dfb407ae6", "value": "49152:Z2BBKNLjQjFxRrdLOqoeKeBipnWgxMiMkk0A4/7amJxAxA5hq:MfC6FxBdLOnevM9oiMkkJKtJDDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666999837, "uuid": "e42e12ae-7375-4323-979a-b47f5d7b8f01", "value": 2615277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666999837, "uuid": "edeacc84-1bc5-4d70-b704-d97cff46eb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666999837, "uuid": "56c394f3-d31c-4970-9f89-ee3320c6bc4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69901961-56d5-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666971011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971011, "uuid": "4cd7d025-76f9-4b22-908b-f5d670cc8ad6", "comment": "Malware payload (RedLineStealer)", "value": "e2e6d49396d3f190ee126f4b8bc08d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971011, "uuid": "7aad2270-92c0-410b-ac0e-33bfea4e1bbd", "comment": "Malware payload (RedLineStealer)", "value": "97b92cb26dc1ea87389f718585be2a5d6e628e5d86f4f028d27001e61deb5369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971011, "uuid": "f2757c5a-6862-400e-81b7-6cab0801e45d", "comment": "Malware payload (RedLineStealer)", "value": "fbcf1e8cc7bff884f86e7b759d31b7cd246406df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971011, "uuid": "c18fb253-f346-45ca-851a-4324f530511a", "comment": "Malware payload (RedLineStealer)", "value": "ae056dcdca85ac80628dbe000162704d1053797d3ac017ce1fe5495e9775c815d79dbbc89904e99176b49100fa5c440f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971011, "uuid": "fb117461-ceef-496f-905a-f151491e8305", "value": "T11A54DF317792D472C4821130C82ADFA11AFFA83515714A87F7A82B9DAF753C1A6B631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971011, "uuid": "89605ac8-6434-4d40-bdb8-9b8eee6a7806", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971011, "uuid": "a6176a67-0936-488e-a7a9-b67c36ab0b02", "value": "3072:mXO/HxWLZ0AgcocGbmj5PnlOUKa/3QswiDbTRCTpb0FoWK3wRYSbR6sNDikOM/hy:OkHELZXo3b2leqQp4IqFRK+YSbRjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666971011, "uuid": "29f859d5-9855-4cfd-ad5f-becfd39f7dfe", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666971011, "uuid": "c287a9f8-0c19-492e-9804-e53fb6f14405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971011, "uuid": "46a786fb-2e3c-4032-a00e-dc2ad07b645a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a053e-5690-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666941325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941325, "uuid": "74d6495b-a52c-4fc6-9c38-797469f5b714", "comment": "Malware payload (GCleaner)", "value": "9bce7ec0c327b7898e6e3caa022caf2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941325, "uuid": "092eb006-53d1-4e88-8fa8-9cc08d570ad2", "comment": "Malware payload (GCleaner)", "value": "987fd3feeeadbccff51ca87873805099e4ba6c008d0d558b3057d2f512e9ce05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941325, "uuid": "2374c650-2498-48f1-8f96-3f16a01530ba", "comment": "Malware payload (GCleaner)", "value": "cedc412476b639648220cad180a7bbac5091d926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941325, "uuid": "4d22c226-b009-4f10-beb3-80391c5a8954", "comment": "Malware payload (GCleaner)", "value": "1e1ebb91a654c0cc93a1a7fcdc85125d23e6c1aa15ba3dcef58e5138425e9aa151b775caedfbfa75d86a2da32a58364c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941325, "uuid": "ea5c2cf9-ec7c-4a29-ba37-1f263ea91049", "value": "T132C5335584864673F095B6B460349E70C4B35762283B8932A1FC7EFF0B7A7D1A096BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941325, "uuid": "b8532a7e-be96-41e3-8b0e-8c3b8e433a50", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941325, "uuid": "b3947d5b-82a7-4b9b-812b-a1d2fe42d941", "value": "49152:Z2Q+5viXLfsF+CTZp3Cb36OhtZ3LTC33pL0GHn+peIDcl3yA5hq:MF5670+CDQh7T2ze+5Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941325, "uuid": "9d07d321-adf0-4105-b85a-b1c02ae47016", "value": 2551897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941325, "uuid": "38400e90-e306-4565-9a31-48f2ca989f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941325, "uuid": "dfef3e81-6129-4f33-a519-2e07f0c473f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c0d46c-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1666937692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937692, "uuid": "88143093-c113-4a7b-97b1-3add5168ca9a", "comment": "Malware payload (Vjw0rm)", "value": "45ede8c10e6f00e3a58796dcc16156dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937692, "uuid": "3588cb8d-4ca5-4daf-ac85-0ba82b196f38", "comment": "Malware payload (Vjw0rm)", "value": "992de29f6d0b52153dbba04a7ca00a64e1d0588e43da86071c3e0affdc294a5c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937692, "uuid": "1ef42324-ef12-4268-8e0f-100b90184ea7", "comment": "Malware payload (Vjw0rm)", "value": "ff51780914234666aceaa29ffb7218e01d82f4e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937692, "uuid": "18b2ee73-95ce-46d1-9939-5a088cf055ff", "comment": "Malware payload (Vjw0rm)", "value": "8403e2dad3baf25ad33dd4b9dec809f478eda7b7e771b6c5562e8dc12fee104f5c5a2dea4a517d501080d9abacf15849", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937692, "uuid": "e20ff3ea-b30b-4081-bfe5-004d065b1bbb", "value": "T1A7D153483EA0D5CD638B57A35D3BA8CBE8652C19BAC4C40DA181F8013994F3E9DF157A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937692, "uuid": "ccfcde9e-9ad9-4d55-ad18-19e4e4269677", "value": "192:uFNBU2BYdlbFgDLjMR9SzFWWL8ULtT6mWPla+m:rknDXMR9Y77Llvb+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937692, "uuid": "1667d8ab-d2b2-4f37-b3d3-b5ede5f1dc93", "value": 6676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937692, "uuid": "7e1466a1-17f4-4b0a-b4c0-b251b2d1c8da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937692, "uuid": "c3ed2325-e37b-491e-a2d4-66be6d1991f2", "value": "wynwormi (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fd8159-56c2-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666962729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962729, "uuid": "61de110d-1f38-423b-b01d-49670d3d609f", "comment": "Malware payload (RedLineStealer)", "value": "1a4d29526e2817f35cb5ddd068a7b73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962729, "uuid": "9db0a2a1-52a2-46ae-93d6-f8a148e75e8b", "comment": "Malware payload (RedLineStealer)", "value": "99b3b23ef0fa2a9751c20b376f84f01968a1828ec65dfb543d6344d8c1f90e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962729, "uuid": "0543116f-6920-4e18-b56c-b91050aad20f", "comment": "Malware payload (RedLineStealer)", "value": "570045fe7cfa933bfae0332f68cbbd60f5722bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962729, "uuid": "a65c72dc-1509-4e32-9db6-cdba8b703b9f", "comment": "Malware payload (RedLineStealer)", "value": "68ce8095adf55f441efc7b26fa4dc8fd6eb23d5adfe0e807c2447201c34273c9ae39c101931432677fecc3807e2ddfda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962729, "uuid": "86a20304-d58d-4ef4-b4e8-8594447e97ed", "value": "T1A58401317582C471C4961034491EDFB02ABFFC3116B14A1B77A82AAE6EB53D158BE72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962729, "uuid": "2d2d8037-965d-4dd2-b70e-e112e024d391", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962729, "uuid": "f1301294-dc41-4e61-b1c0-45985b4ec1bd", "value": "6144:SMBH1LnfD6DMaiwptfAlh8k79mtOOS+RNMJQv/tBjSbhVrmseZMS:S8H1zDuqeNah9EOO37MMngbrmTMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962729, "uuid": "15f9596f-09ec-4641-9562-97b5fc6a3a22", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962729, "uuid": "06085898-e4eb-4216-9988-206ec2cb4a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962729, "uuid": "31293435-7d49-409b-a7c0-82c64e8d7a09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9be214-56a7-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666951288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951288, "uuid": "9f54404d-750a-4bb7-b6f3-e9b273cf187c", "comment": "Malware payload (GCleaner)", "value": "0e6ab85d89a7b1985e0b828288b71e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951288, "uuid": "056fb51a-7add-4c12-8554-fbae4b3d5be3", "comment": "Malware payload (GCleaner)", "value": "9a2a41c6ba8a0c1d9a10d21fb4f9b12a810b05712004c64ffeade432b8376f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951288, "uuid": "ba3d5b25-9858-45ee-849c-5b07a52098d2", "comment": "Malware payload (GCleaner)", "value": "40b9d94b99c517cd0d47abe734585fd2a8ae9560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951288, "uuid": "f6a2f2aa-3d0f-405c-835b-284e71d266c0", "comment": "Malware payload (GCleaner)", "value": "4c128f07e750600af0015fc23b9411648f5dca932460266ca030eb835a9594b40482a7aaacfdc1066af34b3b9a406e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951288, "uuid": "3f19aa10-b8d2-4a67-9895-fc4f398186da", "value": "T1F0C53374ED26E1BDD0D69D3A9920CEC0CF716D91493C0919276C8FAEDD6F9D44C8A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951288, "uuid": "174a00e3-c594-46ea-a710-fb9b1a864a23", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951288, "uuid": "b1e85b20-8d6f-4745-999d-a4401ed632ea", "value": "49152:Z2Z7zzH8bN+OcyL0IsdqAZNwYNUngTa7hhLLrpv/rtDA5hq:MJzH8b4ywBq2NwY6PFrtkDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666951288, "uuid": "5136eed8-dc38-4d2d-87d0-a63ecb7cd17a", "value": 2635290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666951288, "uuid": "a33f9c5b-e902-40de-9062-e36fa738b7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951288, "uuid": "9531a23b-03f8-410d-ab17-68550ba62329", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ee0dc1-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666948938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948938, "uuid": "68edc22b-e41d-4d85-a823-7a996608e16f", "comment": "Malware payload (AgentTesla)", "value": "d4d7cf1a4b59024418280e0747bdcf52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948938, "uuid": "e5a8729d-297e-4172-93ed-e39a6285438a", "comment": "Malware payload (AgentTesla)", "value": "9a30b1945f6e1618fe5f8c8ec8621d921574668570e48dbee58433c683c53658", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948938, "uuid": "77b3693e-1a91-4ad6-910a-cb8cfce14642", "comment": "Malware payload (AgentTesla)", "value": "ae0b99564ae1b3547315e447eedc687b4ea2afde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948938, "uuid": "5887ba8e-66cc-4c47-8cab-d14be7f8699a", "comment": "Malware payload (AgentTesla)", "value": "043c5a63c9db5b9491a91b09a85848d8abcacbe7d204a739d516548f7ab6a38d9954af2813b0da945c878f6db68329d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948938, "uuid": "88eea30b-f5fa-4488-b4d8-82d6761303c2", "value": "T185E4222B9537D0EACBEB23B359974B10677B910690828F7067AF0CF416E7254161BBCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948938, "uuid": "a3092138-c976-4295-90cd-3a130d918c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948938, "uuid": "b5e26b6c-f33f-4f1a-a43b-9388af2da1be", "value": "12288:Apph7bCXNBCN9AIsnzvRS1U4t+DPR0x9htnNRpFKDEpfsAIHnc:gN72dS1D+lGnXp4EpfsAkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948938, "uuid": "46c0b8e6-4f87-4afd-ba2c-770daaace2d5", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948938, "uuid": "096da2ee-f7a5-4060-99b9-fc4b46526a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948938, "uuid": "60b83c21-dbb5-448a-aa1b-c7ffd5e5ccd3", "value": "orden de compra escaneada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec6a9b2-56fe-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666988790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988790, "uuid": "c553ec7b-0a4a-417e-8bf7-6898386825cb", "comment": "Malware payload (RedLineStealer)", "value": "e26266240298c7bbd14a7f4bc7acf7f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988790, "uuid": "079b417e-a624-481f-9c06-beeb89963921", "comment": "Malware payload (RedLineStealer)", "value": "9b6e10183038e8b5b96901589e3235aae062e7e3d4aab6fc3acea667348734c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988790, "uuid": "cb960207-cedc-44c2-a593-c916a10202fc", "comment": "Malware payload (RedLineStealer)", "value": "0a5e0aa4926da9be97728d8fc744d4b8a396a4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988790, "uuid": "ace83f68-6920-4042-9696-9c3d5ef5bfc2", "comment": "Malware payload (RedLineStealer)", "value": "88d8fb9b0caf249a1317b8c1299811f6e7e0e98683b88b59b2f723cf894b485add4df2768c46fb9065872ca07ab8ae3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988790, "uuid": "0e8aa34a-86de-493a-b681-a9c67eaa6e70", "value": "T1C8554C3AE70614B4D76356B1C19EFE7BDB14B6348022AE3FFF46EA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988790, "uuid": "e2e1d917-9b05-46e6-bd28-90de54580d88", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988790, "uuid": "abf89401-e277-43b9-8838-c46cf1106b69", "value": "24576:2+yGpBYhf6VgqFDErGSk0YCYl0kmiWMpL26gd+ePJj6a6WcgOzJ/o:TyGyhf6eqFDEaSPiUQ/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988790, "uuid": "84355e60-063c-491a-a442-731b6ffebcc9", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988790, "uuid": "a18fc479-6072-4f95-a49c-b96f963d13a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988790, "uuid": "3e5aaa29-63ee-43fc-b196-070ee6429cb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f73196-569a-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1666945554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945554, "uuid": "dde73c0a-8927-4f0d-b2d8-e8837d5a6220", "comment": "Malware payload (NanoCore)", "value": "3fe2b3ebd722209c5824def962607cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945554, "uuid": "020863cc-2250-4f8b-8721-57a4e2ecb09d", "comment": "Malware payload (NanoCore)", "value": "9ba317eff0c4aac341537bac76cd13d007398f2b2c6629644d4465624733cb9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945554, "uuid": "8bf5525b-f168-455c-bfdf-73c9a8349006", "comment": "Malware payload (NanoCore)", "value": "c17160a786635fca68952ec34cfc67555fd133c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945554, "uuid": "3030d9f1-6930-42ef-9921-dcc3de386a64", "comment": "Malware payload (NanoCore)", "value": "b880fbe717d653af7b2b092a1d888005afff6b9b47d3a6bff4e8e1de6fba93756ca7c485b7c9a73b1ca058da70f9ad4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945554, "uuid": "0202e687-fa9a-482b-811c-451ca25d5ec9", "value": "T15214CF1677E9892FE2DE86BD612241539379C2E3D8C3F3DE28D415B69B263E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945554, "uuid": "9e93f5fb-bbb4-4d3a-b2c5-e5a453e78a1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945554, "uuid": "05144a97-44ed-4e50-8614-09b3155d2a3e", "value": "6144:MLV6Bta6dtJmakIM5CUBPnGZd3wwMi5T0:MLV6BtpmkdMOhwwMi10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945554, "uuid": "c26d44f9-951b-4e6f-866e-d8d5a936ccfd", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945554, "uuid": "7107168b-ebe1-4a4c-bd19-b81791970939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945554, "uuid": "be76944d-9f4b-4395-8caf-ff1a6a858440", "value": "3fe2b3ebd722209c5824def962607cb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9813802-56cf-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666968649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968649, "uuid": "3ee7f766-819a-47df-862d-1da56ee04a36", "comment": "Malware payload (Tofsee)", "value": "1e03c1ef429db560bde5221347d94cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968649, "uuid": "166aa612-4a26-4980-b17e-4f3cac0fc88f", "comment": "Malware payload (Tofsee)", "value": "9c3636fcddc3b910c91e8a2ca489e07e4074c0a753969132feef8b83e5d63c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968649, "uuid": "79472e46-6ef1-4f3f-bb6e-889ecf1c075c", "comment": "Malware payload (Tofsee)", "value": "c9219ae24147689c85cdf63592b23a4b4fb444bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666968649, "uuid": "9d663287-5ac8-4ade-a8c8-61623daea5da", "comment": "Malware payload (Tofsee)", "value": "85f6cdeaa217c4b14fcdcb3a780716d1c58b36a5a2511d64040862bf153eaa5fa051b4dac2fc6104ab54a3e422f6f223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968649, "uuid": "68741fd5-4055-467a-a225-0b4f3bf4d050", "value": "T13C44CF317182C1B2C4851570002ADFA0DA7EBC315F658AB737AC2B5EAFB53915A7632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968649, "uuid": "191be29b-2ad8-4bcd-9bc5-ffaa0318c6ba", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968649, "uuid": "4e0591c3-036e-4153-9054-e2a8ff57d847", "value": "3072:VXOMHALLwaAgf/CGImj54lL5vGH1M6T4SX7voL14omQUbVNMtaV6M/h3m:R/HiLwC/9I7lL5+He6Tq2yUbVNMu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666968649, "uuid": "9d3cb237-d129-4167-b950-f6fe8b560609", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666968649, "uuid": "e955da31-e88c-4ad7-954d-1e6db44e3738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666968649, "uuid": "3406070e-9bed-499a-a338-99adcc2f09f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f4846c-5694-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666943294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943294, "uuid": "29ae4866-43bb-4c8c-988f-ea64b5acfe77", "comment": "Malware payload (AgentTesla)", "value": "cfc10d2111056eb2e8bd7b994de3a0b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943294, "uuid": "d9549e9d-9951-4be7-bdc9-4b9f7637d33f", "comment": "Malware payload (AgentTesla)", "value": "9c4e640ef53b014b87e5ffb90e161aa3c8b457cbe534f4a8fc232bae55d82a89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943294, "uuid": "088e2e92-bfb1-43d1-986c-063720503f38", "comment": "Malware payload (AgentTesla)", "value": "f98facfe51441ed260d590e34e4b6aaaacb1cecb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943294, "uuid": "6aae2bad-987c-4dc6-b48d-f19099489842", "comment": "Malware payload (AgentTesla)", "value": "b7872767b7bc23d59dfce9071c6218e967759d29c1f006cf0e2a67c3027c837687e255bd58cce60e648ce5c14f95f1c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943294, "uuid": "9e92e112-d0cd-404b-ad57-9f7292cd80d7", "value": "T19EF423F55E9CDECC553A5B8D03E900E303A1AD976B1853E183F4C4C8A8C17CA7D6E5AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943294, "uuid": "86fdfa1f-42c8-49cb-99b6-60401e41f943", "value": "12288:5rWbafPVcSd3+txGhCXJgzUHxgv0Iv87F9c2BlCn/TsojUS8zaTJI75Gy:5abmPVcQ3I3Cv0sA+2PwbMa9Q5Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943294, "uuid": "7c8f9d83-8f18-42f9-9ed9-0ab2035079a2", "value": 745610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943294, "uuid": "573346ce-a5ce-44e6-908d-66bbe40d8d68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943294, "uuid": "e554869b-008a-44f0-8a0b-cd8462c5b381", "value": "SHIPPING DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1c53b3-5659-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666917682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917682, "uuid": "aa07e4c3-fa64-4464-b816-e77404c094a3", "comment": "Malware payload (Amadey)", "value": "ffc24755531411f9496a8167101f32d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917682, "uuid": "38f3bd5d-514c-42b6-8863-f36796c194ed", "comment": "Malware payload (Amadey)", "value": "9cd795139a13e93f44b20f21a677d5e592f7e4e50c0c081e5a063dfe7632f8a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917682, "uuid": "ec077cfe-146f-46fc-b312-150e94313052", "comment": "Malware payload (Amadey)", "value": "f40e9a3a18f43b0525948ffcec9fe9b107167af3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917682, "uuid": "21245a10-03dc-4903-ac08-4bf21b90993c", "comment": "Malware payload (Amadey)", "value": "9a87bb2b574e2efe94fd9e270f6f931d7ea66e6f9c2428b65eec2d48c2fd23f291e3aea45bfad704e4cd5a45b5baaa95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917682, "uuid": "32d16194-197c-4e4e-aa60-dab35f6266a9", "value": "T1B164E0323582C871C4452130482ACFE46A7EFC3149694A9377A43B9EEE76FD0A67725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917682, "uuid": "9499b26f-2a6e-463b-a329-3492c98007f8", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917682, "uuid": "b27389a4-a6d8-4cf9-86bf-1195a745647a", "value": "6144:VIq0o3SzbW9TfHFUyHva1MCKnH6mRe0ucN:VIq02wW9TfayHvaeCaH6cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666917682, "uuid": "648278d9-2ef5-446a-aec9-889ef33045c6", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666917682, "uuid": "fe5454e9-a9e9-482f-852c-bf361ec31e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917682, "uuid": "afe3db0d-7322-484b-a07b-7c463f8fdb6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7534a3ad-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666994653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994653, "uuid": "c5a1270c-0492-432e-b8bf-58244e092a50", "comment": "Malware payload (AgentTesla)", "value": "996c2fc52849896f325ecb13e398b42e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994653, "uuid": "745a18f4-ffac-4bf6-9113-31157a03c825", "comment": "Malware payload (AgentTesla)", "value": "9ddff868edd0f8878268fd0b5a5e481aadaee42ff56f1fe05d9e38791faaa786", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994653, "uuid": "ca3e42fd-d579-4d97-9db4-5e492c045421", "comment": "Malware payload (AgentTesla)", "value": "533bd4d88af0b09d6e672948bdbb2f49a62b7749", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994653, "uuid": "9e36f072-d930-4180-b74f-fb5bc8bb632b", "comment": "Malware payload (AgentTesla)", "value": "2f6609a84dd45bf5980b4556cb338141134d50816a7e29435bebf5f1493235c0c4f3843db1a540b9bf2f2c5c35b8fa11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994653, "uuid": "f7b4ce2f-ad9c-4fdb-9fd8-65240a186568", "value": "T1B2058B25A71F8F0BD4DACF34B4B0C5F01A639C7BB86D8A99C6C42CF374161A1694E987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994653, "uuid": "b9f7a574-4fb4-4184-b206-61c1804950f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994653, "uuid": "b739e54c-6050-4e9f-b55a-c950ec4fa4a0", "value": "12288:AY6BCDYGhSZNRDZHpbJD5Kyjn0bdYT9tAytThwXtL:ArCDYGoNjD7zwYgcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994653, "uuid": "13b9b710-dc85-4dab-9533-13d44c8f3ae7", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994653, "uuid": "8f1ebdff-484b-4bd2-9ccf-ec2cad9f4165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994653, "uuid": "a1c8b9d4-362a-4552-b34c-f36a452c2fc1", "value": "TRF NP 558 PAGAMENTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca00ecb-56c1-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666962346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962346, "uuid": "5423db8f-8f3f-430d-87d0-94c692ffedf2", "comment": "Malware payload (ArkeiStealer)", "value": "c5ed85e8c11af4a57d4ed3d4511c0cad", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962346, "uuid": "9c5db6d4-4ca2-4c45-8f1d-06ce6e7b6a3b", "comment": "Malware payload (ArkeiStealer)", "value": "9edf684165900cda2567c388a5ec574bbc6b2c27415cc56e965d5562c4ad1176", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962346, "uuid": "5cdc8ed7-b811-44d5-a03a-72d533ed7462", "comment": "Malware payload (ArkeiStealer)", "value": "025695a987afcb517e03b57b7a68aacd4452a21d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962346, "uuid": "094c64bf-084c-474a-af77-a383883b8aa7", "comment": "Malware payload (ArkeiStealer)", "value": "36e3af5f255182cdcda6e0031f0f7572c4e91fcb982f053e6fa616907f35bcc234fcf8dc8721b63d116618613048a5d9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962346, "uuid": "37b8c154-3043-40ef-9278-3e2c02586d39", "value": "T15674F0327693C531C3452E34441ADFE1D9FFB8312A624A4B27A4276EAF71381966B31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962346, "uuid": "dd30cf80-1fad-4769-8627-655c96510858", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962346, "uuid": "6c46eee4-bfc7-4ac5-bf5a-407fa299cd9e", "value": "6144:kbHpL5/47iaCautdZ6MtiXsGPgZFGHVvJGs:kbHpB47DktdoiMtyFGjGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962346, "uuid": "5866ad1f-bee5-445f-8e5d-e42b68eac8ac", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962346, "uuid": "d20ad53d-051c-4ca4-9366-02031b7fd684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962346, "uuid": "f2f2dd0f-6853-4108-8f71-cfce222b10d7", "value": "c5ed85e8c11af4a57d4ed3d4511c0cad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117847ce-56ec-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666980742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980742, "uuid": "7805031b-8998-4aea-8df1-0cc5b4290d9d", "comment": "Malware payload", "value": "244d3b61e174a11c3ed3ea93cd3d6932", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980742, "uuid": "abda9f0a-9943-4706-89db-71f923227d54", "comment": "Malware payload", "value": "a036dfee9911f565adb5af9221e53dcfc9291398f2d73281abf53e788ee13862", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980742, "uuid": "056f610c-f4d4-4bc4-a87f-0fab4ec3f836", "comment": "Malware payload", "value": "b265891db2fe090735d72e42f4e422734a79f5c3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980742, "uuid": "ae479812-d5a1-437e-b6a8-ade982b7b2b2", "comment": "Malware payload", "value": "7f270e805c26042d5f30adbf738944466d5fc79308665d2150edf32704af160af9ad23708b1002d4736979d7b3be6258", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980742, "uuid": "f46698af-2515-443e-8d31-66abe6c399e4", "value": "T1D295AFBC75047DE6266F576BDA96ACDC13B61A239ACBA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980742, "uuid": "b659cd41-26c7-4af0-bf31-c09563fab8e8", "value": "24576:ZEHGHty8asyJNc9NtOEersPXrQQgCCbPKU28MoELlxdvZZtk0mmp/5zzUbsDU1Il:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980742, "uuid": "be9fd247-36f9-43b5-8cf6-ef2b1e8b77dd", "value": 1982685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980742, "uuid": "058a400d-e82f-4bfe-906a-4fafa1b3bba5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980742, "uuid": "afa63b33-e0ca-4a4b-83a5-e2b889c38f1f", "value": "Purchase Order09834.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521707d2-565e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666919862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919862, "uuid": "afffa66f-11ab-43be-8bda-4830c37fb9ae", "comment": "Malware payload (AgentTesla)", "value": "9e9bcc015db62a4d467a7e48e28cebf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919862, "uuid": "b191876d-1ed3-47bd-a4cf-584c7311dc4e", "comment": "Malware payload (AgentTesla)", "value": "a067ee213cb0219bbe5bc57d21a1b360628b13ce4742a4e9089feb52d1bbee11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919862, "uuid": "eb034fd5-80c3-404b-9c61-dedce14b3c9a", "comment": "Malware payload (AgentTesla)", "value": "52572f18618364d8b6e9c91ab5adec169c94f8a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666919862, "uuid": "3677c077-25d4-42af-956a-53cddabade6a", "comment": "Malware payload (AgentTesla)", "value": "38eb8081f5eb9132327082eab3f7cf3cc85a56c412fd6f5a301fa2ef41362ee4d769c0d8018ca14bd1366c7d827de2d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919862, "uuid": "e488a361-8267-4e08-a8af-60e27d3e3d33", "value": "T11015167360AE9D2BEBF64F3136A4679D8C55E21119039C37DA610E7E823DA3CD940DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919862, "uuid": "f92b6830-ef10-4b02-a809-b7eefcff573f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919862, "uuid": "578e40f3-4b1a-400f-8ed6-163a26f747c4", "value": "12288:MXGAgHtDg5xE1tEtmJ4/yZoWVXcFEnxolSlTnSO06p5O/gMdVorLb355w3z5LErn:Me4PAJwUoWVXc4WSNnSboGorX3g39Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666919862, "uuid": "90a2ae1c-ea36-45f2-a3d3-4d740a0db8f2", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666919862, "uuid": "b0465238-2020-494d-b392-1da7e846a7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666919862, "uuid": "c5d69915-54de-4657-b93a-c5d437ddb007", "value": "Attached Please Find our SoA & Invoice Copies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f37c473-56ec-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1666980899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980899, "uuid": "3b259678-f511-4768-9e17-1320c2d661cb", "comment": "Malware payload (Vjw0rm)", "value": "f73bc2e3489c9adf7de78a981d7db322", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980899, "uuid": "05b589f4-58fa-4e1d-b86e-ba58e76fffeb", "comment": "Malware payload (Vjw0rm)", "value": "a08ad51e1bb10ad094efaeb92aa3053998fe9cc420e8e3c7d9438834d86f6ed9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980899, "uuid": "7daffb06-9208-462f-9c04-7f68356d9ee4", "comment": "Malware payload (Vjw0rm)", "value": "5e8226ea9da4dca2c9d6fb67068c511bba2d6ad2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980899, "uuid": "d3a5d2a5-9bb2-4516-85a0-65fe3a4a3882", "comment": "Malware payload (Vjw0rm)", "value": "38bc119a357035de1a173e52a3cf9005c230702e6f8eaea22836d4b5a0e946e668b0970ebe6421d416e626d6a6fb8987", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980899, "uuid": "b4117498-355f-4431-9646-19e0b7974ed3", "value": "T15D24BE600BA45960DE5E760559FF0B1D92FF9787D689300FCDF26AC18EA6002D31EB7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980899, "uuid": "0d46ce0a-1b6b-49df-ae00-260f01ecae15", "value": "3072:nR8iC8SdzM1hfy4rPGXJXnSdIQ8PzFvDK+BuyXs8rqq2rJ330p:VN/xrPGUdIhF7s8r8up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980899, "uuid": "22f453e8-d780-4160-90c9-c0656431127a", "value": 209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980899, "uuid": "fe9b49c3-3b2d-492a-bda3-59dbab6a26d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980899, "uuid": "c41a4c62-77d1-4afa-835e-62a86cde61f8", "value": "Proforma Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52c9c5d-569a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666945851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945851, "uuid": "29cb424f-35e8-4e1c-b8bf-057ee8642108", "comment": "Malware payload (ArkeiStealer)", "value": "ef11f9e88d029fbe97d411a153e10090", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945851, "uuid": "5f4dd5b5-75c2-4822-af44-7844c90b311a", "comment": "Malware payload (ArkeiStealer)", "value": "a2cd337c4aae8faa1c05d1a756d1e16c27b47f6939fca986d3de493ad792c842", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945851, "uuid": "0d007493-1647-4241-a615-43d34bc7c61e", "comment": "Malware payload (ArkeiStealer)", "value": "34660c6d2a397dbad0f37a58b8410b15b409d7a2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945851, "uuid": "153080cd-ce18-432d-9fe4-5cd7f66a52bc", "comment": "Malware payload (ArkeiStealer)", "value": "db7e9f13b70d01fc811aacb03209f0603fd02a1cf18759e6c3e9db55f29a7800d85b0ac391c619ca3b5661fa8eee55ba", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945851, "uuid": "a855fe49-bd93-4ae5-97ee-55dfaac41c13", "value": "T18274F132B641C4B1C0551234142BDFA06ABFFC311666497737E02B6EAEB13D0A6A771F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945851, "uuid": "0b4b146f-2299-4c3a-aa59-3806acc478f5", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945851, "uuid": "b48e850b-fa97-433a-b2cc-3b16d1134a71", "value": "6144:Z6YHOL4ZBmDpdcSV+y5K/jyvlX1tW/Sd80+SfCuv0jmKJ:Z6YHOEzm1dcSV+0cyNFX8ufnKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945851, "uuid": "36c15e03-4a9a-414a-a03d-8bd758982b77", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945851, "uuid": "d9af2a1c-f9af-4395-976d-f5e63a6858e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945851, "uuid": "19016181-c582-4292-8c10-8825ab7d0490", "value": "ef11f9e88d029fbe97d411a153e10090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae200785-56c2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666962966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962966, "uuid": "4c0f02bd-9dc2-4e1f-b22f-5ddf1da73e52", "comment": "Malware payload (AgentTesla)", "value": "7efdbba812499b36f6c9c1c96adfbaaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962966, "uuid": "8e9d3ee6-a3f0-4d2b-973a-27b2f9642758", "comment": "Malware payload (AgentTesla)", "value": "a2dea7e6686dbab970d8c6369ebb6ce58eb9fecdaa66c2ec78b853c0fe9b070e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962966, "uuid": "2eb6c18a-3ce0-40f3-95df-f9e9cba3da57", "comment": "Malware payload (AgentTesla)", "value": "a2ab54d37580f1a777720facb0366deda087178f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962966, "uuid": "c1e9b045-e38f-4c1a-8052-7a7470a9d84c", "comment": "Malware payload (AgentTesla)", "value": "70774cf9e131c469b0c4a2f364454d330961d354a446867fd7003507144769b5c4ba3eeebc59279b3d820308fae298fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962966, "uuid": "a7ac7159-19da-4c70-bd55-2b59645f4712", "value": "T1ED050256F727E9B9DD6E03B934714C506B3AD51274CACA6D588A33AF0831203268FDDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962966, "uuid": "2fb28e5a-b4a1-4e3f-9029-f3cc82d0175e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962966, "uuid": "e0d0c865-52af-4c5c-bfb1-7a6a9939a6b2", "value": "12288:i3h702iNplqEuTxOk0gVgT1OK1YMewtNpeXUZxm+RNCS68a5+I5wW3kZ:H1o0+g1YONpOixbCSHa5+hW3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962966, "uuid": "ebf24ebd-68b8-4474-9dc6-2402c1fee675", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962966, "uuid": "74356754-78e3-4954-82ce-39c7c3a03e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962966, "uuid": "d3228fa5-ab8e-4c96-b957-86b800952869", "value": "PO28102022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cd591b-5679-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666931511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931511, "uuid": "b161d7ac-fd93-4469-9a59-b6beb2e223e2", "comment": "Malware payload (Amadey)", "value": "3b8c2241118238474349bc658feb15be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931511, "uuid": "42e3a76a-77ba-49e8-96e3-54a3dba019a3", "comment": "Malware payload (Amadey)", "value": "a384828d07c88af1f60cb50cde6bb82df92eab459b5da8f20fe52fb4dd76cf87", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931511, "uuid": "e93cb4f2-2caa-45b9-9834-76ae549de9c1", "comment": "Malware payload (Amadey)", "value": "e13c06b54f75be4bcee93fa301cb92c6ba2a0e20", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931511, "uuid": "fce3dc33-9632-434f-836b-e78eaa463da2", "comment": "Malware payload (Amadey)", "value": "c4fee985d76b2062bceb782dc6e637e7e8b98c7c34f045171b21f22d7aba7114c1e5be9ed59f46e6cc521872a569d991", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931511, "uuid": "aa87dc65-e546-4109-a3a9-304b5244b532", "value": "T15664CE75BA92C831C485D1704429CFA02ABEFC710B214AC77BA43B5FAA713D1A97635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931511, "uuid": "41043834-89a5-46f8-87c9-277ea3b83e76", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931511, "uuid": "8f6e44f7-4c4f-49a0-ae18-bd2de730eb2e", "value": "6144:mkrHnL22wzqMuQDTPNJBCXd/cQwBuV3gY6hwp5j:mkrHnipz9uQ/DBCXdXwBuV3gYkwp5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666931511, "uuid": "9582694a-ecdf-4855-99c3-bcf21d822d45", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666931511, "uuid": "952f2d48-104c-40d2-84a9-a2143e963508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931511, "uuid": "d357048e-836b-483f-9ef0-8ac3325591d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140de3f4-56af-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666954547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954547, "uuid": "d722ffe5-b1cc-49fc-8998-d19c241bed6d", "comment": "Malware payload (ArkeiStealer)", "value": "ee1f78bee9ce0c22a5002f825d215fac", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954547, "uuid": "ece9d683-f5db-47e4-ba53-43867dcc716e", "comment": "Malware payload (ArkeiStealer)", "value": "a3de421738e83375acc02ad9df1f02ee17077e773409175fdb646a5533e210c2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954547, "uuid": "4f46f1ca-fba9-4084-b3fa-435920b608e7", "comment": "Malware payload (ArkeiStealer)", "value": "203a341d484ebfb205d47adf7b0daec96282784f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666954547, "uuid": "e8873a4e-1227-4fe0-a905-72de76d04c97", "comment": "Malware payload (ArkeiStealer)", "value": "cb2414536e6a8415e67e97f8743f52ba63bad452137f54c60447697693d6f15d67d56a59ffcbdf4e45f7fcfdcf60cb4b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954547, "uuid": "4e9c072d-00d6-4c8d-947c-38f38f7f0860", "value": "T1BF74F1357A82C471C086F234802ADFA06ABEF8312661499337B427ADDFB5391967735F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954547, "uuid": "da8d6c63-249c-41dd-90c5-74e84d1262ef", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954547, "uuid": "d9e6dc04-03ae-4bb5-ae9e-23c933be92a4", "value": "6144:taiHmLshgW9brNiV7ztqTeyDG1yKwduJBJktUCze+ASYdp:taiHm46W5piXqTeyDG1x4WX9ZPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666954547, "uuid": "b5f5a883-45ac-490a-b3a7-b2c8fe801293", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666954547, "uuid": "ea4e1661-22f1-4537-a27c-62d62a205240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666954547, "uuid": "855c1170-3d00-4dc7-9f67-0ae0be9e32b4", "value": "ee1f78bee9ce0c22a5002f825d215fac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431912d-5669-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666924751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924751, "uuid": "277782d2-d8a0-4e92-b046-d9af3c42113c", "comment": "Malware payload", "value": "2119fdd7be98c9f3e7300fcf8ad24c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924751, "uuid": "9eb7752e-92d8-4237-b0fe-f5db2201c4ca", "comment": "Malware payload", "value": "a4b62374d1ea003a767a4123b1789f222f2c26306c0028f2c9dc9a0f9cc4a208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924751, "uuid": "33154756-ed5d-438f-81b8-3ac8b5a11748", "comment": "Malware payload", "value": "1b0c8b9df1f030eace8d78f2f4179ef63f1f85e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924751, "uuid": "82e67c4a-5a85-453c-9a0d-78279346cfc8", "comment": "Malware payload", "value": "03d602fe2cba8b0ff422433d61c736d9b6e5ccdbc6e158ba95be93def9a2945e0f682737001a05cf6eb3a1c46a9d2edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924751, "uuid": "78d30a31-3089-4115-a44b-dee1e34ce554", "value": "T1D643B703E36360F9C551D1F8879BA233F937B85D26346B1E1B14CF192F66AB07968B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924751, "uuid": "014293da-53b9-49aa-a2aa-635be0a96c77", "value": "768:3rWpq85FWB1LGvPFrMckQw0PcebDZ1uPs60czqu6/yZAKIHhF:bExHvCeXZ1uPsF9yZAKIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666924751, "uuid": "dc87683e-37d0-4b3a-a710-8537acc9b69f", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666924751, "uuid": "26cc36bb-d93f-430d-8275-ecd6af86d751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924751, "uuid": "c590a73c-1524-47ce-81c2-b1d5c9eea96f", "value": "Trial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ebbe49-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (WSHRAT)", "timestamp": 1666937691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937691, "uuid": "0db2cb6f-01e9-4105-a613-01676c305d5a", "comment": "Malware payload (WSHRAT)", "value": "5e7cb6f53303bcd3002f05494288eaba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937691, "uuid": "463cf912-897e-4979-b3bc-d690c8b62c3b", "comment": "Malware payload (WSHRAT)", "value": "a4c0bbb066fc89987219821f0df08edfc0480a272902fdb83b8924f6eb872adc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937691, "uuid": "548f6005-69b5-4549-909c-a5d1909f9c96", "comment": "Malware payload (WSHRAT)", "value": "8168f4dd4565b57b61e36ba23106c84d6c4e5ccf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937691, "uuid": "655587ca-6711-411a-a045-17633b56e04b", "comment": "Malware payload (WSHRAT)", "value": "f2b19769e68f28851564a60aa78f3353258ae133a77d80b2ffdd8540ebbb1dbef94b83a73307fb465fbb4795376af08a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937691, "uuid": "af99d495-7287-42d7-be30-7afdeac777f4", "value": "T15FC253403EA4955D238B8FA7373BA8D6D1A43A2E3581C497D504FC61A4A9F33EDE3036", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937691, "uuid": "ff9984ad-9b65-47c0-bc9f-e86ec7534ead", "value": "768:upfV34U86clGKPwlBzypfLaNBf3tezvdcg9tmiW9qgdC2:+xwsF+jub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937691, "uuid": "c9298044-364a-46e0-a8ed-506071400c35", "value": 25766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937691, "uuid": "d19c79e5-bc0a-408f-8238-2678b895693d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937691, "uuid": "c84a57d7-7c5b-492e-af73-c4b9717af2ff", "value": "wynmove (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e016577-566d-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666926378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926378, "uuid": "8c09753a-762a-4f7e-ba5b-951a39ff6d3d", "comment": "Malware payload (GootLoader)", "value": "494198669dfd3b21aa1051d4b232a4f2", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926378, "uuid": "adcd3d5c-cb6f-46a9-a48a-094b9d939c67", "comment": "Malware payload (GootLoader)", "value": "a56ef931e5239bd53850a6259b7b9e1b43f60b5b4a8194db06c4568acd68e623", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926378, "uuid": "40ba4721-a720-4143-bc5b-9c217e2fdca5", "comment": "Malware payload (GootLoader)", "value": "4547df63fe41668b9df803a99d9905e0a72d9943", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926378, "uuid": "1cc6187a-d366-4885-97db-3fbb055c5e65", "comment": "Malware payload (GootLoader)", "value": "43ba353e791424212687793d923a8b78843d08da475d50618e07af5b9181e94aa46dd1b819397abccec1c9a6fdec508d", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926378, "uuid": "cfbc938f-d9f1-4dfd-b4da-aead68c2ccd3", "value": "T16DA2E1CE3BE348284C573DF20D5A761471726642EEAA4D6CF1D77A7B1D8A78AC31084A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926378, "uuid": "9e272725-3bba-45b1-8a1e-bd868c8ab346", "value": "384:hulG9IL73Wr1FPv8AqC5ljDjueZd6ZCNs3wM3ziMQhL2CYdwzmUhXCEYT3UjAgyd:hXILb2Pv8ApDDjumsom3mV5zmU5OUjd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666926378, "uuid": "b1fd75d8-6efa-4f45-9e48-b3bfafc50d15", "value": 22275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666926378, "uuid": "59c57cf1-3497-43fd-b950-6d3c5bf7c54d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926378, "uuid": "27c9dd6f-6465-46ec-a1c5-c79cc5f80dbe", "value": "Which sentence has proper subject-verb agreement (4463).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84414981-5677-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666930683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930683, "uuid": "6afbc380-54d4-4261-a3dd-66771ce6e467", "comment": "Malware payload (Formbook)", "value": "b461a359b3cd91d04427620e1ae7a3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930683, "uuid": "505592f8-1c9e-4fde-a013-f97fb9abb308", "comment": "Malware payload (Formbook)", "value": "a5968626c3fa98eb7975b8c5fc4c5d55bb0bf7bd537143dc3619b1c9d5c15343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930683, "uuid": "b05fde3e-e014-4c79-abc8-9b938120b33a", "comment": "Malware payload (Formbook)", "value": "1f51a6efb1cc01dd985304c056850a7d9dc360d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666930683, "uuid": "38ced0b8-14ab-4344-9b4d-4e35cbaca76d", "comment": "Malware payload (Formbook)", "value": "d5d35787dae05567e3db7f59ca2c7e73b991c80e27f415168ee18c3460ecf35c70749f908a1bcb7b51f1c49d2286f842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930683, "uuid": "0b5d1890-e87a-4729-9313-c3b7f6b933cc", "value": "T1CD437E897BD87D8FC94ECB7A85A1780946BCD0712703D343A8D17A6D085B3DE4D13A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930683, "uuid": "3bf9fab0-d19c-479b-9fb2-571f9c815fa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930683, "uuid": "240afba4-bc05-49ef-860c-0643335d714c", "value": "768:6p6f8s5j4QohDxk9XgF1Rb35BZYoFpkY15r9cVhgk7OEvlUAecs/cz+WiRPPrk+5:csFohDA0TZdpkYadfvlUFcOpWixPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666930683, "uuid": "0704a505-dd63-4ccc-a760-410b8f236043", "value": 57152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666930683, "uuid": "524d8e53-b94c-4fe9-80c6-0637bb0d70ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666930683, "uuid": "a2270a6e-f980-436c-bb89-5343fd51776b", "value": "SWIFT20221028-876543234567897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42844c6-56c6-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666964748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964748, "uuid": "06aab630-ab35-4ce8-9582-f75a48077fd4", "comment": "Malware payload (ArkeiStealer)", "value": "4cdcc096dfe2a3e05d34108713d2b689", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964748, "uuid": "cd1919b3-ffc8-4df3-b847-b7f261503285", "comment": "Malware payload (ArkeiStealer)", "value": "a5a283967a61f5b1a787d072c5946244eac4c3b52165af01a7a099eaa58b0943", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964748, "uuid": "2128adbc-a7e0-4e7c-b891-89476bfe6cc3", "comment": "Malware payload (ArkeiStealer)", "value": "997dbb38811b46fd62e24e7d30d42f20560a5eb6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964748, "uuid": "91544e0f-9a4d-44ef-92b0-03ea812a3e81", "comment": "Malware payload (ArkeiStealer)", "value": "6a064be7bfe47b4ca34dc39780b6058063ef3b663dd68278382f1e7b39a7e3cb5604746c7d90ce786369bd8f760d606b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964748, "uuid": "859f6a8e-a49e-4356-9680-7cdfaa7c5b5b", "value": "T1BB74E0327682D472C0831634042ADFA529BEFCF1EA6C494777A02B6DAE717D195A231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964748, "uuid": "da07958a-0a48-4a0e-b3a6-43687e471f6e", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964748, "uuid": "97fab0f6-aa6f-441e-962d-413a9108ec99", "value": "6144:nE/HTLTM6+jqYAUPTUZMI9q/SfBvELeatN22FeBdMZ0apzqcg:nE/HTs62qgP7IgS58LP22FAyVp+cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666964748, "uuid": "03e18d24-a863-456b-9de0-58efe7e97da1", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666964748, "uuid": "1cd38d43-8699-4edb-bdd3-ed6873dc7a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964748, "uuid": "7b7736bd-793d-49e3-a8c7-6a9201df9372", "value": "4cdcc096dfe2a3e05d34108713d2b689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b330f3-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666938631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938631, "uuid": "6cedbe81-f7f3-4766-8415-236d5e708362", "comment": "Malware payload (RedLineStealer)", "value": "3b9b7394464129517cec702d56c0ed7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938631, "uuid": "8db59e77-7381-4601-b2d0-fb3d616a3080", "comment": "Malware payload (RedLineStealer)", "value": "a6bd07c21acee8ebad1b892ab7dcf5e57bb7e0a1a9ba9ce36a54e62399407158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938631, "uuid": "d8420fd9-bbf0-4dfc-a6b6-8428face144f", "comment": "Malware payload (RedLineStealer)", "value": "c8c07b6f2baa9b306233181555ec1cdab471323a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938631, "uuid": "046d1694-4242-4374-9ca3-82933a1e1ce8", "comment": "Malware payload (RedLineStealer)", "value": "6fb19532ebb0f925b5c6f953d0289b46336b249dc3dbcac3a1a17779794a2b7d9abd1b4125207caa1e81aab15544e479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938631, "uuid": "54307810-52cb-43d8-b00e-fed858e1ef9a", "value": "T18544CE327A82D871C0911230483ACFA129BEFC7159654A4777E83B5FAE713E1A67631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938631, "uuid": "577f92b9-0925-4b5d-a15f-7722c91e638d", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938631, "uuid": "68e5dd16-4ade-4e4c-8952-a802fc29f739", "value": "6144:FRAH9g5LGW/HRAPTLuHg5kntOvczyFDWRj:FRAHkL5AXuA5kntOUzyFkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938631, "uuid": "47d5d159-ea7d-4912-874b-c573a5ee47b5", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938631, "uuid": "e749109f-cd70-4926-9c8f-244ecf8c61e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938631, "uuid": "938d4952-da81-49a0-b759-54db9ff4bce4", "value": "3b9b7394464129517cec702d56c0ed7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c085c8c5-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666938945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938945, "uuid": "f7da559f-8d6a-4475-8dab-1ee374fb07bc", "comment": "Malware payload (ArkeiStealer)", "value": "7983b09765e01a92b85293f53abdf56c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938945, "uuid": "0acc48ba-a915-41b6-93c9-c2ba9956658d", "comment": "Malware payload (ArkeiStealer)", "value": "a7ee146e728c0975a126e2dd03494a0ce62cf246d9ca6cf49d75c4447f437fc6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938945, "uuid": "6740f22d-1d17-45bd-b65f-5f7813a5124f", "comment": "Malware payload (ArkeiStealer)", "value": "7ed682276d99ec0d539758809f5bdf3f64d9b261", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938945, "uuid": "c945bc81-8fa6-43be-a49d-34afb0c67d53", "comment": "Malware payload (ArkeiStealer)", "value": "f0acd056a1dced1311640b14efb8d38845090f4392766485b3b5baad041866918b01bb7043cdd08dbd35e107391a9e13", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938945, "uuid": "862f864b-866d-4c53-8f91-bd07a1c12bb4", "value": "T1F974E005F643C871C4C100348428CBE6AABBA8765665895F3B943B6E7EB03D1A67E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938945, "uuid": "e420cd3d-b9f8-4c7a-846e-7fcf1604ee9b", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938945, "uuid": "df8e8d3b-c690-424f-8de9-c567674eede4", "value": "6144:jhq2/lrRvBejB1+OJ4zWoOEmPe/puVmqcWC0:jhq2/XBEBkOSzhM2/puVtzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938945, "uuid": "5f821324-c829-41f9-9999-390b474bbc18", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938945, "uuid": "8ea0375f-138d-4c9a-8f61-1505bd704c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938945, "uuid": "d435353e-40bc-4b0f-b8ac-572f9f4a5361", "value": "a7ee146e728c0975a126e2dd03494a0ce62cf246d9ca6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4aa41b-56a1-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666948580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948580, "uuid": "23bcc29d-eb04-4326-9a8b-db42ec32d5cf", "comment": "Malware payload (CoinMiner)", "value": "45ae1a4062875dee9d03ea031ff6f72b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948580, "uuid": "fc707dab-5751-42c4-a67e-a2aa0ce8556d", "comment": "Malware payload (CoinMiner)", "value": "a8105057f5aa3f1f3df93d7bddbabffd10656cf33092de0e26d702e05a644c18", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948580, "uuid": "e0ee57f0-66e4-4f74-acfb-d3ea04fe5bc9", "comment": "Malware payload (CoinMiner)", "value": "fc2f2e79f66836250d3ece24aa912106351dc939", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948580, "uuid": "a210c20d-6bc8-4c46-ad1c-917ac2583a2f", "comment": "Malware payload (CoinMiner)", "value": "25a28ca17fb1431d82d186b97689438f841cbc101d605db7f6af945a8799ef8d390a03df7f945b76595e66351664e00d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948580, "uuid": "90845003-131e-497f-8d71-5a76535da6f1", "value": "T13644CF3179A2C772C0451130447AFFA15ABEF83126E48A9733B42B5EAF313D1A66671F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948580, "uuid": "20f3f5ff-7969-4251-a537-6f6f610496ac", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948580, "uuid": "8e87519b-6429-482a-a00c-3aecf5213b06", "value": "3072:IXOGHcWLwUTTADEefGI6ND5l48Erb9Shu4TBANZukHr9tNlKeLM/h36:c1HXLwUTDeuI6+8oM2r9teO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948580, "uuid": "f2842798-ad9e-4cec-aaa1-a2768b00f293", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948580, "uuid": "a4f7b6a3-4146-4205-927e-41b9c6388e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948580, "uuid": "53be7f32-1ed2-412c-bef0-b0aadcbf2b80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ff0065-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (RustyStealer)", "timestamp": 1666952666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952666, "uuid": "3f6dde5b-ce58-477b-83ff-93bba2b08ada", "comment": "Malware payload (RustyStealer)", "value": "33c62f580ece1c3cad5b05b87e1e760b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952666, "uuid": "3dbe0b38-dcba-45a1-8e2b-282da0aae687", "comment": "Malware payload (RustyStealer)", "value": "a82d27f251f423a8016520aafce59827c39c4101d655dc85b01cd39e0b2f61a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952666, "uuid": "a59151cd-5b0d-4183-a540-307bd64db109", "comment": "Malware payload (RustyStealer)", "value": "bbcccfa4d9980a168e9cb13634cc09bd6672ee00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952666, "uuid": "d9391c8f-05b3-43ac-8b7c-73fbd6ce6d4c", "comment": "Malware payload (RustyStealer)", "value": "d423c61bccf2c047ca26586469cb3aa68d7d193cd19675549df2bf025c6957231f1fa50d4a87c70311491924aed14853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952666, "uuid": "71934fda-59d3-4782-a1af-8e5e08d24c98", "value": "T10C84F130F2B2D471C075113C446A9FA46EBEB8311261CE8B7BA4E75E9EF1781666231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952666, "uuid": "5c715ffb-a185-49ea-8e49-2a7e9578e478", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952666, "uuid": "2cdf5991-13c4-4c41-b36c-be5c17b624f9", "value": "12288:Q9tH7cSF9pKMynR8oOvqTPx3vt3grVppT:e1wwyfgM3vtwrLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952666, "uuid": "94755d91-b6c7-4af5-9520-634e9d503257", "value": 400398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952666, "uuid": "7acbffab-1bc8-4449-b981-59ddfaf3a806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952666, "uuid": "d78a5ea1-d81f-41f2-aaab-9a405233465a", "value": "library", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e71290f-5675-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666929868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929868, "uuid": "f8c56ebc-22b0-4dce-90ac-93dc52f51568", "comment": "Malware payload (GootLoader)", "value": "9d984359a033ef93ac0f56507fe0c8f2", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929868, "uuid": "37ca61cd-7087-4e4d-91b1-2e4a955433b0", "comment": "Malware payload (GootLoader)", "value": "a8b8711fbbf1e5dc99a765abf44a1b3c543166ad9c483dfdf73af6fe6e5ddc94", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929868, "uuid": "99d7237c-cb3d-4849-98c5-f9e02aac273a", "comment": "Malware payload (GootLoader)", "value": "b52c62fed4b6ac4a41c5aae67ea9158a9674cd55", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929868, "uuid": "e55a7fb2-c218-4398-b430-54b3242fc8a0", "comment": "Malware payload (GootLoader)", "value": "6176e1a8849f3ec917bb56ca68f5de5015b064c36297525bcacf7967eef907f6b2e33eb7c7877143942973f7f6091cd2", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929868, "uuid": "e9b3b623-8d2f-4fd2-9ff2-38a026d244cb", "value": "T1D6A2D0E1C61A87C1CFD9F4FFB1FC0501957E4629CBAA9693B2A3A10CC2884AC5645BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929868, "uuid": "a7a9f860-bff2-484d-9080-bb6b174c7b53", "value": "384:XIoF8K+tNcJQtNciN8MN44IoO/8DWyS169wsuNfE+YrqufySGAguLOmhTykWZi/T:FF6WJQtb8MNvO/5yS1ewscfE+qqu9tgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666929868, "uuid": "bd36dc67-3879-4996-8579-20532f636204", "value": 22339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666929868, "uuid": "7bb8cccd-ad2b-40b2-94af-50abc5b859f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929868, "uuid": "73a628ce-5150-4290-b663-ea22b63a6ccd", "value": "Which sentence has proper subject-verb agreement (4924).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935533f5-5702-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666990409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990409, "uuid": "a1a2ecb4-fad9-47b9-bc67-0bec67693ca8", "comment": "Malware payload (RedLineStealer)", "value": "9c2279cc6bc073bda684fe7f22ff093d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990409, "uuid": "7b3017bd-27c2-4967-90bc-5a7a91367ec8", "comment": "Malware payload (RedLineStealer)", "value": "a8d45b1c5cc1fce51bf5556d91214c15e1e4294a16c9750b015f1fb22a7c914c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990409, "uuid": "57dc5cad-5109-465a-b8cf-317f8c6042f2", "comment": "Malware payload (RedLineStealer)", "value": "7a23093bdb0968473dc10839bd075a5432615ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990409, "uuid": "e74aaf15-dd71-48b1-bc4f-5c445b3d414e", "comment": "Malware payload (RedLineStealer)", "value": "c6df6967f9f168f113ca9e9afe08c836a05b66897e9be4167ab7a80c5310d48229f496d832c95166a1d7901ac4cd1066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990409, "uuid": "5dc397ed-b11a-4447-9ae8-8d88d48a6c9e", "value": "T125554C3AE70614B4D76356B1C19EFE7BDB14B6348022AE3FFF46EA0CA4734126C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990409, "uuid": "18eba0c8-3308-40f3-9ee6-c20848027044", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990409, "uuid": "6274b9ee-08db-414b-8bbf-e1b29f11e2d0", "value": "24576:V+yKGRi/S6AJ9fkDSk0YCYl0kmiWMpL26gd+ePJj6MKPZ2fOQo:4ytRi/S6AJ9fcSPidh2fOQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666990409, "uuid": "a1dc83c4-1ce1-4dd1-833e-1cf49bc357c0", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666990409, "uuid": "be345ae3-f3a5-4a94-ba6c-c697f599af2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990409, "uuid": "420ce367-355e-44c6-8a28-cc068868323a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f299e7f-5689-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938325, "uuid": "7a462652-96fc-4155-ba39-b97ef1ba97be", "comment": "Malware payload (Amadey)", "value": "4848f5f7e346c7e7292cab2c3fa56d8c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938325, "uuid": "5299d31c-6af4-452c-a6c4-75a71e0febc2", "comment": "Malware payload (Amadey)", "value": "a8fe3a11ba859359bac4d28c7374d24d8c8fe270739a311fa6eaa4d941ef5698", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938325, "uuid": "9176eb80-82c0-4ab8-a580-70efab05ffbe", "comment": "Malware payload (Amadey)", "value": "360cad306d3145f6074a49ece3aac41c46e8834e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938325, "uuid": "80375161-4965-4a68-a017-a3256c2fa69c", "comment": "Malware payload (Amadey)", "value": "71e11152b5aa479a4cd2872ab35d8d477975ba0d406ec66d04f195bb6763a6342a344c0a8024953f2d941da11498cebb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938325, "uuid": "4e692a76-35f5-4984-8343-1042b23d4be7", "value": "T10C54E0267592D4B1C0851C304835FBF1EA7EBC3121254A4B77A83BAF6E703D1A6B7297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938325, "uuid": "222f5b5e-da14-4d62-a0ea-96b74d24007a", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938325, "uuid": "feba62ac-8acb-4778-beba-dccc96498fa4", "value": "3072:dxpXOGq5zxBI+nq55dXtk00xJt98mjGT+KKsDylHBmSSMdeY2NjrueCOepg0Kv:tlqZQJtYYnT+KTDSHkrYMmKCg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938325, "uuid": "83c757f5-15a7-4dad-bc9b-0622578985a5", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938325, "uuid": "0eae2600-df69-4227-bb0c-59f4185ac21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938325, "uuid": "236e7b2b-b101-4b62-b163-491abdacae46", "value": "4848f5f7e346c7e7292cab2c3fa56d8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ee8769-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949131, "uuid": "e161f38b-05b5-4791-90bc-0483defd1ea5", "comment": "Malware payload (SnakeKeylogger)", "value": "7b3fa32faa37fa76925c2d8b5fadbe07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949131, "uuid": "162178ab-7327-45cb-ab09-aeb0602a0667", "comment": "Malware payload (SnakeKeylogger)", "value": "a99e72206a6641f9a3940dc2394d961732b55901d2144e928c766c5a5f53bbeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949131, "uuid": "2ffa2bbc-2b73-47be-a43f-2ebce20deffd", "comment": "Malware payload (SnakeKeylogger)", "value": "f6f801e41edf43993484e79bdd9a71ee29376c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949131, "uuid": "df7cab9e-842f-4384-a8e6-3dc0636393da", "comment": "Malware payload (SnakeKeylogger)", "value": "de136f2d8898cfbd80936249717af90fb996ea9050c59f471443c74dd5a24c1f473d0b25a64c2370e2890ef70f73af15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949131, "uuid": "6568ddf8-1de6-4f28-9b82-f7bea1d0aaa2", "value": "T189D4125A752272DFCA2BD5B1DA480C68AB3168BBC35BD107904B2ADC595C98BDF070F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949131, "uuid": "1096b3cd-80ca-4027-ac43-7f6467206fe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949131, "uuid": "55a8679a-6a99-4ec5-94da-026757182e60", "value": "12288:ah73nnaVU7AOCsdoed/Mc6KNr3CRC1HRPE017Yis7cWEyLzI:Cna6Op+Uc6BRC1xPEgYt7cWEyLzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949131, "uuid": "13cea07a-6451-4072-bc13-03e5941f1e89", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949131, "uuid": "b59891f3-5ab2-4046-acec-592ae0c1085f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949131, "uuid": "bb06a61f-afbf-4910-bdf2-f424e3d20fce", "value": "Product_Specification_PS#0002983778288RCA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c05144-5688-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666937965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937965, "uuid": "9f58c912-a9c4-4787-9eac-483a54cfb828", "comment": "Malware payload (Formbook)", "value": "c1d74ec41c57e24503bb5f05117a0215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937965, "uuid": "f37a104c-67f3-4059-861b-7700202bb502", "comment": "Malware payload (Formbook)", "value": "ab380ec497114c124eaabbb96f643cb20dfb24d0618be4934c19c4062f82fa71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937965, "uuid": "1017671c-fb93-4f6d-b8bc-748791862274", "comment": "Malware payload (Formbook)", "value": "47bd6a606edd6229962526f5488c5c8635acc50e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937965, "uuid": "47fa2ee8-bd06-48e5-9b7b-b40de14e7bce", "comment": "Malware payload (Formbook)", "value": "2aec632b1cf0cace1682956c6cb3a342a803354047c389fad5fd8682434ec0a6c57e76201102aed2aac6afeff1906c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937965, "uuid": "3bf7339a-4c49-470d-8b4d-3e28b877d522", "value": "T12A150252FB73E978EE5E13B038344D962B36E51575C9C96D28C532EA0832203169FDEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937965, "uuid": "14fda5f7-4f54-47a3-9af6-645ec5be997f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937965, "uuid": "71f2db83-dc4d-4edb-88e3-7175c16fa12d", "value": "12288:Rqh702iNpEmR/B4C0UW6Tggk3PuhB4QJP1vwY1LFUFWs8JTEc72d/DW7UKt:d1BWU7ggnhfrvwY15UIDhAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937965, "uuid": "604318ce-5058-47ea-8022-52f473ad37cb", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937965, "uuid": "8185c4a7-739a-44ae-aef7-2a70eac39e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937965, "uuid": "0f27978f-edda-459e-bce1-b3e9592a8649", "value": "c1d74ec41c57e24503bb5f05117a0215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81680a8f-5670-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666927672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927672, "uuid": "8292104f-168c-4389-96d9-4d1b5c95c43d", "comment": "Malware payload (AgentTesla)", "value": "42c808cd36b05097faddaef36ff1dd6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927672, "uuid": "2430ceb2-f2c0-487c-8965-8f35fbe6aa65", "comment": "Malware payload (AgentTesla)", "value": "ab77aab30ff1530adc89a236a447e7722b08fad2792c6748f3dcab2dc3020cab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927672, "uuid": "6851460a-833b-4f86-839c-59f2050419ca", "comment": "Malware payload (AgentTesla)", "value": "fa32781f5a799bde8326467cc5a93717765cb4e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927672, "uuid": "8617ddbe-f8d6-46c6-abf4-0af8835a569c", "comment": "Malware payload (AgentTesla)", "value": "0f0d7bfdceca55804f5ea5632ce87635aa1ac1f223249cd11db4661c15c381ad97b435e6756c14a4b480fb207637809d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927672, "uuid": "1527e31c-bf20-4d19-b84e-7fc1825de436", "value": "T1C412E90193D44232DEB502BB3C675786DB3697EBAC478BE974CC512E7F6214283232E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927672, "uuid": "e36671b9-6410-481d-8a59-0031eee0bd53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927672, "uuid": "43a2d7a9-d1dc-4306-a108-4845d4671fcd", "value": "192:mHst0LNJvqFOYQ8dPus8stYcFmVc03KY:qA0LNJvYO98dmsptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666927672, "uuid": "e74649af-adaa-43cc-93ca-c839a3e95ad2", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666927672, "uuid": "824e4907-be71-458a-a176-6dff313242b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927672, "uuid": "faf820f7-b621-40d6-bb93-b7a953f073e8", "value": "SecuriteInfo.com.W32.MSIL_Downldr.I.gen.Eldorado.12041.24842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11a0497-56a6-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666950945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950945, "uuid": "e5ad314d-9337-435a-993a-8a03cb51123f", "comment": "Malware payload (ArkeiStealer)", "value": "234c2c0d5948f2c2ae0dce965ccc6115", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950945, "uuid": "3d4e73be-10d9-46a1-96b1-36162f145c98", "comment": "Malware payload (ArkeiStealer)", "value": "ac4bd1987b6a72732c2590c7a44f63f63bfa7617ef7f86d8975175b67db4fb30", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950945, "uuid": "d1a7ab74-7a13-4243-875f-8e1c460375fc", "comment": "Malware payload (ArkeiStealer)", "value": "6d32e6ad4181fe051bac11b220583baeed5dba68", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666950945, "uuid": "89ff2568-098c-4877-b7b5-da18145bbbed", "comment": "Malware payload (ArkeiStealer)", "value": "12c9f64b99c5e7cfaebd4cff8609a8124e248978bc5b65c830d1f4c894172cae9fdd73ad87fe40c4db3168f23969123c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950945, "uuid": "6145ad49-673f-4202-8503-1ba0ee4143be", "value": "T10774F1317692D471C48622304526FFA01EBFF83219A58A477BA42F6E9F753D1927A30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950945, "uuid": "4d98626f-254a-49f4-ab46-f5839c9f2742", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950945, "uuid": "5cd4b247-6ce8-4dfc-87ea-3fbba887d6eb", "value": "6144:0xvH4L+iUvjiUrN4at1bpPt1msariYfsrsMNjKa8XEp:0xvH46pvtpnt1dusarHfssnJEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666950945, "uuid": "4195b000-c418-40f7-9148-db2d54b59201", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666950945, "uuid": "11e65532-4848-479e-a391-586d59a9cd7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666950945, "uuid": "5f471953-fe6d-48c8-8f2c-2a56ab36f565", "value": "234c2c0d5948f2c2ae0dce965ccc6115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa7741a-5703-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666990636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990636, "uuid": "a1ea7d31-de89-4841-8f7c-9f1e70c42507", "comment": "Malware payload (Smoke Loader)", "value": "40e33df5022eab73d888a767dc89f7ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990636, "uuid": "c1bc72cf-55b5-419b-a77f-a651b8dec15f", "comment": "Malware payload (Smoke Loader)", "value": "acee4a953641ad23b98512f1f15a3f00973802fbac86715033f650e9fbe5b134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990636, "uuid": "8f895aa2-c71b-4f5b-8996-2f412fab562c", "comment": "Malware payload (Smoke Loader)", "value": "dfc74f651f9ad7cdf4ec46417bf2d0dd93453c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990636, "uuid": "a9242715-5f72-413f-b4d9-4ec15045e9d0", "comment": "Malware payload (Smoke Loader)", "value": "d47799ad8cded01f5a81783aae2d8b973651073be932144b2724bc8c8922cf6ef4715ad8d89b360a71a98f8783c8bf15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990636, "uuid": "607cddde-f512-43c1-9b35-b7e047c423b5", "value": "T1E544BF727891C472C09615304C35CFB12A7EFC3699698683B7983B6A6E333C166B635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990636, "uuid": "b07f4842-6bb9-492c-98fb-28c5151f7ec6", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990636, "uuid": "ce9d7431-efb3-4957-b5c6-b2911e99d179", "value": "3072:QnzSIBUNhHL1nUelz54HBAzKyshGaou47q0LNbWFooLBjrVFEM/h3:hIB4JLZUXHaKf72qCbQoSDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666990636, "uuid": "5203d76d-67de-4b96-9aaf-14b53ca41735", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666990636, "uuid": "461e4eab-edd6-4c60-9c4f-3179797117a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990636, "uuid": "25330791-6505-42dd-bd1c-62d00cd02140", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254fbf79-56b2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666955864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666955864, "uuid": "f47e0d28-920e-4a39-ad40-7c7e717ca7f3", "comment": "Malware payload (AgentTesla)", "value": "23f812593327dfb05a5e04e6e24ee1ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666955864, "uuid": "beac1f04-9999-400c-9166-f118ea502497", "comment": "Malware payload (AgentTesla)", "value": "acf69348c6502f0562574dfadc628158b5d460c9e54d2be1fa454f6984aa3029", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666955864, "uuid": "d164d40f-92c2-4f5c-8c29-ed851767708d", "comment": "Malware payload (AgentTesla)", "value": "72ff9d707eade582b81c2b99eff20ddaceceecbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666955864, "uuid": "18f404d3-fea2-4baf-b4e8-53c1ee0f6e83", "comment": "Malware payload (AgentTesla)", "value": "a6aaa340ffc47e56de1de66aaf525beb04ef262baca78ac92419ddc077436efe8efc2d4799536a422ec6f168ead08bc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666955864, "uuid": "be2bdc97-45ed-4922-a8c8-3f7cf489ebbd", "value": "T1731501BA71EBCF03C3BC0676C4E2621153B9D69A52A3F71B654811D94C433E3F992AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666955864, "uuid": "7f477b82-bf0f-4532-a96c-f46e267bd594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666955864, "uuid": "a1ad0385-ccec-451f-92a1-a519fc693de4", "value": "12288:VqXLKBveIxbGoLiNCMqQ5e4eYZzanz/aKF1/5gcITXM8ePt0v7STCyVorLb355wJ:jeIdPbQk4eYJzy1/Oc6FjGHorX3g39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666955864, "uuid": "1b78d010-76ea-4389-858f-e5f0ca262d41", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666955864, "uuid": "4b0f6b87-0461-4f57-ae5c-c84c768b54c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666955864, "uuid": "543708eb-cbc7-4ef9-be6f-6ecb3838216f", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f4ffd4-569f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666947943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947943, "uuid": "0f4298d5-894d-499d-8159-4b942bccb34b", "comment": "Malware payload (ArkeiStealer)", "value": "441adb789163ccb0b28dbdcfd69ebdad", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947943, "uuid": "0b274786-ba58-464d-8e4f-56532aab7b3c", "comment": "Malware payload (ArkeiStealer)", "value": "aecee48e77885753fef3b48411fd1093f2f3da937ef0dab744530bbf452586ef", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947943, "uuid": "1ad4b12e-ecdc-4178-9eb0-9ad886830b10", "comment": "Malware payload (ArkeiStealer)", "value": "5ddddf9035ac9f0d77cd76c8b748167e40a0a365", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947943, "uuid": "3eb0d7f1-b9d2-4c57-8de8-18e357f60eca", "comment": "Malware payload (ArkeiStealer)", "value": "5f05e790b1913c78abf0b98f7c1c1c5476b8fcdcd2d79e69a15b210a7eda0cec463ecfc29da3a64982cf3135103a3a77", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947943, "uuid": "8886ed76-4b46-4f74-9279-b5399cc67773", "value": "T16FC51A135A8B0E76DDD23BB461CB633AA734ED30CA3A9F7BB608C43559532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947943, "uuid": "09efb5be-56b1-4659-ac45-7e633bb253d3", "value": "2bba10bc6e6e0c67365da76653e3e10d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947943, "uuid": "5109de0e-164f-482b-b568-497034b8eea7", "value": "24576:TcIIsBX3zpXipYKYHvwGUvIM6SdCXLdZICqhsZUDlyfzLqztGl3RuQ55313e:TxBntXlXHqh2UDlyfzcol3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666947943, "uuid": "3b958d9c-0bfd-4fc7-b5f9-7a3c3f1245dd", "value": 2668721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666947943, "uuid": "48cae145-ed51-4953-8879-2dd5d5e08807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947943, "uuid": "a306dd9b-707c-4703-9b36-d839dc89ec95", "value": "441adb789163ccb0b28dbdcfd69ebdad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876d5347-56eb-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1666980510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980510, "uuid": "87ae65d2-670d-451c-954c-5c9a174bd6c1", "comment": "Malware payload (GootLoader)", "value": "929f426d029a56f9f0eed54585f19e9a", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980510, "uuid": "4e9bf560-737f-4130-833c-b403b7303486", "comment": "Malware payload (GootLoader)", "value": "aee1cfb9fa275ce8a2285556813f03b69db33a36beaba9826e9021771e1d213c", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980510, "uuid": "9a721a28-960a-4d18-bc2a-616e70fa378f", "comment": "Malware payload (GootLoader)", "value": "c7b69f763bb362cc3e88fc3ac65018a3c67af1e8", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980510, "uuid": "9599542e-265c-4882-8c54-a3b55cf1a31d", "comment": "Malware payload (GootLoader)", "value": "dcd9796a0d80b59e2de16c6d5a160de91717772f0bd120a797fff8af115b82018ad710e33d8dc73d73be85a8216ebe01", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980510, "uuid": "9b0ff946-7629-4d21-80c6-1f25f5ba5dc5", "value": "T178A2E116A4982224607F1A14A05679A3E340FFD04E5DBA32F3C4FAFD5F3A8D84B5466F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980510, "uuid": "fba06f66-7d6f-4bb6-abe4-8e3f996f46c1", "value": "384:JZHfghsVeogVtuMAKZshPs+29L+g9lzp2wAn1em52Q7WkmmIyPTdNxNjVy:vQsVePVtuMAKYs+8LHZ61em52oIyPtNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980510, "uuid": "cb05afce-49d9-452d-9865-d0ffb019d20f", "value": 22391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980510, "uuid": "fbe8c3e2-8531-464f-81a1-579adce26ea9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980510, "uuid": "1ed7df10-cfa4-4683-94ce-7a19d67ea030", "value": "Which sentence has proper subject-verb agreement (59874).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c138bef6-566d-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666926491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926491, "uuid": "fa86c6e5-e7fb-436c-b9a9-b5d288fd3de2", "comment": "Malware payload (Tofsee)", "value": "d77174b94a8b8079f9e9dc4de2e971a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926491, "uuid": "8c0381ce-151f-46e9-985c-1cd8324fe17c", "comment": "Malware payload (Tofsee)", "value": "af0e88b37323792f3bdc3101d5afca19b238b0d3951472ee2ebd63d02a6aa82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926491, "uuid": "765eed0a-4c42-4153-bb01-3ecb0ebfb5b9", "comment": "Malware payload (Tofsee)", "value": "3044e46dcfff2492d498d5ad7b5997f9d15e5016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926491, "uuid": "f35acf60-eac2-448c-87d4-6997e1b7e2ba", "comment": "Malware payload (Tofsee)", "value": "736ef35055946f5ccbfc51a00f12daa388d8c28b65749ae6d66ef287f3d54234d2784f1140cb64e2c8656d47a0d611dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926491, "uuid": "1de0618c-183b-4c75-bd52-c38c823172d3", "value": "T14A44CF22B591C472C3812630842ADFE019FEFC325B6449B777A43BAEAE712C1657725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926491, "uuid": "a04f0e07-32d0-4478-a25a-64f704ea7866", "value": "7b61acf6f32731558508831ea4bb0cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926491, "uuid": "bf030bb6-2d12-41a1-bd8c-e42dbce5fff0", "value": "6144:0AHn6L7+lP2Pd24zgjIWo2hfrdvwSRl1Dkqr:0AH6/kPu1zeIefrWiDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666926491, "uuid": "5b7a9194-ac58-4925-bafc-b342d385e983", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666926491, "uuid": "f291b3a9-9313-4c70-8b3c-82d2de6ad996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926491, "uuid": "dae7480d-6548-4da7-9b4d-640433ca04a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1481236-5695-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943644, "uuid": "70f0fc26-ba14-478e-9bc4-217d43357665", "comment": "Malware payload", "value": "641bd8601dbfe83d30303f645bc6cf2d", "object_relation": "md5", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943644, "uuid": "4003198b-8e1c-4689-bfb1-85c5a09157ef", "comment": "Malware payload", "value": "af39b9c6a7952bfed795975040deaa8746a310ff1af006b95516ff2980e6dd9d", "object_relation": "sha256", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943644, "uuid": "221f0168-5148-401d-93da-17995d72add7", "comment": "Malware payload", "value": "3cd47398106137ebc986bc9f40762950ec79fad6", "object_relation": "sha1", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943644, "uuid": "c5e2050e-7699-421c-834d-1959e6aeefa5", "comment": "Malware payload", "value": "b3cf67d3f6167cc558660f5ffcf871df022a8a5d437a0eb190de349273e2b4f32ede496d946a4bf28eaa8fc3268fd96a", "object_relation": "sha3-384", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943644, "uuid": "caaf1c85-afb5-41f5-a765-20120a7615d7", "value": "T11F472330F4653271E84DC6F405B02EA003F1ACB512AB47C423B57A5F96ABF6EAF64935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943644, "uuid": "4dc3bffd-1299-41f8-9a11-5c91e3942284", "value": "393216:BKDDDDDDDDDDDDDDDDDp+niwUD0pNnQEYSWI87xcWTI7p1jZeAQibk5j7V6e7udh:4DDDDDDDDDDDDDDDDD+UD0pN9fWraoG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943644, "uuid": "0f355baa-23a8-41d1-a551-eb52efed5353", "value": 25006946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943644, "uuid": "e9fde0fa-7431-4257-9653-40200aac27af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943644, "uuid": "5f2ecd04-b9a9-48ee-a0a3-19c7042ed2b1", "value": "Adobe Premiere Pro [CRACK].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c0376d-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666943680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943680, "uuid": "43b1e0ce-455b-4afc-b0ad-1c466b6586e2", "comment": "Malware payload (RedLineStealer)", "value": "87a9975506b6f4e4aa1abe405bd883f3", "object_relation": "md5", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943680, "uuid": "e594c892-00d3-4356-a50f-9ec12731ca16", "comment": "Malware payload (RedLineStealer)", "value": "af6581c13bf3629ef459cdd69887612e13b0d11ac9a8229e97c9e88c404499e0", "object_relation": "sha256", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943680, "uuid": "67d8fd41-eaca-47aa-aa17-cdb328669f63", "comment": "Malware payload (RedLineStealer)", "value": "26602aed238952db0aa0993a7c3e2013f34c4df9", "object_relation": "sha1", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943680, "uuid": "3fb3bf90-21dc-4694-a151-e188ff5e786c", "comment": "Malware payload (RedLineStealer)", "value": "2b254c5816851c21143c9a9facea31601236c065118722e3098f29926270466c59251a675fabbab544a0baa145625bce", "object_relation": "sha3-384", "Tag": [ { "name": "pw 1515", "colour": "#44C198", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vexonex-com", "colour": "#E3D071", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943680, "uuid": "b2251bb6-86f6-48f3-9dea-58ca80edbca2", "value": "T1AB7633D5C774A25CFE2C6A322261E73BA6F5EC39277497FA81818630011FBA71772784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943680, "uuid": "655e4b6c-961e-412b-8b43-9a096474df40", "value": "196608:F+w5v1MneOagM5jvHA993TX0/9IpaR0we0SyKGIdgtzNgjw:RWny5g93TX9paRxeFgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943680, "uuid": "3eaf9825-e4d0-4cdd-b4db-8a65e4e173a0", "value": 7366177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943680, "uuid": "b4ba66a5-ee37-4368-b870-a9019d2fa977", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943680, "uuid": "69a6c0c1-6c8a-41ff-ad1d-2447cb8170f5", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa12e90d-56ed-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666981562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981562, "uuid": "67c233b4-c387-401a-a6dd-25eb4402676e", "comment": "Malware payload (RedLineStealer)", "value": "ed615023c0c5bc9e5b9f1e0777f3b3dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981562, "uuid": "e29bf07c-a4b0-43a3-ba1d-98527218ef3c", "comment": "Malware payload (RedLineStealer)", "value": "af6c60c80c760d3279958f31d5648b7f7fbaf3e4b9f50775dad2a15828f5e5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981562, "uuid": "9ba5c56e-4829-46bf-a19f-46b1bc671018", "comment": "Malware payload (RedLineStealer)", "value": "73eb333352b2e7529da872aeba97bf84eb05482f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981562, "uuid": "2f8a369a-8652-46b7-887b-46f15a9f3447", "comment": "Malware payload (RedLineStealer)", "value": "ad7053dd6a474ebdb6136627e0e607f4acba8ad59ccb630992c71a82bb12ac0320a43542046575719ed55100b89248f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981562, "uuid": "3b5fd9cb-a307-4c77-96b3-085e47b52ca5", "value": "T19484F16539C2D472C5976430842ACEE02D7FB8311976868333A43BAEAE757D05AB631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981562, "uuid": "4c56ecf1-b2d3-4dbe-b7e9-209e82986dee", "value": "c77dd599a098ccbfc3230384663cf2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981562, "uuid": "0017612f-151b-4d4a-bed8-248225701be5", "value": "6144:bcEPJqnLdaA2PdJI8uVC0YfpYl2UOupfTsnC+Lpa6E8:bcEPonxaAIpApmpmOu9snlL5E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666981562, "uuid": "e508f3dd-7229-4cbe-8989-a6002077a53b", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666981562, "uuid": "4016da32-9bea-460a-ab6b-26c63f19fc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981562, "uuid": "7ffeec7a-9417-4a22-8272-95f39ad7740b", "value": "ed615023c0c5bc9e5b9f1e0777f3b3dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67c0d7c-56ed-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666981529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981529, "uuid": "c0fde9f7-5776-48a8-abac-e1e1679ce0d2", "comment": "Malware payload (Amadey)", "value": "3776556daf53e7da67e1f0714c292ba0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981529, "uuid": "5abc0204-d9a8-47da-9028-e794a660c0f3", "comment": "Malware payload (Amadey)", "value": "b0b4664013262a48fa9543ed9c651c34c9a7233678882f16d86e779c0a9a39ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981529, "uuid": "8310a8ce-0b52-48b5-9e2e-67bb0c142097", "comment": "Malware payload (Amadey)", "value": "04b54e2e1bb59cfe0736c03dfe2e8437d99ee5fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666981529, "uuid": "193e9ded-ebb1-4d50-974a-9937447bc313", "comment": "Malware payload (Amadey)", "value": "9ce2b4f12aacfceeead098f15584c13e6dd6cce8837d74ea360441f6a46f22d5c0e175f17c23052d50c6570c3d8cf745", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981529, "uuid": "46045864-2c81-46f4-8018-536c0fd216c7", "value": "T1F954DF323961DC71F4827530446ACFE11ABEF8311A644A4777B02B2EAF753925A7A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981529, "uuid": "5da9f235-aa95-4713-a04a-c5b99a7ba968", "value": "c77dd599a098ccbfc3230384663cf2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981529, "uuid": "e6f8da55-95a4-4f4c-b8c2-b4357b3aa933", "value": "6144:UkdPVCFLSWomUIADz7Nl7lwUndTEvKbIT8:UkdPcFWWowqN9l5dTe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666981529, "uuid": "4e643688-b0b8-44c6-83f7-db8e66f90330", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666981529, "uuid": "dd5d9384-4975-4b9e-88c5-57c6a7f9574f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666981529, "uuid": "8fee66d3-2e13-4f3c-aedd-2a02e8fd87c9", "value": "3776556daf53e7da67e1f0714c292ba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0546737b-56ea-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666979862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979862, "uuid": "9553e9a1-a71b-4a7f-85c2-ffccc5508ea3", "comment": "Malware payload (AgentTesla)", "value": "cfb46b3b7000625e80209bbf06f381d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979862, "uuid": "2c14bc0b-f5ad-4883-ac8e-2b2c0f5fc716", "comment": "Malware payload (AgentTesla)", "value": "b13b19176d4111d7f56f18c93e789f10bc74ea4126a7dc5124fc8b250bba06c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979862, "uuid": "acf8f3d0-7be4-4f4b-b76d-e322e52544f5", "comment": "Malware payload (AgentTesla)", "value": "c9b6e311f5b2913e33d00d0f37756068a0e109f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979862, "uuid": "d67c1190-10a5-4302-a438-cb603cea5877", "comment": "Malware payload (AgentTesla)", "value": "596557f405799d185cb09142b32fa7b8eb86aa3c22c21d47b7ca90e93ca5c63a8d60e586d91f0f97450dbc97696a8edd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979862, "uuid": "c5655bff-d800-4c92-ad9a-9451d4bd8903", "value": "T11025BDA021CCDA63C26825B9CA55E1F01FE2BE72E124E6973CD23CD736FAF568B41505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979862, "uuid": "96d79049-1d59-451e-a48f-650004cd205b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979862, "uuid": "e04b3293-9ada-4be9-bce9-bc2c2f5d2ebc", "value": "24576:J0A6w+06F093KV0J2t6oeorX3g39RXBt:WA6w+06g3KV0Weob3GRXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666979862, "uuid": "feb84935-eaeb-4f18-ad77-02647c59c5f0", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666979862, "uuid": "7d9c3a87-f08b-4d58-bdde-f1d86f700253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979862, "uuid": "91985209-1e13-4287-b0dc-4ba5585acf04", "value": "overdue account letter.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d938303d-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937268, "uuid": "9bcaa0d6-c873-43c9-8d6d-fe43a8a4b5ff", "comment": "Malware payload (SnakeKeylogger)", "value": "921812ed14cbe666f4ee5941f8022f85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937268, "uuid": "71c644a0-81f2-4160-871a-ca3583a29ede", "comment": "Malware payload (SnakeKeylogger)", "value": "b19bfdcf3227f54fae495df05b209614b24ea08b7b48ffef0d8ae818f0661277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937268, "uuid": "a7b44cc5-ccaf-4a56-b5b3-66f163633b0a", "comment": "Malware payload (SnakeKeylogger)", "value": "232f8d5ed99cb45b883752f1e7347db744f254b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937268, "uuid": "4498c3cb-444f-4061-8c9a-6664f57f6b60", "comment": "Malware payload (SnakeKeylogger)", "value": "d223527bf59032540266f069f655d15311df2f9c0128bb2c3d45ed149ba58531914e8d9ab12c35df9166441707ffbf6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937268, "uuid": "341cf97f-2828-4863-b633-4127138705d4", "value": "T10C050246F723F9BDDE2E13B928304C515B76E516248ADE7C6D85229B0C32203169FDEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937268, "uuid": "cafa56f2-13e1-41c3-a08e-51e2a9e4d7b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937268, "uuid": "6fce68be-a835-472f-b67e-8e1d42a26f3e", "value": "12288:7Nh702iNpLe4xwgDwQbLQu250vxkeRn2QyeiRkUTTPYish5n8mlx51M:o1JwgDwQbR250Zn1SR/HVsh53DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937268, "uuid": "f62e67f5-bbab-49c3-8793-ff1e9c9539ce", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937268, "uuid": "c20a0726-cc20-4770-a64d-292b373f1a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937268, "uuid": "dd43cb9e-0f43-4ad3-b8b7-2d128bda5e74", "value": "Payment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbd741d-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994587, "uuid": "c1ad7112-f95a-4f7b-aa77-caba07196f88", "comment": "Malware payload (Meterpreter)", "value": "cfffd8f19174f53ca45cd1e2d3ba73d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994587, "uuid": "c51a8a47-d612-496d-ab1c-84d27daf66a0", "comment": "Malware payload (Meterpreter)", "value": "b1aa956509d3d708d9fcbc32510c448d8fcd476a682015529784af2fa4486ba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994587, "uuid": "0a2ece3a-4ef5-4760-af62-8c61a1ff52c9", "comment": "Malware payload (Meterpreter)", "value": "4dbf8e4a3844aa3bf3a9714b91accffbee8a9900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994587, "uuid": "7afca445-db5b-4655-bff2-b5e4b10d8a2b", "comment": "Malware payload (Meterpreter)", "value": "ea4130230910b26b49187722dd43e867336defe8212417d8439d22110d436bc1d671f457f7f98795d39692b781bf9dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994587, "uuid": "cecba514-8c6d-4245-93fc-77bc238c0733", "value": "T17D73BF42D5C02522C1B5127E1BB53BB6A971E5F62701C2DA368CCCE9CFD2CE0E6263C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994587, "uuid": "1694beb9-c931-425b-b1cb-94f88979cffb", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994587, "uuid": "be2b31d2-0a87-4e68-91d9-731c3f12e929", "value": "1536:Ia1QsObn4901igDZ7R0lngnO8v1Mb+KR0Nc8QsJq39:hx8f1iylRIgnN1e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994587, "uuid": "454704bd-2f6d-4b00-b483-22a6352db83b", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994587, "uuid": "c2dc6ded-5af2-4b7d-bc11-50d3626eb71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994587, "uuid": "852cfcde-2dfb-44ca-b3f1-aa9ab825541e", "value": "rabba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55293df-5680-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666934738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934738, "uuid": "4d7351bf-10b6-47c1-9af8-e56a78a3cb01", "comment": "Malware payload (AsyncRAT)", "value": "cc51b80ddf2f2e3e5bb98c044a273c72", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934738, "uuid": "8415047a-f759-4eea-a905-75b97e7f35fa", "comment": "Malware payload (AsyncRAT)", "value": "b24c75d9e1a26e070994807153641fa82130db5b166dfa2ac79412a7c36e37f6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934738, "uuid": "bb474853-db92-4db4-b180-22f3982f6fc0", "comment": "Malware payload (AsyncRAT)", "value": "cfaa854a28c42d6b226a8850d8a3f2ba5fbc629e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666934738, "uuid": "a38c7ca1-7380-4488-a58a-0b58f7cd5a48", "comment": "Malware payload (AsyncRAT)", "value": "aac1951ebacf83570fe7945a338936df00b26a9e644f68efa345c022c930e9d45e9ca23b3f34462319c7d2d204b4835a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934738, "uuid": "27751323-ef2c-4180-9546-e93cdbc6a47a", "value": "T10064D0DD70412A81D716B334D47A5E796BB9920EC58A8A6A16BC40CC66FDFCB7380DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934738, "uuid": "6acd1902-3dc8-47a1-b563-1bc1d3172bda", "value": "6144:c7bMr654fIae8TF0fbbHhcN70+IX1vQVehh/9UTfPPuyYzha71IPrOdQILF7N:c7bC3q8Tyf20FvoeAf3l1IPrOWIZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666934738, "uuid": "ae4e31c2-e286-4b5f-8945-f0e33829eddd", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666934738, "uuid": "2d4a6e18-de02-4758-9e29-709650a9ba2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666934738, "uuid": "48abee23-723a-4978-bae0-ed6d14608080", "value": "b24_asyncloader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a00a7e-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666949615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949615, "uuid": "920620dc-5659-44cb-bf49-184427e7180b", "comment": "Malware payload", "value": "df0d393b4fbe38178e60d375ac94605a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949615, "uuid": "4906ffb9-c79c-4c16-a3b7-8e6f8feacd35", "comment": "Malware payload", "value": "b2e2800cba233be0507c6ef2adb8a5ab9f3d63bd8d0bdbcd95f365609cc1935a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949615, "uuid": "9d26679c-b486-4946-9f99-f813021da0d9", "comment": "Malware payload", "value": "2d65e63c89e4121725888ca299a7656328ca780a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949615, "uuid": "d67f86ba-10b6-4c6f-80cf-5bf111581e42", "comment": "Malware payload", "value": "941f271f2d7ca4e79cb20495de54cf272433058ec8a02d35b7ae49a67afece835438d63038effbd5e2e666e48c85cd9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949615, "uuid": "c239f300-e7ac-4696-a237-5c3935d8a1b4", "value": "T1F975D01270C0C032C16316320A669E7B9B7FA152EB2E8BCF4716756BEF64AD16613377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949615, "uuid": "9f1942f7-1004-435e-b8ba-9ec5e1679f86", "value": "95775a362cae2a5280b7aa94d498f0c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949615, "uuid": "36ccf368-1395-48ab-a0c1-911140293120", "value": "49152:ePpBMfvIrkPXjtF4aCs/rTyGu5E1ndCuEQp0FB:DwkPXjtF4aCs/SGu5undCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949615, "uuid": "bd0ce9b7-8257-43c4-bab6-f6fe3f0979be", "value": 1584640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949615, "uuid": "e772ac6f-71b6-4d47-9907-2e90bb1e0cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949615, "uuid": "1c31347b-ff0b-497f-be99-94b46cb9c66c", "value": "df0d393b4fbe38178e60d375ac94605a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc50142d-56d9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666972895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972895, "uuid": "1e107774-4e49-4a8f-9d5c-8d08eabba3eb", "comment": "Malware payload (GCleaner)", "value": "cc8515798b71f6281895f275d06602fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972895, "uuid": "3df34fbd-d5c8-47e7-8c2c-1840c1a54b72", "comment": "Malware payload (GCleaner)", "value": "b32ed38eefa1d8043f5116e78f8dd653f59095a7ee5b294c2d14b3ad8b0c9eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972895, "uuid": "901efbd0-5de0-4aac-838c-6f05b0314496", "comment": "Malware payload (GCleaner)", "value": "89b97c40e82bac96453b51ece47ba5a50ce55207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666972895, "uuid": "9b1f794c-6206-4006-afc6-024509be2f74", "comment": "Malware payload (GCleaner)", "value": "e4c434f99a22af06f95b0f87a11bf222f6714d281baf45a1e9612afe8c5ded9c86c65764d0904976a158735e88de5ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972895, "uuid": "38398175-1376-4fcf-b4bd-5106c6eebb45", "value": "T178B5335AFEEAC4B1D5F288358972C2D452723AD7B8364804778CD6AF4F278C25850BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972895, "uuid": "ce8571f8-f8d2-48e5-96d2-4d885fd5f187", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972895, "uuid": "13577fbd-c8a2-4ac1-9600-6bc84f2aec6f", "value": "49152:Z20c1gTY7Vth9H0LwF5ZlQN9cWRMLxph/Zg9aQo+UXW7rKVmA5hq:MvGYXcL0QNyWRMLxfOTBSArqVDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666972895, "uuid": "bd7e9625-52aa-4bb5-b057-e071651e810f", "value": 2435150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666972895, "uuid": "e581b8bd-a3a8-4777-bd1c-a8906f462fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666972895, "uuid": "37b49ff1-22ec-4718-824f-914f97d1bf91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b2e56b-5659-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666917665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917665, "uuid": "6c7d5f3d-6748-48c4-8fd3-4872fbaa1c31", "comment": "Malware payload (Smoke Loader)", "value": "1471c7af84b762fccd5854321e9dba7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917665, "uuid": "4c81c179-17f6-42af-b6e7-7849e8bceed3", "comment": "Malware payload (Smoke Loader)", "value": "b37fbcfc277a49be5515df9030fbb83d8d74e0b4ad2f641eb52b3d16d195494a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917665, "uuid": "5dcf8755-7c0f-4674-af4c-2e53947e0650", "comment": "Malware payload (Smoke Loader)", "value": "a3aff7332f4fb50f9505b5c956f8ed6a5472847b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917665, "uuid": "797dac56-7e8f-4cbc-b53e-86d54654bc01", "comment": "Malware payload (Smoke Loader)", "value": "0a07999485538ccf6e38f62a5564830aae6bc4d8d537a2a2e79397cc2661699598a3d66b337f6b950bfd18c1834f3f2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917665, "uuid": "24b1dcee-779a-4d53-9aa9-75815ae3084c", "value": "T1C844D0317981C872C04525308435DFA46A7EBC3219658A8377A83F6FBFB23D2667625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917665, "uuid": "aa19a272-8979-4581-8dd0-8017ac63e600", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917665, "uuid": "c14a83b2-46ab-4b2d-8596-27b0280566d1", "value": "3072:B9XOztqKVxP6eX15RcfdjdsS3dARtMZKrlDbyEI9+w3M/h31:zatqkpcfr3uYUlbU9+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666917665, "uuid": "28b86003-68d1-47db-ab15-708d04a13794", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666917665, "uuid": "bb2c930b-1429-4f5f-b1ad-7cf7d888f45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917665, "uuid": "f652f32a-7f95-415d-9e53-4761a49b78fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37b0691-56ea-11ed-9266-42010a9c0072", "comment": "Malware payload (SystemBC)", "timestamp": 1666980208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980208, "uuid": "d87be46b-0dce-4e43-b342-ff7720ddfb08", "comment": "Malware payload (SystemBC)", "value": "f57290a3fb2a9714e880f92a4ee1f22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980208, "uuid": "fac0a845-aec2-4d57-b403-d18b08cb29e0", "comment": "Malware payload (SystemBC)", "value": "b3c506f89220c76008795fdb56d670380ab58d952065c891f75a8db54b84ef8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980208, "uuid": "4f7dd89a-33be-4fc1-9e40-a159615f53d6", "comment": "Malware payload (SystemBC)", "value": "25249086768b072a7f0649ab9fb60fa4e3eb95b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980208, "uuid": "92612b72-a3ee-4dcb-90ea-e2a1f6b88483", "comment": "Malware payload (SystemBC)", "value": "803a7634ece465658155e818b9bd1de6340605ec8180b50482320880bf0894482eb05fcbe1edcaa9fd0e5bbb2400a3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980208, "uuid": "f60204f7-a500-41f1-af73-e1aaf1c650f3", "value": "T152A6C0A13609B3CFC44E24FC9416CF47AAB943B74624490DE8AEBABE5F13F45354AD24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980208, "uuid": "e887f271-f134-4a10-9538-22486bca0bb0", "value": "d11871fc716f77feec71c42bf958e3e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980208, "uuid": "b2e1e3c6-b153-45e5-bf98-32cafd701362", "value": "196608:puiEfVsQ+P5VBqvpxTle/y89BcDmwIuAOie1M:pdrnUvTm9BcDm/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980208, "uuid": "17a9fc8d-03b8-4eb5-9e32-6da4e9e9c00e", "value": 9548944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980208, "uuid": "1cd6ab8e-5d07-4f2f-b136-f58599828676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980208, "uuid": "3aeb2854-a6b4-492e-a0a0-11ccffec1a89", "value": "f57290a3fb2a9714e880f92a4ee1f22a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a7336-568f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666941049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941049, "uuid": "0925aa1f-4445-4859-90df-7dc5f7a8f74a", "comment": "Malware payload (ArkeiStealer)", "value": "61a925edd99f92d6aca205cb8c68de84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941049, "uuid": "85f58b84-7748-4723-bde9-fc31282c6dbb", "comment": "Malware payload (ArkeiStealer)", "value": "b40106ff8758aafebd4a521af40467b1693537bce239bea4b07deac8ea925f93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941049, "uuid": "e573dd3c-c49a-464c-9328-957f4decaae3", "comment": "Malware payload (ArkeiStealer)", "value": "7d6b695ee6329a3a30731deebd5db94f849083b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941049, "uuid": "8ef59dc7-b1c0-408a-8cc7-1c154e20ce14", "comment": "Malware payload (ArkeiStealer)", "value": "88c207b6bca08cad619a6209c80bd0909351d5ec450c5bec1afa7f2f585fda2ffea5bf7eb25b72f7c90d8a13c5dbed24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941049, "uuid": "b4e2ee58-a29e-4b82-916e-944ace466304", "value": "T1E174F1317553C471C08D063C443ADFA029BEFE352963468777A8375FAA71381A6B661F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941049, "uuid": "c885e83b-8218-4004-a5e2-e5a37a7e580f", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941049, "uuid": "918fd4ac-7df5-454c-98a8-871c0552ceb9", "value": "6144:9peHwLG1jejKutaav59nMeG0SUidT6xS+wrjHncilUDFJeGgglZwj:9peHwqFeeuL9MpNUigx/EjcilKgIqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941049, "uuid": "b2ff014a-b452-4cc5-922f-b36e7172ce03", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941049, "uuid": "fa2d3b25-70de-48a2-b639-f2ec889b30a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941049, "uuid": "c354eaf2-0edd-40ed-9985-546b85105fa3", "value": "61a925edd99f92d6aca205cb8c68de84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a530a4-56ec-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666980740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980740, "uuid": "f5493864-a42d-4d3a-aace-fa850b49e46b", "comment": "Malware payload", "value": "8fe0051f967d8276ff203606cc1a6b94", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980740, "uuid": "7b93b9c3-2d4f-4db2-bf82-bc01e1268a5c", "comment": "Malware payload", "value": "b4b59d3b8d088c432e5ce118f5c1483db4a0b96eb2ef4c0b64dc4760c6278688", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980740, "uuid": "f6bc4fb5-a0a4-4d4d-b669-15021e118e24", "comment": "Malware payload", "value": "f1e715c8bd66f134a2963026e509668d310fd180", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980740, "uuid": "95528783-313c-49ee-afc9-ba7975092468", "comment": "Malware payload", "value": "372f9f763ad122bf4b3fe5371d86f07bd6d398d645910f4baa1d6e07ccb1c0d9e946c8f1be2dd9d33e5e14f3d8030683", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980740, "uuid": "2d67ce39-1f60-4b50-8e9b-d18bae0a291b", "value": "T19F9402053345DB82D5EB47B49CD385D34A02FD65BFE2828B3182B3AF1D707528A267AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980740, "uuid": "b3f89dc3-059c-4358-9ec3-faf075936d4e", "value": "12288:4dNqrDx7XXXXXXXXXXXXUXXXXXXXrXXXXXXXXEmYzTm0fwSiSxKgFVF:Dr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980740, "uuid": "5f40a350-9122-436e-a5e7-744742ec1183", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980740, "uuid": "2fad03b0-716a-4123-9c12-167cf2882b8b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980740, "uuid": "74ebb194-61d1-445f-aa15-bc68142e6264", "value": "Draft shipping documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a0a8a8-5694-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666943277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943277, "uuid": "ba2abbe6-03c7-460b-a4a4-8d99e33fec27", "comment": "Malware payload (GCleaner)", "value": "b2064277a80d503fbd7546e0acb4467d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943277, "uuid": "b459ef10-bfac-4eb8-a743-2491e5c3ca0e", "comment": "Malware payload (GCleaner)", "value": "b634568b4551290a2e0c537d4346b14928fdf341e1a93426bfa29566dfdc66a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943277, "uuid": "8f4c52e4-d886-4006-9ef3-f24d4468143c", "comment": "Malware payload (GCleaner)", "value": "c07726e432cd7ddcf969a99bec559c83ff23b21a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943277, "uuid": "d897c082-a279-44a8-b508-02155d322258", "comment": "Malware payload (GCleaner)", "value": "c43d37c46903916eae3520d155c51bb497136f47e572c62455839de0ca292fde759dd1aa8f3f2641a7b53ecd8e360537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943277, "uuid": "4cd954e7-1cff-4152-93e8-c0c59bf07f42", "value": "T104C53307E6D79834C0B2C47A8D7664D082BDBF715C382864797C68CE8676CCACE91F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943277, "uuid": "d2ceb9fd-bb94-4fb2-bfd5-b51bb488c34e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943277, "uuid": "128193c7-c105-4a99-81db-8462eebe0681", "value": "49152:Z2UnDrSJGMIqXaRpXQFUIYP18L3yyxJFw4eJlq5KUivvYfv6r65ZAA5hq:MUnDrSJvxSHNyTubaKfyZ/Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943277, "uuid": "5c363462-9d07-4bea-9b82-56fa87ac2d67", "value": 2597276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943277, "uuid": "92d9b952-5359-470e-ad72-86082d7a5c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943277, "uuid": "d9865d9b-ee9f-4ec9-a137-f9fd190960df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d422a85-56d6-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666971527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971527, "uuid": "0e1b8b37-adf3-4708-9471-fe59d80ad7a3", "comment": "Malware payload (GCleaner)", "value": "8304c8a846f1bf7588f9cc5567ad5f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971527, "uuid": "dabbb5d8-a502-447a-b8db-e0c6369f8c34", "comment": "Malware payload (GCleaner)", "value": "b6ebcda08519b82b4ce8d01d5372874f79b25df23179a7c972d1419931869aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971527, "uuid": "a946a1e3-3894-46a2-8f74-d05538da830e", "comment": "Malware payload (GCleaner)", "value": "1a83510209139986ac8a84930e3cc4819cdbe9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666971527, "uuid": "37bec2ec-a9e3-4e7f-870a-205fe2cee1f7", "comment": "Malware payload (GCleaner)", "value": "5c4e4ee044d9cfdaaabbd3cb8d1c09f4338ed8bf4156ea95f29899d45142ca400d6bfab28b53f5f796a15e4eb307f45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971527, "uuid": "b9d21a29-e82a-42f7-b1ab-3e08d623068e", "value": "T14464F0327D92D872D49A35308136DFA11ABFB83118614A4377F427ADAE31BD0997638F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971527, "uuid": "3146c0c4-caf5-466d-9a3d-32c664974c04", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971527, "uuid": "e738cf05-4c42-4b8d-a383-42ad87c12f44", "value": "6144:NjHXLNn2bGlaGWOYUVDsOhUkoIrG3uaepthxOuSkWwULq:NjHXh2SlaZkVDsT9ut5thXSkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666971527, "uuid": "77b2bac6-57cb-468f-bb56-9b9759cbe955", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666971527, "uuid": "d3b8a75a-45fd-437a-aee0-267ad5289601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666971527, "uuid": "b01ba02e-3590-4044-88b7-bf6c5a67f7df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f069fb-56f5-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666984830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984830, "uuid": "e5f90c9e-8738-45ff-910c-625504970c93", "comment": "Malware payload (TeamBot)", "value": "9f240f5dd3d7a219f0b02c52b585e96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984830, "uuid": "b702e1e0-3a72-4bc1-ba91-dc372683ab47", "comment": "Malware payload (TeamBot)", "value": "b701f46e85a0ec5612e542a21599f40a58a5681b01118f295435149007967fac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984830, "uuid": "95ffe273-195f-47f3-be81-795437f818b3", "comment": "Malware payload (TeamBot)", "value": "cba57432089685a7336998f48d15b594b2e0b652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666984830, "uuid": "1d6f9113-ef84-49a9-87a8-cb04185f8f56", "comment": "Malware payload (TeamBot)", "value": "9281898767cfd8c1e17e53eb60a453900152c0f3c1c4ad852f0bda492522dfd1f62823f3c1e84f343cd8cdcadd013eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984830, "uuid": "8503f71b-5ac4-449d-b05d-465d1d701033", "value": "T14244CF317AB2F0B1C48611704466DFE03A7FB83119A8494337A42B6EAFB53D19A7635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984830, "uuid": "9bb1a3b9-5cce-4a8e-8d95-3e7590781eaa", "value": "c77dd599a098ccbfc3230384663cf2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984830, "uuid": "861e2b36-b98e-473e-b358-562b3f8db4f5", "value": "3072:HXORDEoPsXZoLAFXSbF7n5wuLJeJle3E+FHHzwHSbdRXwozM/h3R:3eEoP+ZoLASFB4JkE+Fnztbrw48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666984830, "uuid": "a95d7d9d-8481-45ad-a82a-ed89e69d6ae3", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666984830, "uuid": "61eafff3-5e29-49f1-8fc4-f4f25a89647b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666984830, "uuid": "8cb5af88-7cf9-47db-9987-c075273867ce", "value": "9f240f5dd3d7a219f0b02c52b585e96d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656d98de-5679-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666931491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931491, "uuid": "0164352f-eabc-4553-b5c5-2db2ba3c517c", "comment": "Malware payload (Smoke Loader)", "value": "38ea4847ffed3cf102b3c0a6d866f2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931491, "uuid": "9b84c7eb-209a-4194-a455-03b7ee42517d", "comment": "Malware payload (Smoke Loader)", "value": "b74f8096c3eebe6982ed33f6c0c435bd168e4b46478f27465a464875b6bcedfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931491, "uuid": "04aacd9d-992a-4492-adaa-bb5075d290e5", "comment": "Malware payload (Smoke Loader)", "value": "8679f957ec2f366bca3dd5324413fe3ae60b55f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931491, "uuid": "f46b1c73-44f5-4bda-9f66-ca92f8811348", "comment": "Malware payload (Smoke Loader)", "value": "e605474ae20c904ebfe09963f6df6d5c0bcd3b3499da56fddcc5d9fbff126dc6d3ff839fa6ed1aab4b0603cc1870be84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931491, "uuid": "9ba96c23-8a1e-4394-a7d1-9fd8e62881dc", "value": "T15844D072B982C471C48016304836CFE129BEFC3159654A87B7A83B5EBE723D1667A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931491, "uuid": "08df51cb-a588-4160-b842-efc0201d5ae2", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931491, "uuid": "f1207869-64b9-41b0-9ed4-f6636ebae9e6", "value": "3072:0mxXO0lqHdQjLgWzlqAEKuoGBfmlk5bbhAaLpwERnyftM/h3gU7:JV6HOLgWzl3ubBucbhAFEWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666931491, "uuid": "c4276100-d64c-4e9b-a45c-d9b0a76b6ba4", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666931491, "uuid": "04e40698-9020-42f8-bcb2-4c8a6eb4b31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931491, "uuid": "1f054cd7-1d57-4810-b540-b17ff5b60a7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d9d335-56f1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666982865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982865, "uuid": "1bd009e3-2dec-4284-bd55-1f7556ca26af", "comment": "Malware payload (GCleaner)", "value": "1bb4a3c2d8bd4afb972a0b107afd3ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982865, "uuid": "519775d6-d6ae-4dd6-95c9-24e129668e17", "comment": "Malware payload (GCleaner)", "value": "b7b0dea77586bf700a6805164cebd665eefb9099e9d2181f2640a73b5190a563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982865, "uuid": "9c5f0e1c-c342-4de4-92e6-ac13282d9b9e", "comment": "Malware payload (GCleaner)", "value": "7a3a4deedbe7d2e564f2d83151c5518657126d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982865, "uuid": "e126aa86-cb09-4ed6-a597-7229feedf410", "comment": "Malware payload (GCleaner)", "value": "8813f806153427bc7ff800d330b5871686e17a77c2bcede5fd99d326c000aad213855ff5e967880627777e8137ced5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982865, "uuid": "f2cb634b-4db4-4d85-8a58-4d6411fb3348", "value": "T12FC5333A49C5CA20C0B19DF98F1F4970CC3132C5A5276C0AB8DDDD7A3A6A7D6B602779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982865, "uuid": "ca66b5b2-949e-4bf7-8224-80f2710744ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982865, "uuid": "54f19391-2907-4c8a-92a5-759ca2f1fc52", "value": "49152:Z2sFfpB+r41Yd9JwIeyVPwxE3IJzojUYxlm0jXf0dvliA5hq:McB+rcYd3teyVPOE3I6t0d9ZDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666982865, "uuid": "c5389626-c77c-4a7e-b599-027ae9ccb9c9", "value": 2575356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666982865, "uuid": "67e48ca3-31c8-4689-968a-526eb1c83842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982865, "uuid": "6bf3552d-4ae1-498e-a542-b3cfe71ae0b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88922c41-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666959037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959037, "uuid": "7e0e162a-3a40-4325-aa41-7af1ed289046", "comment": "Malware payload (Tofsee)", "value": "10a6906edbc80f923af9cf298fe01d54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959037, "uuid": "4b0a2cd4-6129-4525-b26f-b326f9a4b08e", "comment": "Malware payload (Tofsee)", "value": "b8073208192dd8e839a3253b7390d2d7db9722832bc049c3a5fc6219d7dab428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959037, "uuid": "be150b60-944b-4ab1-946f-9d72aa277aa1", "comment": "Malware payload (Tofsee)", "value": "76cf48a3fd3be771bb65cc4ae295196e926e0c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959037, "uuid": "aa9bcb44-1ede-4c58-8da0-5c572a8b7149", "comment": "Malware payload (Tofsee)", "value": "7103b880eccbeb19eb65d755dbe6ddeb9755a2496e3b2acb6d7a56824004c67e97b41c9f0f8f3d27455a5f5419801912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959037, "uuid": "463566ca-4f6b-461f-8ecb-340e205aeb39", "value": "T14E44CF3576B2C073C3862230442ADFA17EBEB83116B4498737A42B5EAF713D1966631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959037, "uuid": "102139c2-fc98-410a-a24c-20048ca9f301", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959037, "uuid": "ee0e99d7-ad53-42b4-a53c-547bd3092a19", "value": "6144:/hH+L8ZJpCtK7F6ylV8Txe5g8spMvLNC:/hH+KJAmF6yUv87vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959037, "uuid": "249a6160-057e-43fb-8898-cb498de24c79", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959037, "uuid": "c25445cb-8f21-4973-b519-6a5d64d49b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959037, "uuid": "b81b3748-a3ff-4a0e-a359-24ad35879ef5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9dcef5-5681-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666935100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935100, "uuid": "f958d6d0-c364-4570-8b0c-c699b20bf365", "comment": "Malware payload (RemcosRAT)", "value": "ca9830c48a3255042db20184dd9c2502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935100, "uuid": "ca6c668f-b1a5-4b9d-937c-711ccc875b9d", "comment": "Malware payload (RemcosRAT)", "value": "b86c307f6c68c014f36459c536b3d89eca668cd367b297d8122d08cbc5ce7632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935100, "uuid": "3ed332dd-096e-44d4-9e43-2c560bcd61ac", "comment": "Malware payload (RemcosRAT)", "value": "d1833d2491258ef936421e8354337dbd33958810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666935100, "uuid": "6efe5019-2bdd-4edc-bb64-bb9f9eca4d02", "comment": "Malware payload (RemcosRAT)", "value": "5143d364d319448d997a6a70180165bdb416f3a28f8a615d2fd6ed72cf2fcc1b35aeef9dec13055e567cc63e22284ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935100, "uuid": "70e2cdd4-067d-4d5a-96cd-328969c6524f", "value": "T1AB452246F623FDBCDC2E03B478795C616F339951748ADA6C698623EB0836203568BDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935100, "uuid": "6ff7ed2d-262a-4dcb-9706-43f9992d0e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935100, "uuid": "fd0cf6ec-04f2-415a-ad6f-feb04c43bee2", "value": "12288:YLh702iNpoV8YK+OFLTrcYWkfzUWVLGZSJLTFQgwILD4EbNNDoiMctGUzFF2CqoP:J16FG3WkJnTFQzENC2tVb2Ch4ArR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666935100, "uuid": "1234db81-39cb-48a3-ad59-aee4f20a9982", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666935100, "uuid": "17bf0564-5087-457e-b997-390e1c91a302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666935100, "uuid": "428811d5-d8f2-40dc-b1a0-bc4dabf8da76", "value": "orden de compra PO#43576300.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797af7b2-5705-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666991654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991654, "uuid": "a58f5d32-1e35-4725-96bd-b9de8ee6b1c1", "comment": "Malware payload", "value": "b0126a827c1ac1a264baf701bbbca5d6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991654, "uuid": "6f7a6a94-aa98-45fd-b009-8f2e05b69316", "comment": "Malware payload", "value": "b86e932aee044d2472233a1c6482962e024e8ca5149da5f793bff7d37457ca3c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991654, "uuid": "8ffce512-349d-4436-839f-707a89e626fc", "comment": "Malware payload", "value": "aab42562d7cd7eba8aebda88c070d2d7e27061d8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666991654, "uuid": "fe8e671f-8f74-4cc7-aa7d-04dd5d3f1bbd", "comment": "Malware payload", "value": "e98d4047f5973e0609cc11e9d64eb14729ddc1bf29734d15e436075c6e355bc3ffce6059ab10a41418e5502c2c5f9c9e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991654, "uuid": "4e1cce3f-1e92-4a5e-a420-6c8376eb50f2", "value": "T108F52313F261961BC8F6D33620791639907A8D58DB07BB8A3D48B7BA28F7DD80F855D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991654, "uuid": "3cadfdd1-7873-4869-bc4b-548b37e307a9", "value": "98304:NqO6efffnRcj7jGPJqRMVMZGZee6D4s1U4Rz0:NRXcXgwMs1U4Rz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666991654, "uuid": "f7afc661-bae1-4f88-be3b-bdac10e91e4e", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666991654, "uuid": "ef93ee9a-b7f4-401d-b93a-868482ccf424", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666991654, "uuid": "26249490-0ee7-4875-9e16-4746137c71be", "value": "Live_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595de447-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666949509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949509, "uuid": "d4c0b0f5-24b5-4092-b533-5720cd7127e3", "comment": "Malware payload", "value": "96c260683d5ddd69915ee0e241531337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949509, "uuid": "acd043e0-dc84-4057-aab4-b5c979adefc8", "comment": "Malware payload", "value": "b874044cbec881b3de5373c444f3eed3b581d96240dd5e1a92ef75ed1c026a68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949509, "uuid": "08d6ac4d-ff5f-43b1-87a0-1c59dd98d55c", "comment": "Malware payload", "value": "d62ad61e4e4b9298c92f1a6e6eba93f0fbf92a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949509, "uuid": "f59b1b3d-a762-4a64-ac11-09b60a492370", "comment": "Malware payload", "value": "8f485dc166994def2c98d56750727708c7ce86f0f7e551f63f214613840d226900b84a18122bb01863f955413eedd766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949509, "uuid": "a3f86f46-7215-4b2e-88c5-eb15f47f64b7", "value": "T10484F6C2F76DFAAFC2FD3534C4929A608E6CECD15706771B9214B26FDAF019008296B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949509, "uuid": "c804c9fa-7bda-4747-8f25-3968a3509bb6", "value": "67f8eb0b4da64d2b6f85b364cf9dbf3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949509, "uuid": "7a12ac2e-39a5-4016-aac5-5f77a19d204d", "value": "6144:LNv1mi6m9BStFprRxFb+K4zg0ecFr8WOhU1dcQn1s0Me/vPcH+Mve5XF8mopH634:LNFhpfrrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949509, "uuid": "161823ef-1be2-43d2-bbbf-0aa29b970da1", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949509, "uuid": "dce4576f-707a-4ac2-b266-540dfc204763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949509, "uuid": "5c1ccfa5-8dc6-42d5-aa4d-69c9183f1e6a", "value": "96c260683d5ddd69915ee0e241531337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a0101f-56a6-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666951053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951053, "uuid": "1c468370-d19a-4cd0-bd9a-c72d9778a6cc", "comment": "Malware payload (AgentTesla)", "value": "bd9d82b9351a0fb45c5f4815aaad7ac2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951053, "uuid": "2ca15300-18d2-4015-9c67-c9784cab7b2a", "comment": "Malware payload (AgentTesla)", "value": "b8b249936aaeaae04dbd00466e4904bed00ff001aa9f7c7020adf0ec2081c397", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951053, "uuid": "ce7bfb1e-d223-4a22-9a19-aaf4f294ec50", "comment": "Malware payload (AgentTesla)", "value": "d26d940bd9b3a70a4004118855112101f45aaedd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951053, "uuid": "4d175e37-e93e-4992-b7f3-90d39f726579", "comment": "Malware payload (AgentTesla)", "value": "c3db0cf0e44caf099d3b30240ef9868c251d470f73c91e08ecb91d0d3dec5554a614f21e8131b66a61a063a3bde7ecf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951053, "uuid": "765ac65a-99c3-4e3d-aa6b-85d4d40dfb84", "value": "T128F4C03429EA522DF277DF705FE078EE89EEF6332706B46A149107C64B12E41CD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951053, "uuid": "ad728335-d20e-4d2a-91b1-176664f472fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951053, "uuid": "2adce730-b033-43eb-9026-8a8029d688bf", "value": "12288:cS7AgHtDg5xE1vUOsAQeql5ExQRlNS5xub6AhYXIGMdVorLb355w3z5LErq+:cSN4x0MExQPNS50HhAVGorX3g39O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666951053, "uuid": "59f83757-f815-42da-bf48-a37dedfec7dc", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666951053, "uuid": "a598ac58-e1f1-49e1-9541-690c48f6a51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951053, "uuid": "23d8686a-4ed5-47ae-a8ab-0457ccca162e", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec088a21-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666963929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963929, "uuid": "fc39f1bb-79d0-4183-883e-54a7bb77cb7d", "comment": "Malware payload (Loki)", "value": "50d9d10506adb6700bb3e0df6d17a5be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963929, "uuid": "5920c918-0dd8-493d-bc0b-cd7fe70d80a2", "comment": "Malware payload (Loki)", "value": "b8d864b09ba66e1cff809b9700c8ef000b2d4ccbaba47c5da69bb7cf44a28795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963929, "uuid": "9c72acf2-0698-4670-87bd-39322b57e3d1", "comment": "Malware payload (Loki)", "value": "e11b8c33ea7fa0618fbca8ef6828c2081835e944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963929, "uuid": "e92d3868-0be6-4ee3-bfa7-b53b92af29d4", "comment": "Malware payload (Loki)", "value": "73fa7d8b6eaf86fdcc654e2603973cda66cf04b391620823263126f319fcf603a3fc0525d4fd1280d018903b8d3f1fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963929, "uuid": "9ea531ab-0717-4e29-a4bd-2ed0d947319a", "value": "T11D04126372C2C8FBD413073259F9A7E5EA39F3242469A10F53F86E7B15226C3E126497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963929, "uuid": "3f46f5a1-9bcc-4fa2-a781-44604dfeed9a", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963929, "uuid": "5413cc5b-155f-40ee-a7bc-da1d3b179aaf", "value": "3072:qUJoFfWzzl+cSMGGKeoyShiKF9nc+PAukezQLVqM+ZPjZag0dWvsqDbKAnrE7t6D:qweEpGaobF9nBAukeELV50lagLvn+Ao+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963929, "uuid": "c21e1b62-6126-4e35-a4fb-9108498c6dca", "value": 186605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963929, "uuid": "c6f12a2e-b469-4852-9667-8fad80e2b673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963929, "uuid": "70c27b94-5515-4791-afcb-ce675ed32990", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840b54f6-5694-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666943138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943138, "uuid": "29957d3e-353e-4305-b623-bda6f4ee3ef1", "comment": "Malware payload (Amadey)", "value": "fc714cd93d4c1c10c8987efd5615c0fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943138, "uuid": "24eae318-e95e-4547-bed3-f206648c701f", "comment": "Malware payload (Amadey)", "value": "b91a7f77b408c765dad293b41f969108ca7950cf730b661b9c3b898cf79fbec7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943138, "uuid": "98ac992f-398a-4812-bde6-c3433cbd53fb", "comment": "Malware payload (Amadey)", "value": "7c7d4cd350c1384b3e43ac0f33b4a1fe4363fc24", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943138, "uuid": "1ff862e7-7d9e-4303-adc6-dab239b8ff18", "comment": "Malware payload (Amadey)", "value": "b83db1c8de2a18dc438487619fb5b251d6b106ef95e45940745ec4e5ceeba46fb985a408cdade9d5b38a4e59ea3373ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943138, "uuid": "3c669f28-df68-46d7-9ba6-e17d2180d5ad", "value": "T12664CF327692C871C4851134483ACFE1297EFC317929498777A83F5EAE713D1AAA631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943138, "uuid": "9537654a-b556-449b-8b5d-f9607bc87593", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943138, "uuid": "0cd4c565-4440-4f9a-ad78-9fbdfa9e716f", "value": "6144:RolHBLZUC1qKu0zFdJfW6iZJuxWplFMyAJSRj:RolHBdR1Du0zpToJ9HMmRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943138, "uuid": "82285229-2c08-4740-b6fa-b1d5ee17cedd", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943138, "uuid": "ac5ce951-ec6b-44c8-befc-baa7cc54d605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943138, "uuid": "83f7b357-b67f-42b3-ac70-8a3150884249", "value": "fc714cd93d4c1c10c8987efd5615c0fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52350a25-56de-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666974838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974838, "uuid": "ec4b8980-0eea-4246-8e88-1bda0c9eaec1", "comment": "Malware payload (GCleaner)", "value": "d192504859e7969633e66e702d4de232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974838, "uuid": "945c3a46-b45f-4248-a179-980e59c2eee3", "comment": "Malware payload (GCleaner)", "value": "b98699af25b884bace694894681f844182bf4bab884f27d8f2344cf8161eb5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974838, "uuid": "89e290dd-1cdf-459d-af3f-cf109cef4c0a", "comment": "Malware payload (GCleaner)", "value": "f11ff46d0b417d8eca6eee235b859f7f0161fd43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666974838, "uuid": "853c0ca1-20ba-49cd-b14f-5ba897dc8b4f", "comment": "Malware payload (GCleaner)", "value": "ee452146650a9f1a0c6ad25a5c402e73c3a454aac33a132245931957fad3c673327479eab48d93e7eb2d9a6881300176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974838, "uuid": "caaa6682-a715-4468-ab38-ad0a3e68cf6b", "value": "T16CC533418A66C2B2D0E15975BCB6D7ADAEB723760D6DB92430D8C8EE5D3BC41CF90390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974838, "uuid": "a148270c-ed2a-44bb-9164-da68dd2341c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974838, "uuid": "2ff9b97c-60bb-4f3c-b938-6b0bccb3fb01", "value": "49152:Z238v6xjR8d5NdexRPX3HzSD+t5neZFRrteC5dkk9LFA5hq:M38SMkf3Hl5eZFR5xzBmDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666974838, "uuid": "4c054d35-216f-4ea7-b7cd-e0ca96435470", "value": 2578440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666974838, "uuid": "933dc52c-7e1f-42fe-bc1b-b03bb48acd8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666974838, "uuid": "dd74c62e-98a5-4c78-a3ea-b92e522b8098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca9dc5c-5697-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666944629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944629, "uuid": "0ff03cb9-ef6f-4125-aee9-7075b4cc30a6", "comment": "Malware payload (Tofsee)", "value": "95078f8be60e5fc73fdc808225753942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944629, "uuid": "33a5d6ba-fc52-43e9-b84a-0a5c214ecc04", "comment": "Malware payload (Tofsee)", "value": "b9f20c98571a978d095810d68c3b3f21155b975932b34910618e8f862ad33b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944629, "uuid": "413f861b-8a03-4cca-8ed9-aacfca576d78", "comment": "Malware payload (Tofsee)", "value": "57324f1f25f74dc2878ec0e5af0c77e83125e7ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944629, "uuid": "cd065ec9-4b4e-435d-8706-86654154148a", "comment": "Malware payload (Tofsee)", "value": "9fe08a884a137852a946a21496ce2bd953ec47bb6cebd4c4ecab307edf601b24e04b14403f3edf14009db665265fc270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944629, "uuid": "0d73e970-14ec-4d27-b330-1480f32a961f", "value": "T1CB44CF317691C4B2F08612333429DFA0D97EB83115618A8737A42F6E9FB3391A76635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944629, "uuid": "82a60ddd-5e3f-4dc6-9704-335e96bad3b9", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944629, "uuid": "98538448-45fd-4055-a7d0-533bfbef5777", "value": "6144:auHHJL7MppvYdoKrTDbvxDu+260932HJ:auHHJ3+pgdb3vmF2HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944629, "uuid": "5e2c0594-dba8-4c22-938c-fc86c55089e5", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944629, "uuid": "c936e2e3-3712-4206-862d-5dc7cc64ba4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944629, "uuid": "2ac4c58a-adab-4658-8483-f46a6e031bed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97de4503-5701-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666989987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666989987, "uuid": "66fd8155-1ee8-4b7a-8a26-d39fa9f7b326", "comment": "Malware payload (GCleaner)", "value": "9b738e724f4cc26a6c424593ca6a33fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666989987, "uuid": "be53f40a-6a78-4bbe-8ab6-e0ba6395d51e", "comment": "Malware payload (GCleaner)", "value": "ba2a1a5710ca0fdf98f8227e2865be783e96e46b2956934709b32b7851433bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666989987, "uuid": "dc5c5d83-c6f1-447f-8c5b-2d655faaed36", "comment": "Malware payload (GCleaner)", "value": "dce2c64bca55636521e2b11e0c95ec1e48a3dd06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666989987, "uuid": "ddcf013d-c50b-4a6f-9b7a-fe03dfbc8ee2", "comment": "Malware payload (GCleaner)", "value": "b3dfe883d82bcc73ca43f450fa730ddbada66eaea5e824d01915bef964ba1864f4564065826eb3b38321a7ca2ea6cd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666989987, "uuid": "4159dc2c-ec01-4785-b6af-c2a33dfc878a", "value": "T114C533016F909274C1148C30AE8FDA54AA77AC722C68F42DBAECD5DD9F33095D92E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666989987, "uuid": "2d0e4669-5199-4e31-9885-dc9fb43df5b3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666989987, "uuid": "7b7dd816-a6d0-4f5c-8edd-430fe24c269c", "value": "49152:Z2jFNlOxtmow90U3fMEkE0N/6XdQdOCPTii+5CrkgKj1MMHqcekA5hq:MrAmr9F3fMEkL/6etTiiA+i1MUryDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666989987, "uuid": "aeabbb61-e59a-4f39-8161-b17c4a10270e", "value": 2587959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666989987, "uuid": "1139876d-51e6-4c10-bc69-f2cbfa1c4d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666989987, "uuid": "39c66627-235b-49c6-be4a-4a6e875a4b90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38758c8-56f2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666983671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983671, "uuid": "cf14f55f-a4da-487f-8a10-b94c356291d5", "comment": "Malware payload", "value": "b0119d5f207b8760d397457b2f37a310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983671, "uuid": "d6637fb2-329f-4499-a3b8-ff90201f1399", "comment": "Malware payload", "value": "ba3dcb22690e011caffff1c9c0f327c61a26fa16ae987222bf6df35d5bd44458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983671, "uuid": "20ef4820-d291-4a71-8d64-36695bfd777d", "comment": "Malware payload", "value": "92d5d5529933c570e4413d8ae6546b0bf76dd128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983671, "uuid": "52f9de5b-e542-4dbd-9056-0d964aaef528", "comment": "Malware payload", "value": "24c2865f7536322ed5087a3ea90b51b5725b219322f8293a932afbfe48e2492c039e03c6a7864384d36aaaaa602f6d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983671, "uuid": "eda38371-0181-4c19-a541-bb7a52587691", "value": "T18BB633A74BB1EC5BCDB883B1BE00931285A1BCB2C4532A15F10F9795876817E7BB72C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983671, "uuid": "b16778b7-e4b2-4c1d-adec-5b81f879ebcc", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983671, "uuid": "6172f5cc-e7cd-466b-b383-7e122f598487", "value": "196608:KV/dL1Ow70JWCFNwxrGxLCZvAbY6wuhaJ4dXF:K3L10/FNwxaxLCZ8Y1waJ4hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983671, "uuid": "26d49263-8141-442e-8deb-2f1fff563503", "value": 10461928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983671, "uuid": "fcc14db8-6025-40ea-8408-bc9593cac19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983671, "uuid": "ef2698cd-bbee-4c8b-b90b-97e187d238d0", "value": "b0119d5f207b8760d397457b2f37a310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd3f2b6-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666949064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949064, "uuid": "f9cce83e-5a31-461c-afd3-05f08894cabd", "comment": "Malware payload (Formbook)", "value": "bfa74263a6a71c90851fce876b6c21f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949064, "uuid": "3e068bca-dc4f-494f-9187-5edd45942cb0", "comment": "Malware payload (Formbook)", "value": "ba814cfaac0276ac7286b11316cee4b58db7421be488aa7bcc15ca8e9c97c4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949064, "uuid": "097d35ac-395e-42cf-a4f1-b0a3d84ad988", "comment": "Malware payload (Formbook)", "value": "4d35bbac50f47b35fa1a5a5d999f819e22e9fcbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949064, "uuid": "098edebb-065c-4ba1-bb76-627f01220583", "comment": "Malware payload (Formbook)", "value": "efb093906b508e892f96be8cc21580e99f95b37a8da075b503fe5a3833c4e3a200197df86c18e13d64c53e846b57ea86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949064, "uuid": "bdb1050e-bbc8-4785-8998-be28f867575d", "value": "T1CD23923262B1EF54C92F3975D86386F94227EE42DC0587DF34887E4A3A36180F572A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949064, "uuid": "7acb7ff7-750b-4655-b23f-3eb8328cfe25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949064, "uuid": "e38d0493-9481-4b49-9911-822659848a64", "value": "384:CBP1XkmI1WAG8tUHHojSe7i29JXYamLZnptYcFmVc03K:CBtXrAGFHHfJptYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949064, "uuid": "21be6d6e-fc34-43b7-97f9-b50bf9df8d96", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949064, "uuid": "7cc56612-f39c-4fae-86fe-ad92fc7ebfc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949064, "uuid": "70de2ccb-8ad2-4f3b-b5bb-7732731cfa93", "value": "SecuriteInfo.com.Win32.DropperX-gen.6307.29895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee9a186-56eb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666980657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980657, "uuid": "d4d18bce-8141-4db3-bf0d-d981ba71a546", "comment": "Malware payload", "value": "74427a823d84a977bb2be67280a09c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980657, "uuid": "d3b6913d-4b88-43a0-a5f8-56c6c59bbb4a", "comment": "Malware payload", "value": "bb7a3762585262c7dab0e77658d6caf42a0604eef822c68f082d35a8a557d77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980657, "uuid": "5401e3b0-2dd2-4538-99a3-f737a793f6f9", "comment": "Malware payload", "value": "71c40949f56161f76b9dfbbdf5fc69059186f004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980657, "uuid": "98b9fbde-7975-48e1-9556-eb039ad7b8c1", "comment": "Malware payload", "value": "9b24b0a66a41b1c0af539c283d9ea470888f5448dbb8f963450a85e59d35bf58071a18cc4213c1d04ca26e3bcd9cf062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980657, "uuid": "86f3cbb9-080d-4200-9e6e-ef91fb69c61d", "value": "T1475509E997E35ED3F8316A39C75102F461323EC4A0E55EF51688B62C497C2DEE30A92D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980657, "uuid": "d9e824ba-4eef-4e7e-8687-71fb4517767f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980657, "uuid": "b87a2995-9539-4912-8169-e48cdd68f316", "value": "24576:wDHHFdoYa7PQtSXbBb02nt3nrdSXSp/9dgB:wBI0M1dG8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980657, "uuid": "6781deb1-5bc3-49ef-820a-09d9a3ab194a", "value": 1338880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980657, "uuid": "f5e45c9a-925f-4121-a853-38b0fdd84154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980657, "uuid": "877a3eea-dc28-45a2-a779-f8ac1b8c4c3a", "value": "74427a823d84a977bb2be67280a09c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092af71c-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938637, "uuid": "37be47db-4fb6-4811-984e-a2fd0d8ad3de", "comment": "Malware payload (Amadey)", "value": "822c1748798f2178ac9012bbe9cbcdc0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938637, "uuid": "07c4a48e-21d0-432f-996c-ebf550a4c841", "comment": "Malware payload (Amadey)", "value": "bbbb8810bb559c73a95a7dc3cd7f9c6fb5fb7e1d9f355e6323ce4de8bcd80187", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938637, "uuid": "46040ae2-043c-4d55-ac88-eaec068ec5b6", "comment": "Malware payload (Amadey)", "value": "6ce664de19642005ca8fb46b1973c565d546bf23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938637, "uuid": "89f89e6d-2292-4ea7-82bb-08fa878c1717", "comment": "Malware payload (Amadey)", "value": "fc6023adcee7f2a755a32e9f778336a36436f833ebe72787747f2e498a335c38f90e135ca6dac6c701d9756b24860e8a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938637, "uuid": "b3b5e7dc-c9c8-475c-a2b6-18f38b04b063", "value": "T1D944D026B642F471C08101305865DBE7397EB8B12625C853FBA43B2E6E703D2AFF6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938637, "uuid": "7a6bd5a8-9c6e-4573-8841-453c37667007", "value": "ff6659a3b7adcc9d3b718a91e331c2a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938637, "uuid": "d7d1429d-d6ca-4934-bbbf-5fff2474be4d", "value": "3072:5FXODIq/1sxonEW0ZN5GXL5jlRah/86cYtiFrfRStSFlfoOg/KRHdHt0K9:LUIqzjZXdXs/86d4rfRS+lfo6Hdt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938637, "uuid": "58b5fb9b-2f43-43a1-bb3a-7e962b738161", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938637, "uuid": "0be02f81-4090-4bdd-a547-1e8d3bf1e9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938637, "uuid": "0d5d236e-ddee-433f-8eb2-f3737b97e121", "value": "822c1748798f2178ac9012bbe9cbcdc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd0c18c-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666949440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949440, "uuid": "7cb1dc3e-714a-41d4-9771-7c427eae61b6", "comment": "Malware payload (Loki)", "value": "54c7b417a81e16ffbd64ebc6c8c08f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949440, "uuid": "815d359d-76ee-4280-81c7-17eb06410284", "comment": "Malware payload (Loki)", "value": "bbc763fe70295d3e51e833aa8275ae914446a375f1c8d73d3b2a3e7940d5551f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949440, "uuid": "0005f021-a17c-49db-8778-0e722ed05257", "comment": "Malware payload (Loki)", "value": "6d8f2ae3b666c11103123d0c8d34c2236299948e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949440, "uuid": "d3e082de-f208-4237-9c82-ee8968b29649", "comment": "Malware payload (Loki)", "value": "2df8d90600fedc503603beca02eafc2db8df0284f24f51b8cbfc92ca065d3d52e5207b2ff5a543d73cbf81e8a315bf23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949440, "uuid": "1d65e3c3-e2d9-4257-8eb9-ede773d6133b", "value": "T13DE45A34279B4F0BC0DACE34A472D1F016625DBBBD6ECA82CAD46CF7741A2E4690D587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949440, "uuid": "25844f32-5edd-487e-8f8b-2dff426dc9e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949440, "uuid": "53551074-b499-4285-beaa-03ad865cb7c2", "value": "12288:sPSmB6IJE4jhfZ+ePQcTK+5US3CSGVmJY9:EXBJfd86Qcm+/3CNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949440, "uuid": "af2b54ff-791c-45f9-99dc-0393c60e8a04", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949440, "uuid": "dd081db0-ab29-4835-8df9-e4a20593f876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949440, "uuid": "7fb3fd70-08d8-4042-b831-1fa2f2f5710d", "value": "54c7b417a81e16ffbd64ebc6c8c08f5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e368c918-5695-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666943728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "e7c062e8-2de4-43a8-b19e-4ecb959b9ce8", "comment": "Malware payload (Formbook)", "value": "7d0abbfd584b0d733fe425c113b68330", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "806d6659-5b7c-4ddb-a15c-b3b4aa4049cf", "comment": "Malware payload (Formbook)", "value": "bbef7e02b36b3ffc1444e1442c321878bfaf8b6719abe3c5afcb769a16581f6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "238d3a96-0eab-4d51-a9b1-bbcaf749d469", "comment": "Malware payload (Formbook)", "value": "a836ae44055c733d90bb89a0af9263e15a7dd8a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943728, "uuid": "c91e9ad4-0fe9-423e-a0a3-16177406683b", "comment": "Malware payload (Formbook)", "value": "fd56b2fbc2c3198df42aed8fada62368b3630c0ff926cedbcedf4a221e2a774fd82a6d522a665c89527d7d886ad3b465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "a73f0e73-7e5b-4de0-b2e6-d625151af92d", "value": "T161337D88BFD86D8FC607CBB988A1384C0AB8E0622B03C3877C94765C0D073CE596B653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "72ce3d63-3ef2-4188-9b84-c5cd5bd89c6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "e332f2f6-8f19-497a-8f63-537034e8ac6e", "value": "768:A106+p+5HFVpRSFR+BMdCeUTobXmJVpUQYBWsxSIxhMlwvlUApgP4551iRPPrk+5:2+MFpA+ximJVpJiRxBvlUCge1ixPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943728, "uuid": "8ce745ac-3669-44c9-baf5-cc5252e56b48", "value": 53568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943728, "uuid": "9a48a5c9-b65b-4afc-8ecf-43f1cec4e868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943728, "uuid": "e83cb313-a328-42a7-8a4a-f638167f0618", "value": "7d0abbfd584b0d733fe425c113b68330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d8753c-56f1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666983187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983187, "uuid": "a9ace56b-5e70-479b-b9d5-ba5d5ee5e3b6", "comment": "Malware payload (AgentTesla)", "value": "1b0fc31d346db844884344c01ff205f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983187, "uuid": "bae4a21a-76c0-47ec-a2c2-0cd7e48b58c3", "comment": "Malware payload (AgentTesla)", "value": "bc03ceee156422cbce76d22c3116720772cde8d7920e2b7b5f0d96d059774e44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983187, "uuid": "f85316f1-6b09-4f86-904f-81b8d361e43a", "comment": "Malware payload (AgentTesla)", "value": "e4a0b40aed9c2a8dbe344ea9a70170513bc3e8e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983187, "uuid": "72bba6b4-9446-4a31-a46e-9fbeedc82cdd", "comment": "Malware payload (AgentTesla)", "value": "475282cbf853c346af7d6cddb5e1c46581a65f21ec46b575df2ca82f3a8f0d55e321f489fbbd68d6888f885d40279b3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983187, "uuid": "54cbde3a-3d19-45f1-8739-2e8ad37758c1", "value": "T13A74BE62E899048DFA33A136C0170D24545FA7C613BF8BCB4754EBA198B37CE46376DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983187, "uuid": "8f488df9-1fa4-4c3d-91f1-02c128f8fafa", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983187, "uuid": "aea172b8-56b6-4917-b976-ff89b76510f0", "value": "6144:MweEbWBced/aI1TtzusXIcyheJ4q2NjKgwc+sBDZ/y87qtCUks:vWBced/aI1Ttzusue8jKVc++lz7Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983187, "uuid": "2db20a3d-0eaa-4fe3-a363-f01c9698290d", "value": 347256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983187, "uuid": "e0d551cd-e1ed-474d-a2f7-e8e84df7e384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983187, "uuid": "3f95c72e-9316-4079-b3a2-59ed40621740", "value": "RFQ-0039585.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7415727-56b6-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666957935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957935, "uuid": "3c304b96-b5c3-4a0a-baad-f2f6a7749954", "comment": "Malware payload", "value": "34d61034f9976be13fbc5fd3e04dbafc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957935, "uuid": "ed5f3043-fc76-4620-9b8e-7f6a5261bbe3", "comment": "Malware payload", "value": "bdf26fed9c2fe05fd927d157df3ea4bbb07c024f68db2e3615776b0bdbee75e1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957935, "uuid": "85ba6f79-1276-4f55-89c7-f3bd2314dc04", "comment": "Malware payload", "value": "e1d0a76d6bbb9c78c65af55c9e1d682502d41a94", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666957935, "uuid": "952d3e08-0764-429a-8408-aa03200744a8", "comment": "Malware payload", "value": "9054f54f140562494716e29e9872370f3156ac99244dcae313fde18fb0432376a71262ee99ae4c2ae406eba3bce40248", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666957935, "uuid": "e0422a93-c0fb-41dc-86c8-31f8ca0bba91", "value": "T1E65412133618E762C51450F4AD079A892F4AEF4CA24669CE2105776FEF397E30BDE84E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666957935, "uuid": "1abe46ee-7492-488f-9d08-dfc9ab26a548", "value": "6144:ROTm4YS+lKpzIB+8MAXlUcdQRZXhwdXoEnFN:4Tmr+zI48LlXsXKdXrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666957935, "uuid": "4c0a2919-932d-40e2-afa7-d7e1081f8bd2", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666957935, "uuid": "d094a5c2-cf00-4321-b1ca-597b36783aa5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666957935, "uuid": "24738c54-7e0c-44be-9d2c-27220b1fc2b9", "value": "D221014SG_001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29173f2d-566a-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666924947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924947, "uuid": "c13df817-d708-4677-b272-e8891c91f788", "comment": "Malware payload (Tofsee)", "value": "27ed630e4fb8fce3eb26855519071800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924947, "uuid": "74dbfc69-d2bc-416c-a798-f0d030fb0722", "comment": "Malware payload (Tofsee)", "value": "bf264533d0528a24ca80d446a214a974ac9851a3619aa52516256e6d89c973c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924947, "uuid": "7efcf40e-6931-458f-b88a-ccbc03f3acea", "comment": "Malware payload (Tofsee)", "value": "1875b9c24d86c978c7a3f80363fc65d4158b5b24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666924947, "uuid": "30b4ac3b-b58e-4ff6-a583-277f6b359a00", "comment": "Malware payload (Tofsee)", "value": "0aebae656459fd0d12333139c449c290a702fb348f6fe416cf4f82ef960a5023bb25cb23da0638e39c55c563a6de4d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924947, "uuid": "2f00738c-ade4-4f4d-a374-9b0ab6f163b3", "value": "T1AE44CF317581C8B1C08511334829CFE5D9BFBC31FA64498373A43B6EAE753D1A66626F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924947, "uuid": "92068351-5f67-4f3f-afc4-04de5ac017a1", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924947, "uuid": "5e59c2f8-8ae0-45fa-b3dd-d7318bb369d2", "value": "3072:FmXOAgbq42TxtUmX159ucLZ8qq6YQ1Z3V+zgQegMYu1z4Cr2JsM/h31:4KbqTLFucLLTVYgtYOzIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666924947, "uuid": "7ec96da6-303c-4d46-8e4a-8b2a6d84ec53", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666924947, "uuid": "062d2c3f-49eb-4529-bf97-cc5106210e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666924947, "uuid": "56daf2bb-7720-4451-8341-d81f3eb792dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ed3b61-568f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666941101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941101, "uuid": "4f47c934-e141-4825-aee8-237fa0cef0f3", "comment": "Malware payload (RedLineStealer)", "value": "5954ba19214d4d4fc7350c2476a938fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941101, "uuid": "7743d6e2-3e28-4f46-8a7a-4059a58914f2", "comment": "Malware payload (RedLineStealer)", "value": "bf4defa19f39c56ce003b1e7afea73c99554742f56b48dca2eb52a135d8cf0a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941101, "uuid": "4070cce0-0b64-4571-8141-7345ed17bea8", "comment": "Malware payload (RedLineStealer)", "value": "9dd382dd17bc6eb7e8803c32c77ea27f16b07ad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941101, "uuid": "c704dddc-4f5d-45b0-b271-2ce89fd9f222", "comment": "Malware payload (RedLineStealer)", "value": "ab5c10012d756c820d9f3e0d016c36c45ba3d05ead1778ea1a7852aa02f9e9fcd1c4ebb3256893814f25a65851b0a6d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941101, "uuid": "8580691c-c6f4-4d8f-8b7f-43c2be78fedb", "value": "T18C74E02236C0C071E27B12309962DAB52BBBB875067A5A9B7BC413B95F313D3DA35707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941101, "uuid": "07b66252-c54f-40aa-8a53-8bfcbe7030db", "value": "21427dee5bb0c78a44fe8e154f9d839b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941101, "uuid": "ba55b67f-f4bc-4dfa-8bbd-0596a8b5f7ff", "value": "6144:+QGsSYLKS0eHEYxn2vs1E/F9wWc30y3MRJbQd3PCtQb:+QGsSYyeli/A0PRJ+/Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941101, "uuid": "eaa29279-b2c1-4ca6-b129-bc04c9fa6678", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941101, "uuid": "ed2e5290-25db-4f2d-9adc-a11d658c167c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941101, "uuid": "0a9764ac-e3ba-42fc-b18a-19777a647ae6", "value": "5954ba19214d4d4fc7350c2476a938fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595ecc6e-5664-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666922451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922451, "uuid": "4f78da70-93f1-43b0-84d9-8656bd18d3ce", "comment": "Malware payload (GCleaner)", "value": "03b2fb288e3e017ca1a6d4962c2064cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922451, "uuid": "5cf53c21-bfbc-4e70-ac6e-2a534f39e650", "comment": "Malware payload (GCleaner)", "value": "bf5728fd5384894ab6419e73dfa06aafe0be1ddfdb0853d57073224bb3e66741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922451, "uuid": "7b1d7a7a-49ab-4026-8389-8973fcf0e6b3", "comment": "Malware payload (GCleaner)", "value": "6d10ab2215d503fa6bdbb108735d0ecf2abc6ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666922451, "uuid": "37e83695-eb73-455c-b863-b03456ffa34b", "comment": "Malware payload (GCleaner)", "value": "acd6c6f9f4eceab9cc0cf1ae9f2f9e87088085c01b0c1cff615d163a7b7606f5dae1d618062fb7196d79408a1a777a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922451, "uuid": "01513a5b-3ac2-4de3-9b4a-ae85adb52ab8", "value": "T123B53322CEC05977F0D0D97117B89F1AA0BE75587E3DA83B72DC85B48B3604296293DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922451, "uuid": "11c588fd-4985-4099-bb16-95344f223d14", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922451, "uuid": "fde9e1ad-23dd-46f9-9a2b-4a9ef540896d", "value": "49152:Z2r7mbgKh312ag57ixyEOqPG6ssC9dqqCgEXsfOVHg/qbmFA5hq:MebgKh312ag54MAqC/XsrBmDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666922451, "uuid": "dc2e58f6-22be-4447-945c-8f03117c6e93", "value": 2385019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666922451, "uuid": "9d0c8e15-3a5b-4f75-b3db-0302f172c990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666922451, "uuid": "64d52db3-6de8-4cdc-985b-1dc4e1fe72bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e475eced-5709-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666993551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993551, "uuid": "e972dc29-3287-4039-81dc-2bc7d884aa72", "comment": "Malware payload (CoinMiner)", "value": "af5f4ae9c823b515d52c2ad14b310d0f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993551, "uuid": "463020bf-0968-44ec-87e0-cb0a14383616", "comment": "Malware payload (CoinMiner)", "value": "bfa4494d646c670ed445521d78e86746e818eb62726e8c38159cf704c84a0651", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993551, "uuid": "10e8fd82-591f-4ac3-9945-4d373f64d616", "comment": "Malware payload (CoinMiner)", "value": "9763bbeec18043db43a32388db472adf339997bb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993551, "uuid": "4b339c9f-80f2-4238-a0bc-c10601de688b", "comment": "Malware payload (CoinMiner)", "value": "885d74766641b65c34cab97a41c4198e0402df7d582944f950539e3997ba11898b5298cefe67a7977916930a30c183f7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993551, "uuid": "5886a360-4b89-4002-aba4-f881db75c0d5", "value": "T18944BF3179D0C072C49251304829DEA0657EBC726A698E83F7943B6EBE723C166F635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993551, "uuid": "5f03763c-e2f5-450b-bc2e-ae35397b52b2", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993551, "uuid": "c32c4b4a-9aa3-4eac-a25d-3498201ce3d9", "value": "6144:RWBEMLOp6b+j+NbNmYIvJoRcu1ZHiHGs:YBzSp6ajcNmYIBoRTims", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666993551, "uuid": "4df52093-daec-47d3-bc31-b794733a2aa6", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666993551, "uuid": "1412314b-dfff-4283-b18a-e45286ec3454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993551, "uuid": "b8ef24ed-12fa-4ff7-bd6f-0e69a6cbab74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0474389c-56fe-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666988451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988451, "uuid": "7a5c8fc7-be54-4dcd-a532-ab7b5b6c0e63", "comment": "Malware payload (Tofsee)", "value": "cb6774edbe5d6e9dbe0e219896e87455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988451, "uuid": "7531651a-3df3-42bd-ab51-6be005d02bac", "comment": "Malware payload (Tofsee)", "value": "c1213622657fa46bf95966fb29a141216d09cced53a6f0f2ba893de8012cbef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988451, "uuid": "42f21bd6-f60f-497a-a635-a7cb9c84582f", "comment": "Malware payload (Tofsee)", "value": "78ce9bcca0198dd962e674fc9bf8784fa02a7fd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988451, "uuid": "b99cf8b5-b4a9-441f-972a-27c6583b27cd", "comment": "Malware payload (Tofsee)", "value": "ba9a072180a2743a3cf733af16f5db78e1f07426b2f46291d41a032e5f2256969c2efbc1c43a50559beea41d5865eb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988451, "uuid": "cb442cf7-dc0a-4c59-8467-9d92a070e917", "value": "T13744BE7275D0CC32C08225308921DFE16ABDBC325E658A4777943B5EAD3E3C1A67626F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988451, "uuid": "060b19b8-b64b-48f0-8bf0-c68492bc466c", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988451, "uuid": "129b1e38-ffea-4d59-9acb-308616d90892", "value": "3072:RFlSBYz5nLB3TeHz5S9+1TAF9RR/RfyFQTHrAzeztVsma8YiM/h3:VSBetLFTUV49RRd6QjEctVfari", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988451, "uuid": "49d6e50d-cda4-4556-aaf4-4f99cd5adef3", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988451, "uuid": "b355b014-0d24-4ce8-8312-8aec894930e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988451, "uuid": "838735eb-6900-45f8-a834-1d950b05530a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f544245-570e-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666995341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995341, "uuid": "b60d3bde-cee8-4f4b-b214-d8e9fb634ac3", "comment": "Malware payload (GCleaner)", "value": "763c941be5f47878ceeb4c883aebd95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995341, "uuid": "1bfde7cd-c026-43b9-b5bd-51b44d3a149b", "comment": "Malware payload (GCleaner)", "value": "c26172ac7173490976c59c122ee4b61cf3dd17781980d2f189b9865a6985b6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995341, "uuid": "f6d896dd-af73-4e5f-a921-3c0d9cce3aa1", "comment": "Malware payload (GCleaner)", "value": "8e9a8cd97da33206dd280da9b084b6ccda2fb98d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995341, "uuid": "f6570cca-d83c-4743-a5ab-33451548ca3e", "comment": "Malware payload (GCleaner)", "value": "66cef3432fecf1f62ddd137a1cf34674dccb5adb005d8acb923361032607963f00ec93721d177036155875f42fd3c71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995341, "uuid": "6b9cc74f-52ce-4662-aa01-daba85bcbff1", "value": "T15CC53322C9908A31F43CC0F57F260911DAA235543EB4668DBEED75EA8F09BD9542E337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995341, "uuid": "253eb20b-5e05-4b2f-b1d1-76a6b0fbf4fd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995341, "uuid": "00072e84-4459-4927-b649-e5f2c7e3a9ab", "value": "49152:Z2RXzJELFRgpMX30xVguFOGzfcrmFXa0HDi+J+25SwdTHJ0pD3n4/KA5hq:MQcp++xFOGzfNHD/+4pHJ0JORDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666995341, "uuid": "ae56262f-812f-48d5-b831-32c5eb3acbc0", "value": 2633927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666995341, "uuid": "de296514-c382-4758-a6f0-46ac1329c518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995341, "uuid": "9ee2cd3a-fa14-4573-8eb3-112d14783f7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46d7f83-56d2-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666969902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969902, "uuid": "e15386c7-17c5-44b5-aabb-6a0b1502319d", "comment": "Malware payload (Tofsee)", "value": "c5635464b80b1ccdb718fe9eb4865247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969902, "uuid": "e7a6fdc0-e7e7-47b0-9598-1a2d1a9219b1", "comment": "Malware payload (Tofsee)", "value": "c2a009f5337155c460d4ef4b4c7e543d179f26acef83ec6f250e9c1651726771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969902, "uuid": "88c24feb-bc06-401a-b7fa-994afb756b87", "comment": "Malware payload (Tofsee)", "value": "93df5528187d5a0f92b221d01f261ba05c1ac7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666969902, "uuid": "9032781a-9439-4825-8438-88485a9d3bec", "comment": "Malware payload (Tofsee)", "value": "5c6c297eab50114d72841833428849c22e9d536217a2dd2bc5fc4eff85520a30521c31f1502a980bacc78e53c05f7f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969902, "uuid": "88a3c4b7-c0ed-47eb-a323-c9c201636fa0", "value": "T1DE44D0317A91C771C48627304426CFE01A7FBC3119E4498737A42BAEAF753D1A96A72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969902, "uuid": "c58626a9-3300-4520-a375-416f28db9ae9", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969902, "uuid": "a47db3ed-1bc2-413d-9416-e8230b098f9f", "value": "3072:dXOYH+GLiIA0clrG+mj5PqVZErR/07Qn3AvVFcntsY/M/h3i:ZDHpLiTlC++qVW1qdutsY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666969902, "uuid": "fa1f5c25-630b-4775-90dd-ff8659b32065", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666969902, "uuid": "48a93dce-e788-4919-9163-be8aeb71389a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666969902, "uuid": "ef7a23b5-bd7c-4f60-8cff-4ff2bbb03096", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d826821f-5686-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666937267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937267, "uuid": "8785abda-82c4-4d00-9fd0-feea654ec63a", "comment": "Malware payload (SnakeKeylogger)", "value": "1e2fa55442af8f3410851d474f334299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937267, "uuid": "970e9f17-1ac8-4a61-9866-a0be5e962c6a", "comment": "Malware payload (SnakeKeylogger)", "value": "c2b01892e99eeedbfb6a42d3a15bd2dcc4dc2978cdb3eda42103462ed748d87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937267, "uuid": "45321b51-dd99-41c1-8213-1955bfcd330f", "comment": "Malware payload (SnakeKeylogger)", "value": "e7d2b1721bf899af1c4f6e7cedeb389177f61c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937267, "uuid": "53be5df2-6f63-41fc-9f99-fa8b8d7dce4c", "comment": "Malware payload (SnakeKeylogger)", "value": "0a47df7d7009d873862ea22246df2e4bfcd2ca1424b87e99e9034a1c6161297a7513098ba8ebcdf106909b1418941e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937267, "uuid": "1a5ea3ef-f86e-4f39-a19a-be14b01a3997", "value": "T1916591D2A126C85EE1CF2B75E91A6FFE8183DE24C311181F64537D0A7CF916A432E52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937267, "uuid": "c77eeb6c-d78a-4fad-991b-0d3c332a756d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937267, "uuid": "f62ec699-7db2-4f18-a9a1-851ca1b5b5db", "value": "6144:Rmb1yc6KJ1zsALQi8PSQxc2FqARVQzB6fx2CxwXL/k8VvklXf61MTrFw0rI2Rooa:w5GI9ZyxcOVQzUYk8Vvk9/TrF7mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937267, "uuid": "dfa31cb9-c258-47b0-9b04-111d125e45d9", "value": 1464320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937267, "uuid": "34f0f02c-3344-459b-8aad-4b73acc3ea70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937267, "uuid": "57a7510b-ea3f-4cc6-b293-b100a017a1d2", "value": "TRANSFER_REQUEST_FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a182db9-568c-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666939739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939739, "uuid": "2932f414-e463-4849-9491-12e4b1469193", "comment": "Malware payload (CoinMiner)", "value": "f3338c6c327c08a5afe9e08793231e88", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939739, "uuid": "9ddb622e-f822-4027-abfd-7177cd2591fd", "comment": "Malware payload (CoinMiner)", "value": "c2fa6e1b9978fdf97ff513399a98a2e492c28bdc2037ad08f6503021f057ba1c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939739, "uuid": "517e626d-7657-4069-8fb1-e4bec08fab57", "comment": "Malware payload (CoinMiner)", "value": "d01063a9a0c429f7b31c365173da10660380263c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939739, "uuid": "4a42c327-0c89-4ff6-9ad0-bb11fa7b1085", "comment": "Malware payload (CoinMiner)", "value": "63401c42d26efbfef3a153f10526f66aae10b76921a5810e1b7f5e9be03b600fc25b6182c72001dc7788d05fe5d9398e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939739, "uuid": "047ee3c7-fa9b-490d-b19b-963378a34201", "value": "T19944BE267582C871F085E1308439CFA3297EEC3116654B8777A43B5EBE713D2AA7621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939739, "uuid": "7a7f9fd6-4dfe-4319-9b23-69d46097e850", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939739, "uuid": "03088222-2fa3-4caf-92c3-7e4250b23607", "value": "6144:T9rHyL9FbOvhuQcynSFXnl/hpztNAlm87Bti7ltjRj:T9rHyRFO5uQcyShlzzAXBMBnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939739, "uuid": "8c8e6286-e51e-4a03-ae2f-fb357010c677", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939739, "uuid": "cff8f0c8-dc1b-4687-a137-794c5b222faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939739, "uuid": "537ed71d-687d-4964-b18b-9aeaee4ffd20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9cca32-56ab-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666952951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952951, "uuid": "5f87878a-2f6a-481e-8138-3cc82673e8d3", "comment": "Malware payload (Formbook)", "value": "043f96cd726a247f428241733271393e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952951, "uuid": "3a580caa-3145-4531-a862-bdfafd511a21", "comment": "Malware payload (Formbook)", "value": "c42d70369ed48cbb67bf7b5dc2c673d0ca83d3cae4542938fbc7dca3f132bc49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952951, "uuid": "d2606646-9547-4bce-8554-00b1b570ccc1", "comment": "Malware payload (Formbook)", "value": "5956cc7268b58efcb4cef4677ef699593fd27766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952951, "uuid": "97e42175-6aa9-4839-9f3a-e587ef8f8cd4", "comment": "Malware payload (Formbook)", "value": "237f6f516b3ee1bd11e5b5f3a374789ac9d8d17d3310d153bc3a1a72949dc75b7172e81270e4572a102662e6aa7821d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952951, "uuid": "9eaee627-3357-472d-b6f7-9a04dcc71b23", "value": "T1A544232322E0D8F7F2C64B739D3AB6F99337534541126597CB684F8F36A06C7864B292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952951, "uuid": "b582277c-ca4b-486b-bf5d-5f0d8e0182c0", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952951, "uuid": "b0f62a4a-8d7a-4058-b58e-774fab451134", "value": "6144:qweEpGB5xMDZ4ONpX7yIPaOBcwnEpENvMfm0KN6HAdF8FITSerwh80J2:bGBbMDnpX2A1iwnmExMHHAF8Srwh8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952951, "uuid": "cd517589-afc1-4000-9a3c-9231a06d27d0", "value": 278311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952951, "uuid": "45f3778a-ae32-44d3-bb45-15355d3845ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952951, "uuid": "950a4433-116f-4d00-9491-10788086d4e1", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ce13a7-56c4-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666963841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963841, "uuid": "f1ff5ccf-fc96-40ff-8c42-c1b0c29d3ce5", "comment": "Malware payload (Amadey)", "value": "077541e0d8ae415a153c37e97d94c655", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963841, "uuid": "b30c74ff-047c-404b-a405-93eea85f9cac", "comment": "Malware payload (Amadey)", "value": "c4e1986ee6a50c33defc84b9af4a87780f97aebb09675aa24bd0026c5656b265", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963841, "uuid": "6530bc24-84d3-4253-aaa4-4faa1051bc90", "comment": "Malware payload (Amadey)", "value": "749272b37c182f883395c40c43dac17b8d0590db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666963841, "uuid": "8011cae5-3a16-4f13-8cc1-5cc9814c7c2d", "comment": "Malware payload (Amadey)", "value": "26fcd059ccb3343c537995715246a141780e40877f04553bcb5addb3989bbd2d0c57275aaaa00153197112001442ccc9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963841, "uuid": "5412ffe7-96cd-41b0-b518-f939fd92918d", "value": "T1C554D0317992F431C44ED170482ACFA16EBFAC3109658A4737B4275EAF653D0A6BA31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963841, "uuid": "629d1e8b-5ef7-4a59-9f49-c559cc5a2acc", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963841, "uuid": "f427aa7e-a0f4-4ac5-b6a7-446380df042c", "value": "6144:oPHgLKbRGyDb1gV+I4fFBt1iDIkexM4/9vTg2wHv4xK:oPHg4DZg+IABjickK/9vNwHwxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666963841, "uuid": "b4d2f71c-178e-4f20-87f4-08398108fb10", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666963841, "uuid": "aa4c4aeb-f4f5-4629-9a5d-c02b76e99c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666963841, "uuid": "51937488-46cc-45fe-b4b4-7b05eee9517a", "value": "c4e1986ee6a50c33defc84b9af4a87780f97aebb09675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed59849d-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666952764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952764, "uuid": "bdea9e31-dd93-4de0-af77-67e486753889", "comment": "Malware payload (RecordBreaker)", "value": "3b0f72ce01590edeb4c501b329545988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952764, "uuid": "41e0366b-fb5a-4441-bbe1-f17fb259b987", "comment": "Malware payload (RecordBreaker)", "value": "c925399d414822e9c05cc98b03c0c8a84bd4960e29a0e24347e26dde86767104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952764, "uuid": "28567430-f14e-45b8-9711-aaffe03880c5", "comment": "Malware payload (RecordBreaker)", "value": "8e49822827663c588eac106ab9b6e48fd36136fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952764, "uuid": "9ab0cc4f-db5b-4985-a585-a38d514e6041", "comment": "Malware payload (RecordBreaker)", "value": "c3ddd7f692716f01eb047ac15c2a3b0beb5a983fca96880ce9740fd8afdaad2b3ea6797836486dd77dfbea120a27499c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952764, "uuid": "2306c341-2dd5-4804-b4a2-8fe569b2ec40", "value": "T1E553E8964D15DE38F8C1CC77BBB5B28972289CA189FEDBD320367E2A1E617F0B440525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952764, "uuid": "15061f01-d2db-422e-add0-634be034c810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952764, "uuid": "e4c332f6-cd5b-4d8c-b58d-e260aaebcd9f", "value": "1536:SqBFigD8i4cwxUn8UjGMMbbTMMZOM//ESZbUtWJhse:dFigD8i0GGMMbbTMMAM//E0Itahj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952764, "uuid": "60e393bd-25c6-47df-b975-987886e68da6", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952764, "uuid": "d6efd83b-462f-429c-8e7f-f675c8b2fd0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952764, "uuid": "be26b9c1-072d-4d20-a681-9a9b5b876499", "value": "c925399d414822e9c05cc98b03c0c8a84bd4960e29a0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace6de28-56ef-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666982291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982291, "uuid": "8351273d-3dfb-413f-a401-7a759e2b7b3c", "comment": "Malware payload (Tofsee)", "value": "17e796c1d99911ce19512a8adb8ea55a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982291, "uuid": "c2a47c41-6ca2-4f94-b84e-077a52a0ea41", "comment": "Malware payload (Tofsee)", "value": "c944b1c3a2ec3d3141c00e8b83c4a88b5c76057f1119b3de079056fd65d2d33f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982291, "uuid": "bae1addb-c1e3-45a6-8b86-73be0c2b2fcf", "comment": "Malware payload (Tofsee)", "value": "e4e6aa0076157643919abbf26d9a444fd170d2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666982291, "uuid": "64b46419-9ea4-4df8-afbc-4b59d9372255", "comment": "Malware payload (Tofsee)", "value": "dcff613e89aa41f275f3b7753264a14af0b55fc64a9907c676890aae13b0ef8d8d787ebde1819427a0a7fcc550584828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982291, "uuid": "5d37e1de-fe03-40b4-9288-faf6531f64d5", "value": "T1E344CF313692D472C48611344466CFA01ABFBCF12BA54A8737B42BEEAE753D0967631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982291, "uuid": "26a172d3-8190-45c7-82b6-543c28b8d1af", "value": "c77dd599a098ccbfc3230384663cf2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982291, "uuid": "0c8e457b-754b-43c7-9cc1-95dad0e8cbf2", "value": "3072:xXO0xmVPc4N9LLXf3D7n5ksUGMAHXijUgzYcYhvT+iyQuvM/h3R:VNmVPhN9LjDfUK3j/W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666982291, "uuid": "5e6c0f21-a8b9-46e6-af4d-01db3eb9880e", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666982291, "uuid": "0116ac5a-f380-4838-bbef-d53a90e8d418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666982291, "uuid": "2e3f4e74-03d7-4db8-a310-209594b68c4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b379143a-5698-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666944936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944936, "uuid": "bf10bfd8-93d2-415d-adac-51bbf6b6a633", "comment": "Malware payload (RedLineStealer)", "value": "c3ac1f6d135647b204eb350e5529d6b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944936, "uuid": "f595d1ba-6350-4ab6-adee-aced3678c969", "comment": "Malware payload (RedLineStealer)", "value": "c98604be3cac3d987066461c682e96584f2dca81d4150c985cce4717a2c80c3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944936, "uuid": "6255a793-00f4-46c1-b318-6ff71e50b0d5", "comment": "Malware payload (RedLineStealer)", "value": "1f3705b9c284616e13129798475c9e8598cdda18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944936, "uuid": "902cc761-7a14-43e8-ab24-e9561d9c4391", "comment": "Malware payload (RedLineStealer)", "value": "7c026cc8d35e05f890048b45c9a504642dc93352aebde69ffbc04c1293a48ef45b5199f477f591a0eddbbb993185ba9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944936, "uuid": "e43ec0ed-888c-4790-a385-6531d00f9f48", "value": "T19E44DF317681D471C045C23C442ACFA02ABEBC715B684A8F77A43B6FBE72391666631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944936, "uuid": "3c300d5d-89a0-48cc-b8f7-2be59751bd55", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944936, "uuid": "ed002c86-c72a-4bd0-9700-b566437ee1af", "value": "6144:5TzHYLA7iUo7uQzQI9GUKgFWaS4AyoT7Yj:5TzHYE+U0uQMIvfgaMTMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944936, "uuid": "0531afbf-d5e4-42a2-b93a-8c35d61830ab", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944936, "uuid": "cac2f683-1791-47de-8840-840495b3e065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944936, "uuid": "f9ccef4d-8735-4ae2-b4e0-03dde43c158e", "value": "c3ac1f6d135647b204eb350e5529d6b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b783922d-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptBot)", "timestamp": 1666952674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952674, "uuid": "e268bc01-a124-4efa-b41d-15904c7f95ad", "comment": "Malware payload (CryptBot)", "value": "614e48baeccb3ddef286b165b8078798", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952674, "uuid": "b8f3ff1a-589d-45ef-b36a-6489d863bf09", "comment": "Malware payload (CryptBot)", "value": "c99d58fd025a25f09226d6201f7cd16d487e5d0dbe264394438049d3bb5f083c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952674, "uuid": "43075ed8-b02e-455e-94c6-75dd55732438", "comment": "Malware payload (CryptBot)", "value": "165d55ed7cfef2ed7eb1256180adeb2e6059ccbc", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952674, "uuid": "de741c36-7b7d-488d-aafc-c755b26021a6", "comment": "Malware payload (CryptBot)", "value": "b468a23e777dbd9ea62fc1e9b76f72121e576e203320a9e96b37f3e586bec77cdc1564e3ab6ebd1ec025d125ff97d84c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952674, "uuid": "9cbef4ce-377a-4be8-9586-30cbb570b029", "value": "T1A4266B21CB76B16F08388468B36522731DDF7778331546337869CE6EE0B89D93C9626E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952674, "uuid": "a32e54d5-96a0-4332-9f90-165b996ac80d", "value": "a37c2d8360ef93cc06763836c227809e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952674, "uuid": "f647e9c0-50a5-411a-993c-55eba7aba308", "value": "98304:fdBTnp5U/Fc72oPeA/YMqc9DUu2CjXLAx:zTnp5Ut+2ol9DUu2abA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952674, "uuid": "38498063-b13e-4906-8f74-e7d6f9191c82", "value": 4739072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952674, "uuid": "94716773-f59b-4bfe-80f4-d094e131ba56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952674, "uuid": "bb2852b1-51bc-4075-bab9-cd703f40c33c", "value": "D3[1].file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2b02b0-56fd-11ed-9266-42010a9c0072", "comment": "Malware payload (Heodo)", "timestamp": 1666988090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "192b0bdd-094f-4f5a-a4ba-594e403d38b5", "comment": "Malware payload (Heodo)", "value": "03fb4e3b2ba8c482e67b30d825f59243", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "1be09c83-00c7-42aa-83ac-134e4a759529", "comment": "Malware payload (Heodo)", "value": "c9d0fc1789a0e2c4b372ef24897c2fa60109e7d618f9d0aabb3c30ed0eae109b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "f3965737-a9f4-463e-ac4d-b4f438edca6d", "comment": "Malware payload (Heodo)", "value": "762c558f07750acad9e3ce6d1fd8672728f12615", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "87bc5ce4-9d5b-4ecb-a846-a045faed60db", "comment": "Malware payload (Heodo)", "value": "7513d11fe133de2fb2cf49151472f2bedb1c42c92470c4c24be0087f99d1d75904e6d14859a23292af045eecb1e38581", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "fc63fb31-da2b-4b74-b640-c43c10948cff", "value": "T1AF15D3836895A4E0D59B1B3B211D5FA730C7841D47C246EF2AF81B9C79E9AD4807CECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "fbc08464-6197-4c7a-aad9-e091453eb3a4", "value": "70b8cfa68ef2c7898ee65b9a0ce218ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "d37c6c51-7384-4b18-87b6-19dd523e814a", "value": "12288:+t1xV1OkAShtOKAgHOSEvkbR0V0akoDZw/5:m1xV1EShtOKPE00Kkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988090, "uuid": "82e957de-5f67-4465-9888-33df8e6977b2", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988090, "uuid": "c93adc56-7ed4-4feb-986d-deb889a46a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "4c2e3179-df06-4a51-8a4f-217554dbc1e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45cd57f-565e-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666920107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920107, "uuid": "7bd4dbb1-d48f-45f0-b1e3-f2abd193d0f9", "comment": "Malware payload (Tofsee)", "value": "ec2ef405cc041de35742b88b108d8f4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920107, "uuid": "c46550fc-c45f-4e3b-b68f-3157974ef407", "comment": "Malware payload (Tofsee)", "value": "c9d0feebedcc9286b9e3b5db4e8d644391bd67a218c67a91443938802a019f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920107, "uuid": "1ca15824-25c4-4992-8b59-8b4957533612", "comment": "Malware payload (Tofsee)", "value": "06e759b7569fc255e6b265bbd1102852ed397742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920107, "uuid": "5524c19f-9d34-49de-bb17-c513346ddb35", "comment": "Malware payload (Tofsee)", "value": "d8b20d4d5b5547fc0c91114c876f57441096c4cf103c87fa3917a01c4565e9b10aa0ac8b933831771a051b4e1bfb0f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920107, "uuid": "29f786f0-5149-43f6-afcb-baaf691e882e", "value": "T1C044CF32B68AC871C08521304475DFE56ABFAC3319645A4377E83B5EAEB23C1667631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920107, "uuid": "5f546a1a-b592-4b88-bcde-b4d3dd30bb02", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920107, "uuid": "df9be1a5-d94b-44a7-9279-9e21a2346e4b", "value": "3072:EnXOU9qIVDx+aIX15ufhf+/ls2a4TON0HF1Wym+RGuK88iM/h31:4vqIUmx+ds2aoON0KyRGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666920107, "uuid": "ef731216-81c0-44da-ae1c-7dc4edb1df63", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666920107, "uuid": "87305392-b4a3-473d-8f6a-e760823b4160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920107, "uuid": "f3827f64-af93-46ae-9881-dcdba13fd81e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c471d06-5690-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666941354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941354, "uuid": "8b8e37a6-9962-4bdb-9394-267e04cb834e", "comment": "Malware payload (RedLineStealer)", "value": "17f01af210730fdaaf0d89210cb90d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941354, "uuid": "0b3579f1-149b-4cd0-b604-78d84487f4bd", "comment": "Malware payload (RedLineStealer)", "value": "ca2f66f1dc4974038990d1163d41a27a468b49521290153fbe9e865fd1f18dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941354, "uuid": "eb04f111-6c5a-455c-a714-3c5aff3bc3d6", "comment": "Malware payload (RedLineStealer)", "value": "5a755b7fec266ffcfff8a345b8c3bc1826201fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941354, "uuid": "53aa6e39-32e4-4890-9208-fd2d4d0ec308", "comment": "Malware payload (RedLineStealer)", "value": "69f0bf2da3ec157c0f1d5959f58eb110ef4034ea892a2516da628e0f8a790d28fe7b68c63aed403906fde90d4f4f1510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941354, "uuid": "2f397a78-0ba3-4185-bf80-d233e60758e0", "value": "T18DE3075427BCEE14D5BE4B79A4606C718BF0A543F552F32E4BD150BA2E73780CA13AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941354, "uuid": "52b1eba2-5fce-4da4-ba75-9189f8cfad85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941354, "uuid": "be296507-2172-4890-ba92-1640dd7608c9", "value": "3072:gYO/ZMTFz5rI+7eLGU4aaLsVtDFTKRPShYSSr:gYMZMBz5rIDCU4aaLScpShC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941354, "uuid": "72b45781-90fa-4b94-81c6-6be02e19ddf6", "value": 150349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941354, "uuid": "13bc0d00-8c86-4cb8-9502-318ce374b081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941354, "uuid": "01b4c01f-dae6-4190-9dc5-5958b426c393", "value": "17f01af210730fdaaf0d89210cb90d1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c4be07-5660-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666920693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920693, "uuid": "e01d1b83-4539-471f-9c4b-39c17f160137", "comment": "Malware payload (RedLineStealer)", "value": "2d6707b569e21f105a82659db8ce262b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920693, "uuid": "33abd942-3d7c-4849-a632-e50897558769", "comment": "Malware payload (RedLineStealer)", "value": "caa9458f14985b1d1de68af03f88db426a844dbfb8fa8b1f670e8fe256238049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920693, "uuid": "701847d3-583b-440e-bc93-ab3907d49baf", "comment": "Malware payload (RedLineStealer)", "value": "104704bd5d3f60a319727cf1abcd807e21b754a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920693, "uuid": "189b5584-f2e4-4322-b291-889b192653fa", "comment": "Malware payload (RedLineStealer)", "value": "820b8d57bbb58dd847ca67d00e4e5817f27a599940c9b1e3895a08497b40601baae1daf022d9b44932ff91eb957d5eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920693, "uuid": "0275bc9a-5bdc-4833-9381-e7485498898c", "value": "T12F94F132B542C4B2C0442134483AEFE12ABEB9B015154A077B943BAEBFB56D2657772F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920693, "uuid": "c95da341-785d-4b04-94eb-7a4e8d30b268", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920693, "uuid": "80e04189-daee-41f0-b61f-cb331f50dab1", "value": "6144:w3TqkePhdTkBR6Yk6NyPvC756HaW5zeqqmL2sgB61mip/nM:w3TqkePhdTkBMYdIvC0HhKmL2+Mip0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666920693, "uuid": "00cebab7-91ff-4f87-91e3-218c0ebc5771", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666920693, "uuid": "3da54afb-6f6b-4db3-9cbc-e8d9be29d854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920693, "uuid": "897877b6-0cdc-48f4-aa55-1067e98546e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142c08e6-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666938656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938656, "uuid": "199ced72-a09e-417d-b770-45d01c3f2066", "comment": "Malware payload (ArkeiStealer)", "value": "27d20883a23e7d2463a92e85540204fd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938656, "uuid": "170206a7-16c8-44d0-8c3b-fb01b0b11819", "comment": "Malware payload (ArkeiStealer)", "value": "cab73be3e1fcca42f723d90cc793d60e3f8029b480554e4dd255de2b1107590f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938656, "uuid": "b94544e3-8672-444a-8343-a250e64be911", "comment": "Malware payload (ArkeiStealer)", "value": "1bb5ccfbc53b2d64c4bcd7a0853b9d8a6f77604c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938656, "uuid": "d7d1193d-caec-4707-ace6-15b438d1424b", "comment": "Malware payload (ArkeiStealer)", "value": "99892ca7d270e5c4ce90745b5b8c6cf7b4e8590e19af74befc8df7078b697ec203f76a438caa7d53807596e7c54bfeb1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938656, "uuid": "03001075-37c3-4808-9aa1-973d490a8372", "value": "T1E074DF36B941FC72C4811170C43ADFE469FEAC721920898773A43B5EAEB4391B96671F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938656, "uuid": "c4dffb20-7fa3-4e8b-a279-9177ff58aafe", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938656, "uuid": "04cb05ab-b644-4bf4-bc74-f2d7d00b87fb", "value": "6144:Em0JHSLY3TEvsum84GNB37MvxofW9lW/88zJ/JfBJHE4AXSj:Em0JHS0jE0uzf7QxofW9lW/8AVJZF1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938656, "uuid": "00d3ce4d-4366-4a9c-9b90-586bcbb0928e", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938656, "uuid": "58ad602e-a138-4d04-a54e-363630aee857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938656, "uuid": "0473883d-708c-4525-8062-50f2c97a38a7", "value": "27d20883a23e7d2463a92e85540204fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d4fb80-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666949455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949455, "uuid": "5be94e0b-6318-4e61-8ec3-df7b36333c2f", "comment": "Malware payload (GCleaner)", "value": "db29df32bd306d781ce3a71925d1ea77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949455, "uuid": "cc324495-117c-41a0-a96c-74276b6d62d9", "comment": "Malware payload (GCleaner)", "value": "cb0ccca16776b72d82a43083e93e1a033629a026d1380a95c1e9278a817857e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949455, "uuid": "8971f43f-67e7-4c36-8905-e30b8d6d23a0", "comment": "Malware payload (GCleaner)", "value": "dc02b378f1575325b24320417406d15351aa69e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949455, "uuid": "ca19a2e3-d996-42cf-bdd6-cce3a6b39403", "comment": "Malware payload (GCleaner)", "value": "fb003b36e80114ada498fac0296f2f8b4fb43f070407dd6806806a602189063040a41fc732f03c7faa5185c7b8edce88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949455, "uuid": "fc837171-f36e-417e-9235-0d32a5fedff6", "value": "T19EC53311F6E9C874D170C130DFB2CA3966606E3FEA22A4956FEC6E8D96477A24C4C3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949455, "uuid": "eba33ff0-709e-48b7-bea1-5321958ce9f5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949455, "uuid": "54ac2898-38b9-4195-9b1f-6ae46ddcb88f", "value": "49152:Z2RT5NvJr90J4UXdlAKFz83sBeOHa+hVwxISZ4/fkuA5hq:M55NRifXdlrrBbrh2BOADq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949455, "uuid": "6b1dcc5d-50ad-4e00-9b05-b886419e154f", "value": 2562483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949455, "uuid": "0206da35-d6ee-4411-93de-a631cc3abf90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949455, "uuid": "4fe11fc5-dc48-4040-a5f3-eca2b9f723d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec6ee6e-56a7-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666951236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951236, "uuid": "bac5163f-c9f1-4f09-832c-e7d124e519b4", "comment": "Malware payload (GuLoader)", "value": "8f63de1e1adc9467bf3b04a7720af3fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951236, "uuid": "b840c468-6771-4eba-a10a-1d964d15813d", "comment": "Malware payload (GuLoader)", "value": "cb23593573d08cc8c3eeaf7342d89b4ec2df72e5cc5c3e9d9ce4c941fc6a8b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951236, "uuid": "dd710db7-c5bf-4c97-82ac-6d0d4f10eac1", "comment": "Malware payload (GuLoader)", "value": "048c223cbc77a1e19a00761ad2bc05436127c4ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951236, "uuid": "f98af538-089b-4cb6-a02e-d794a1d56d28", "comment": "Malware payload (GuLoader)", "value": "5d64f15766634bfa7196fe9014673e4b37f8ba46217eb41c22d7569eeacdf2232f7ef9958ee2fa01bf3a156c29f8bc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951236, "uuid": "c7e2cedd-bb3a-4868-abcb-5a0355bb8871", "value": "T1DC7412907374C8ABE1AAAB329E7767576EFDF1221958869F2300A7253C72341DD1D30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951236, "uuid": "d8d32125-506e-4469-aa44-49c2a662fdf7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951236, "uuid": "40a62061-4bbb-43b3-b10f-f135771b53ff", "value": "6144:oYa63O1SJWaqZVkJJSPCl0Wzad7nMdSnAsAQlKRRm0Rl4KMWo5uJ9rLaq0nfa:oYlO6bDJJ4xWzw7Mdcfmb46hJ9rLXea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666951236, "uuid": "7edaf439-323e-4365-94dc-4661be028e1c", "value": 345032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666951236, "uuid": "36934bc1-5a9f-423a-a244-5a55a3800ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951236, "uuid": "24c76a80-9c03-46df-a51c-d562bdf3475a", "value": "Amended Contract No. 16862.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19979e6a-56a1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666948543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948543, "uuid": "25399c3f-be52-4cab-8312-37115cc00753", "comment": "Malware payload (GCleaner)", "value": "3974a09a7f37d98858b7eb6a2d675059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948543, "uuid": "c81ba17f-ccb0-40dd-81a4-1e940e8d5709", "comment": "Malware payload (GCleaner)", "value": "cb423a1028a756d3b11cbef06e2ac8db4fa17359e5017d63d45167e99ae3a184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948543, "uuid": "dc45f848-d613-4ec5-8a6e-307b3ae97344", "comment": "Malware payload (GCleaner)", "value": "0b4c19f471c1809c38651d39ba0d85d08251b0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666948543, "uuid": "f0ff5adf-d48c-4ecf-a2b5-726846554a79", "comment": "Malware payload (GCleaner)", "value": "82aa15f17a79d88554944f0788ef04b7fe63e6025e4f5b69c50fe5cf18edb9b523f7849d94abe36039678b6729b98251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948543, "uuid": "8abad79b-6e1d-4e8f-a05c-7cd2f615a2d1", "value": "T1C3C533014A196276E1E2C5322C958B2CC67D7BB2D462DEA032FC86DD4B799D5D08C3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948543, "uuid": "18d040b6-f030-4e4b-ad2e-9d4fae648928", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948543, "uuid": "9c7d47e7-c412-42a1-a64f-5a7968850871", "value": "49152:Z2LE29z68tdQrb+CFBQqXGK1tO3Nt9I52D2u7kHIrLnwz4A5hq:ML/LtdQr1XGS6f252DhQ+MzDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666948543, "uuid": "ec8bf2f0-2f8c-40c0-b6c0-980a9ba61ff7", "value": 2576222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666948543, "uuid": "f00acf5f-61f5-46ce-9055-b42143ad02ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666948543, "uuid": "13103214-249c-4a0f-8423-97e732ea6e6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c22985-565a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666918309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918309, "uuid": "505804c5-af41-4211-8ac6-1971328fa4e4", "comment": "Malware payload (RedLineStealer)", "value": "3e1ab4e7d787cfc18460393ce47e4181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918309, "uuid": "689bb25c-33ec-4399-a746-03498711d4ea", "comment": "Malware payload (RedLineStealer)", "value": "cb7296e2a1380a3459d874635a0174bf89a14d869cd8322941362e25695ea4f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918309, "uuid": "bfcdb9f3-3bd6-4399-883a-04d2b71d2114", "comment": "Malware payload (RedLineStealer)", "value": "27aa32e656b4d4d8e80715849468f3a2e27bf4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666918309, "uuid": "1506fe3f-02dc-4885-921e-3f0fd43d300e", "comment": "Malware payload (RedLineStealer)", "value": "5991d05533290f0e2ee2a37ecb8f0120bef4528382c7daa0b9fc81e03ffa1df07858d4bf48f4b53d19419ce61f1c709c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918309, "uuid": "c3e827bb-abd7-4f1a-ad88-d0fc76918211", "value": "T10884F1B1B442D871C48551304826EFA25ABFFC7014698947B7B43BEE7E703D268BA25F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918309, "uuid": "a3a22cc5-ace2-47f8-af70-99153d711853", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918309, "uuid": "a1735be3-1074-41ec-87b7-0e4284d51a2f", "value": "6144:Nfq2lh8pgnumARsUpYkLUKb4l5eY9dltRtxE/GQemoM7QZ6j5:Nfq2jEgU04ElTX5xE/GQJl75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666918309, "uuid": "1eda7c0c-ba30-4512-9f8c-6289a4f80727", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666918309, "uuid": "b1025ca9-8420-4333-8ef2-614528f6e942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666918309, "uuid": "e5ad3206-13c1-4115-b53b-182845f74ba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f77fef9-56a9-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666952150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952150, "uuid": "0efff929-0fe9-4316-bdbe-be7790108429", "comment": "Malware payload (AgentTesla)", "value": "d36d66fbf8524fc8976fd11385cadb00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952150, "uuid": "b2d3e9c0-0660-4310-aa25-e21ed3596e72", "comment": "Malware payload (AgentTesla)", "value": "cbf8e82f22cce35faf23fe92370a4f058a78b014a3614be3bc2f8759f9724a2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952150, "uuid": "a4dd8c41-0b50-4ca7-91d9-6e8371b98712", "comment": "Malware payload (AgentTesla)", "value": "13c3b5e5f18e5cc676f78e6eb7ee7db64fc4c413", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952150, "uuid": "06405b5f-697f-44a9-8825-0c3dd8b9cdd2", "comment": "Malware payload (AgentTesla)", "value": "57eaaf3334d8f30d7bddd987a268c2ba663712b9cf684523f20e322056b9517ab625ddaf592be64479e8f768ad0cd83d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952150, "uuid": "10f7c471-3a92-4ea8-9540-bdb0225c4aa4", "value": "T1CCC423726405E237CEE77770C90F4B9E97790D2670E6E4E4628B74061CFEA1D221B9D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952150, "uuid": "4d26e048-e326-42f1-ad85-4ab93f6e159f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952150, "uuid": "f5b99482-dfdf-49f9-a136-fb0d0c7dedfc", "value": "12288:kh7ODYsy+PTELcLAEJT9HGiMGEYlkvpxjr4EyL:pjrEQUEjHhMGFkvLr4EyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952150, "uuid": "6f31f428-03e8-4478-91a7-65bc5fd68a0c", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952150, "uuid": "f42a6b59-ba5b-4b98-9b08-d8c7bbd7af83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952150, "uuid": "957934b3-63c3-4ecb-973c-f8947948e51d", "value": "d36d66fbf8524fc8976fd11385cadb00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c8a3f3-56c2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666962680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962680, "uuid": "92ee57a9-9146-4e80-a903-fa186b0d597e", "comment": "Malware payload (AgentTesla)", "value": "918ca15fc42f51c51e8bdac7ed9aa227", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962680, "uuid": "ace32d98-81f0-4cb0-a671-614690461997", "comment": "Malware payload (AgentTesla)", "value": "cd53ca02d3f26bf3e6431e6d86c9379f9f77f7e67cddba40ae9a16f85569334b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962680, "uuid": "d9fb8bcb-d266-4762-9246-eece039e7cc3", "comment": "Malware payload (AgentTesla)", "value": "621f1068156442ccbe460d4198c1eef3d6f25deb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962680, "uuid": "71b77234-773b-4f03-a8f5-8a22f9d9a837", "comment": "Malware payload (AgentTesla)", "value": "6c779fc8864cf00756ff0e575cc7a93b8a39836686e607742d03837527403bced268f9ec15a16ad8808e73dc27c701ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962680, "uuid": "2317a8e9-9e26-4a36-8a5d-34cfc4c7bd63", "value": "T19C12E70593D44232DEB643BB3CB74786CB36A7ABA8478EE9B4CC511E7F2214147632E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962680, "uuid": "6237f829-00cc-4937-8371-851dc6328fc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962680, "uuid": "a61e70bc-8ec9-41dd-a3ea-3bae4ab4f4f3", "value": "96:1wTdaCU/QOstuLXJLq+nDFmhlUpHcvn9KWb/3WNtW1jYcFoNVcz1W4oKYMsLYUa:1wU+ELXJ+qFO2puBr8stYcFmVc03KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962680, "uuid": "daeb0964-1f4e-4464-8849-e860426b63c9", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962680, "uuid": "49f5a840-61d4-4f36-8f15-1ba3ade4453b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962680, "uuid": "9074cdc8-2c27-44f8-ad4a-0bb9499b6187", "value": "TT-222553765001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d908b4-56ab-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666953038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953038, "uuid": "8d75b7bc-1f28-4d29-bacb-ee4937c141c1", "comment": "Malware payload (GCleaner)", "value": "5e886defaec4e7988bdd67728230e89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953038, "uuid": "b6b14a04-bf0a-48dc-b21b-07a373a8ed5f", "comment": "Malware payload (GCleaner)", "value": "ce631e74a5efdd501af7d0bf7a18263c4df212025773c8f06307d133031d6aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953038, "uuid": "9e555928-73cd-400d-8215-b1628d8e4be6", "comment": "Malware payload (GCleaner)", "value": "6990e56233cc5337a66129b9a4779ef81c6d3f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666953038, "uuid": "283c4055-e9b9-4072-afe8-4d0d6215eb18", "comment": "Malware payload (GCleaner)", "value": "911e5bb1b4b45ba72f339538a53953a6e014f1dabc74969e3c50fce12ccec9769683fabb62702dec0c49b6671f185560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953038, "uuid": "818fbb54-1562-4fdf-8a42-eb64c25c3084", "value": "T1B7B5334A8D1ADA30C422D4705D7CAF6886113A371B7CD8C9FAFC1BBFD95B5065CA23A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953038, "uuid": "76b30cd2-cfcc-4826-9532-ed9546850a82", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953038, "uuid": "dc3c2398-ef03-4399-8523-c18ef795771a", "value": "49152:Z2JM6QOTXqlJBIwnX4q6zbakB1/79f0Ca0KU+S5AXbRZ5s+hA5hq:MJfZq72wnyXdB1/79Xa0d5INZZaDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666953038, "uuid": "b343f366-b3d4-472a-a409-70b7d804e2cd", "value": 2432199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666953038, "uuid": "da1a691e-ed8d-4e09-a772-951902583f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666953038, "uuid": "5b96a86c-1698-4829-bba8-af962f5ec36b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f126b22d-56b7-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666958354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958354, "uuid": "e707907c-55b3-4ef3-955b-7075c6bf84ac", "comment": "Malware payload (GCleaner)", "value": "d1c7f8588d3e85bb859a0d7d4f4889e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958354, "uuid": "b6438045-b47f-4302-9c8a-2865d06e6087", "comment": "Malware payload (GCleaner)", "value": "ce6f1408e4ab5b88ccdf46f4820ea0366f5b2d9a54c9061d5e7ce150ad3e1d76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958354, "uuid": "1eaa633e-a3db-4636-bd56-fe96199cf496", "comment": "Malware payload (GCleaner)", "value": "6bd3011d60ee62ff2f35299dd7cea5191d45d065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666958354, "uuid": "83a7acdc-3e4c-4a9c-80e7-6f4756a6a82c", "comment": "Malware payload (GCleaner)", "value": "ae8a2d30ed1d91a91a72f860ff39cae60d2a781511bfebb894020b018af613cb66812f07b7af48bef6c30d3b9ce8b37c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958354, "uuid": "83987327-82fe-41b1-ad59-94aa71013e02", "value": "T182C53310D1A0C9FEC0AE65F3DB3C1B00D9B59616A474E226FBECD89F4A72706F85131A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958354, "uuid": "6a0a6e28-b750-419f-a3fd-6eb21a397309", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958354, "uuid": "c7b64704-3063-4cf2-b74c-aa331eb5a0b4", "value": "49152:Z28VO84MtB1lIvwjJlevfgmr9WnJDzmCCeZpV8TDhR1TxIcF+lEE05A5hq:M8fnzIvwjJle3gciJDzHCn7AlEE3Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666958354, "uuid": "caf162ac-2a98-47e9-947e-b227f12a00f9", "value": 2593322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666958354, "uuid": "c4ede8e2-c93b-4d56-a66f-16f7082b39d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666958354, "uuid": "caa9aaf7-9b11-400b-a370-2cffc6899899", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece35b00-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666949327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949327, "uuid": "e95068de-13e3-4c6b-8a66-40b77c6eae92", "comment": "Malware payload", "value": "a601c21f7d83cdac2e7452c84d115118", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949327, "uuid": "d5da515f-fa71-432b-a7f4-64ac335ff4c3", "comment": "Malware payload", "value": "ce7aa34c7980559bf8032e777bdd68d74075acf957bb171ceacbfd3ba3154706", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949327, "uuid": "2e06db10-b03d-4bc9-b365-7e924809ac99", "comment": "Malware payload", "value": "f6c32160478154439b5d6cbd9baae690775af436", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949327, "uuid": "b0cefd1d-4fbf-441d-b381-2a3ac98c80c3", "comment": "Malware payload", "value": "87dea6b03717aa8d89b16bb8f26e7aeb3cb36c5717a2067610869b5455f1fc484b560e162f3abb4acd5c6643a732cf81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949327, "uuid": "9d78e647-15b0-43b0-8cc4-4b7f76834785", "value": "T10F413E467412042226BA33A84F7A9108FCF119171B1ECA40B81FD0956F34F2D22DA9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949327, "uuid": "6bcc1d9c-775f-4681-b219-fdb4e6d8c8c8", "value": "48:NsISsHjzu+wQIFtyQTwAAgvIAT5u1pccPVOJGGXyH3ivIcsWJoNBu8PaOP96S:uNZQct7Ui9luDccP0J0H3iQcXaSAaGUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949327, "uuid": "889337e9-ee99-4f3f-9711-c892823d16f3", "value": 2293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949327, "uuid": "9f011c25-5706-413e-831b-16010260db70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949327, "uuid": "84df5269-c6c3-4879-a0fb-0a1905537c03", "value": "carousel.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452f6956-56df-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666975245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666975245, "uuid": "6bf6ed62-a275-4104-951c-491e82eb0de1", "comment": "Malware payload (RedLineStealer)", "value": "d21ff6900361fbaf46e001dbea8e466f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666975245, "uuid": "f62353f7-0f2c-44ae-893d-4d69ba3a0169", "comment": "Malware payload (RedLineStealer)", "value": "ced84cfc7ef4d5dc6470bdfdc321b9f339343dd53f12bddced08676b19d1df05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666975245, "uuid": "156a2b44-dbdd-4525-94a1-7a836b830357", "comment": "Malware payload (RedLineStealer)", "value": "ab96c69cdd221997eda99eb524edf672baa0d821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666975245, "uuid": "02163dd7-828c-49f6-9901-30e737c97d20", "comment": "Malware payload (RedLineStealer)", "value": "c4ccd7e0b907599f6d7489dfb9582e7546f424493e4c5ec6154768634fdcfaa99f31ad9a4003f2fbebb33e862d52053b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666975245, "uuid": "a9fbab11-6b93-490e-96fe-7c205d087a32", "value": "T13D44CF367992D4B1C7851530402ADFA11ABEB8F0DE6F468333AC365EAF603D1956631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666975245, "uuid": "a2114dd3-a04f-4e79-ae0f-df13a807dcb0", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666975245, "uuid": "aecd15ea-9cf2-4e45-a73c-67fb20c28fb3", "value": "3072:ZXO9HjTLCVjAcibXGtmj5OkFijAfO/Xf01RxGp14TtnHXdo7Kwkf/eLV5ERiM/hy:9WHPLCWbWtOFikfO/vUnhH8kf/eMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666975245, "uuid": "6c6e990d-f899-4844-96fd-cd51a25d9a74", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666975245, "uuid": "a8629b03-a19c-46b0-9890-dbea534f9a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666975245, "uuid": "e1d21d91-d25d-483b-9f0d-cfd008b9b03a", "value": "d21ff6900361fbaf46e001dbea8e466f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60ba4ee-570a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666994010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994010, "uuid": "cb60e922-3101-4979-afc4-bb9cc8610511", "comment": "Malware payload", "value": "2b45411ed9ea8e68c029cc0438d58d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994010, "uuid": "d15055e1-1742-41e9-be6c-fca97819f383", "comment": "Malware payload", "value": "cf8b5aa132d63783d62e93b9152ae9001f830034acddfc5ef905e5584cdcc2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994010, "uuid": "b1ea3513-ac87-45f1-8683-1cf14caab717", "comment": "Malware payload", "value": "9a296a005849ea8619ddb1478ad597a3fcdc348f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994010, "uuid": "e5b52ece-fc1a-4add-bb9c-1272cfcd9813", "comment": "Malware payload", "value": "e5c57fe2c8342b6197f34e9303aa8e9f424364ebaad02df3cd7820c1c861d631600672475d6e81ac8e161a34f526b895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994010, "uuid": "bb9ec1eb-2a93-4f55-8521-2b240b104c4d", "value": "T163763322BAE398BFC03A41F54C31DD41B0F3D2494A14CA83539516976D7EBA9D2BF728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994010, "uuid": "3c915449-61e7-41e2-8f09-4ffe9478e9a3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994010, "uuid": "4a9bcbe7-f835-4a73-ae6c-c518aeae7a93", "value": "196608:91OmV9gYAf7ATQA8Jm+uN6lRZJM6+y8gYTwJkI3YWiyg:3OiBi7AM9JmEWy8gNGI3Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994010, "uuid": "97a3e2db-0201-44a5-a9cd-196cd55c79c1", "value": 7641130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994010, "uuid": "1c47eca7-f58f-4bd7-be60-72136d8e3680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994010, "uuid": "5e9370a9-bc05-438a-bf13-bf8a22b8f93d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3396e78-56f9-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666986624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986624, "uuid": "ca300839-9347-4983-a188-83c8d06b28f7", "comment": "Malware payload (Amadey)", "value": "fe096068c43e0291845e999f75f400c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986624, "uuid": "23702867-db07-4654-a021-cc7be95f0508", "comment": "Malware payload (Amadey)", "value": "cf95dca92b0825e77760fdce4714de6aa1f53a157c5b7a8fe55051f5cb44b969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986624, "uuid": "f08ed367-8d66-416d-b68a-1d37498629c0", "comment": "Malware payload (Amadey)", "value": "dc288ee2967ec97f6c5e0e7fb8293b3ec0aa77ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986624, "uuid": "18bafe57-93a0-4e38-82b5-9a2dfa1a93f9", "comment": "Malware payload (Amadey)", "value": "fae6615b14637632f0f0ea44e91fe08f41e6405d6a320cf3aa1b8259fa34c62bffbd64a5f543aa443ea7a4c76df989ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986624, "uuid": "c1fa6b22-8016-460a-93f3-0f9457c1ac17", "value": "T19454D0717590C432C48235304925DFE16A3EFC75E9299A83F7A43B5E6E323C1A6E621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986624, "uuid": "a5092cd9-55c4-4870-80c7-8d0003d2fb09", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986624, "uuid": "cda6658a-c509-4630-9a86-bcdc613e81ed", "value": "6144:uvBqgSL8ckht0pMKiBtsFGUJsI/2QbxIwJ6c2:wBEIcg0iBQDsNQ1B0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666986624, "uuid": "640702fa-fd6f-4b92-8232-b1e7cfb35871", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666986624, "uuid": "691ccb80-d57e-4e50-92f1-a9a258c726c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986624, "uuid": "0233ae48-f98b-4567-92a6-308ced9db08a", "value": "fe096068c43e0291845e999f75f400c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d46e088-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666939235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939235, "uuid": "3a69c8b4-69b7-4825-a42e-8713ed92e100", "comment": "Malware payload (Amadey)", "value": "c83fae2e288df00315ed055510767f71", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939235, "uuid": "0a6774ac-7aa1-478b-9ba6-31f21e6152c8", "comment": "Malware payload (Amadey)", "value": "d014be770ac6b7f81095b0b4de4c71d08214ab1eaa48808ee260b5a637587496", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939235, "uuid": "af084f76-fccd-4389-8773-5dbe7852a2ea", "comment": "Malware payload (Amadey)", "value": "0e54ff214d03a8ab5f04bf37a2469effa1952c62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939235, "uuid": "3ecdf39a-5e74-4701-a693-42f6e05796d9", "comment": "Malware payload (Amadey)", "value": "cc01a0f3db53ece65cd93a572dcb75475d2b1981bf4aebaa2455b9fb04232abca0ee3cf8218e5cb9da28744674df7487", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939235, "uuid": "56698bde-4251-4f1b-9dd8-f9d0a1f40070", "value": "T10554E116B542D831C48F013C4835DBE47A7BAC31152549B337A83B6E6EB13D1AAB739E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939235, "uuid": "b6c7ecf0-4884-4819-b8f1-5aa9463b177a", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939235, "uuid": "d2525f5f-78dd-4c9a-920f-b4c9509f00b4", "value": "6144:gdqfXm6K5KXgJhbKCivdXknAYyFjOCGX0:gdq/m6K5KQJhbehvBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939235, "uuid": "1ca7a98c-86e8-4c8a-b2c2-2a9070d09b2a", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939235, "uuid": "5a6cae57-ca89-423f-b719-afbf85866cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939235, "uuid": "1fae11a5-baa1-4e37-b8c3-5f5ac0ea5c15", "value": "c83fae2e288df00315ed055510767f71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a7f670-56eb-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666980289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980289, "uuid": "f8e31091-26c0-41aa-918f-25567088d974", "comment": "Malware payload (GCleaner)", "value": "a30e7789305d2641c898e604f380c98f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980289, "uuid": "d7b208c0-0589-4af7-b49a-0d8a95a2923b", "comment": "Malware payload (GCleaner)", "value": "d0b61c1d8f50762d71d34660df64493a43c1d2bc9fbf21e7d8a8a7c9267f06b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980289, "uuid": "b929f657-9b82-40a8-81dd-e405fdee284c", "comment": "Malware payload (GCleaner)", "value": "a986e767e997de01445d91d64d869d0accc0c655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980289, "uuid": "34662d9f-4fea-4237-abb8-692ced36ce7b", "comment": "Malware payload (GCleaner)", "value": "87b00e791839f5bf9790b18cfc8369ee944b371c05727329e337a6e42e6ab6a02aaf41f9776b7405a0298fbdebccf6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980289, "uuid": "1131ea5a-29dd-477e-a7f3-cc70568a5bee", "value": "T136C533AD49D2CCF1C0119DF2BEBCD25CD7156E948E7A601E629CC8DE1A3B990F881367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980289, "uuid": "73cc8415-415d-420f-9c24-ba8877ca2f81", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980289, "uuid": "26995651-68d0-46cf-8851-e9a019ca0276", "value": "49152:Z2GnGD+oNG9fTLu0vJlldsmrUMObgJNXBFFkn5vo79v5YuxA5hq:MrDtNW20vvsmrUdgJNXBDQ5vi9iuqDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980289, "uuid": "7396796b-eeec-46f6-97d4-7def7e6c5ab4", "value": 2532200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980289, "uuid": "c0dece8f-144c-4b0c-92ea-c3bb166783c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980289, "uuid": "e4e1ab0b-98f6-4473-af48-cef02ee22fba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ffa896-56f3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666983885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983885, "uuid": "3de0c7c1-28ca-4d9e-88fb-760a4b01dffb", "comment": "Malware payload", "value": "a14a17c4e1fbeda445d2ceeaca7518ce", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983885, "uuid": "83875013-2324-4cf6-8bf5-e898dc615f75", "comment": "Malware payload", "value": "d27fe6a42208e340e992bb1e4b346229d9c2663b9184238e01ab699c3a772a3c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983885, "uuid": "fb1c4146-d270-4816-aa32-23886e53aadc", "comment": "Malware payload", "value": "b5d10e3ff15419475162b91d8acb3861e4ae0208", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983885, "uuid": "f52bba92-55f6-46b9-bd04-2efb95d3d444", "comment": "Malware payload", "value": "407f232595521457becb1c335c5d4045dee96c8a173b41f163473b642c00dd752c324d80ef15ff83c5f4189b2ea7b700", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983885, "uuid": "65a73823-2a6b-481c-9db2-47b3b9ceb4c3", "value": "T14F83017A3E2B979D38E800D130E0437839313996D4C5BA28EF39679C6BC59D262533B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983885, "uuid": "721e3489-96f7-493e-ac36-178ccc17c28b", "value": "1536:e+K60e/GEPX1JJbcdJxbpt0g00ALOMgT8YSJq+oiDIsucCYQoPZ1iZ4KsChK6FVX:10e/T1fkogtALplLJnDIVcvQoP2Z4KZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983885, "uuid": "afccda66-f559-4dfb-9c88-a2384c98bef5", "value": 85808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983885, "uuid": "96524825-0b5e-4e46-8ab9-e46f4c110db1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983885, "uuid": "d914752c-c3dd-4d67-bf11-7cfefb17f8c4", "value": "Payment_10_2_2022.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15dae4b-56d3-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666970300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970300, "uuid": "554dfb79-ac0e-4794-bcdf-35d7c3b039e5", "comment": "Malware payload (RedLineStealer)", "value": "1b8122dabd7cc5b26b638b36644959df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970300, "uuid": "5818bbaa-6517-4ed9-ba19-656ebbc42c3a", "comment": "Malware payload (RedLineStealer)", "value": "d29207615954a14c746c6f1d6c5c8ccb33997ebf7f44a296c44972ed10a7102a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970300, "uuid": "d10b0368-d1c4-4850-88db-be41d3c4411f", "comment": "Malware payload (RedLineStealer)", "value": "7476421c47b7f8339dafa0061cd7c090ee0ef05f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666970300, "uuid": "a1781537-6242-434a-98aa-0f1a4d0a2f09", "comment": "Malware payload (RedLineStealer)", "value": "2ea6385ff7dd6ec2dbd0c0fbac16e96bd881df154829b5235c0a7aea35577b7a69368a10d625399cf0370b674489c80f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970300, "uuid": "e34c8b4d-3bdd-4940-b2ee-7da2aa8224d6", "value": "T106C5BF3AE74614B4D76357B1C18EFE7BDB04B6348026AE2FFF46EA0C64734126C89256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970300, "uuid": "1e951075-266a-406f-ab19-c30eaf187723", "value": "1b62f5ec48faa08ab096dfae72734859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970300, "uuid": "61163a12-f0b8-4ff4-872d-5be50c775f53", "value": "49152:3yTa5UKl7dQ6WFSPifCTyGBofbfrhmpSnfeJzdNbPmO95c9JY:3yTa5UKlZQ6WFGifEz4f9mpSfKd+O9uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666970300, "uuid": "5816fe92-2776-42e3-aa15-92e6703d3039", "value": 2513920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666970300, "uuid": "644c33aa-9396-4b84-998b-b24c2926db06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666970300, "uuid": "70b4076d-66e1-47ad-a189-97704d70e225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeac655-568b-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666939372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939372, "uuid": "fdab8e0e-0ca5-4c27-954e-b271242caafd", "comment": "Malware payload (AgentTesla)", "value": "c9357d62e8261e6efa0c2ff532fc060a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939372, "uuid": "6e0989df-37ac-4038-8785-79b3d0382992", "comment": "Malware payload (AgentTesla)", "value": "d2ed12fd19f99ee70c32cada95a76eee97a4218c7de5c61c4f5d054a77112886", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939372, "uuid": "6721ebb0-41a2-4106-be81-a37a3117da18", "comment": "Malware payload (AgentTesla)", "value": "6e49bf216bfdb69c1fa33a77d9cc8cdb10f84cc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666939372, "uuid": "14afc7e3-5253-4e7a-af83-1dda3a689ca4", "comment": "Malware payload (AgentTesla)", "value": "663a49e408d73fcc4c69e72fb1e9611def9621088e12f48596df33b148acef0406d6a60fd4154b0714e0647d639c84a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939372, "uuid": "870c876f-d4a7-44b1-b338-955dd428772d", "value": "T10312F901A7D40231DEB3027B3CBB5746C73697A798479BE9748C511E7F6269147233E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939372, "uuid": "71661f34-52a3-4c4e-866d-984b40c9db58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939372, "uuid": "ba38e9c8-8a8b-4d9b-a196-3730bcb7ac0e", "value": "192:BVJjU+7DLo8JuqFOONBn18stYcFmVc03KY:a+7DLdJuYOI1ptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666939372, "uuid": "3fdc0e3f-97a1-4e9b-8427-0543cf9803cb", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666939372, "uuid": "35a3fd6e-e3ed-475e-be0d-876e7f199c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666939372, "uuid": "5f10ae86-8c82-4947-a429-39b21bf7023e", "value": "Bank Paper Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0418918c-56fa-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666986732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986732, "uuid": "3c3db35d-a998-4eca-947b-0c0981feaff7", "comment": "Malware payload (Smoke Loader)", "value": "b12e8f04c8dfeb2ee994a001e4b8223a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986732, "uuid": "31e2caa3-57c9-4c73-952c-b4385c666659", "comment": "Malware payload (Smoke Loader)", "value": "d3cb4155317c670bac19dc7626fcb90da2107ab8b030264ab07bba3763db6315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986732, "uuid": "6f2911b1-c478-4860-a991-cb9300d0c4fb", "comment": "Malware payload (Smoke Loader)", "value": "c890b673372110144c3cfd3d5cfc5d8298de0d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666986732, "uuid": "7789a576-93b6-4343-863f-efd45c65dba9", "comment": "Malware payload (Smoke Loader)", "value": "826ad0455c41f1856278f735b688793b9e81ec9f5f00b354eb2987f6a50542b9a4a0f780a479a76f98df529bcc12dffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986732, "uuid": "d373fff6-fd15-456b-952e-91ab63e69842", "value": "T18544BE617590D032D08A65308835CFA12A7EFC329D69868377A43F6A6E733C1A77635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986732, "uuid": "45fca0cb-054d-4f48-8f44-04e57df54292", "value": "0094705b2c9b847219b2817888057ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986732, "uuid": "4a3cc657-00fb-4b4c-8f76-655578995039", "value": "3072:vS7yBgXQKLXTj63z5lYMx7ISRdV/U7h2JMhvEq8OtTwjZnGCVYysHVvZWooM/h3:gyBCHLjjYuSRdVxMhcqwdG6YyaKoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666986732, "uuid": "911c411b-2526-48f6-b8f1-f5141b412d9d", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666986732, "uuid": "1b078b80-4af0-4c3f-a1dc-3e6dfdef76ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666986732, "uuid": "e9221d84-502c-4e72-83d4-0443fa617d52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03180211-5659-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666917582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917582, "uuid": "6fa83d26-3761-48e3-865f-cb0995e14d75", "comment": "Malware payload (Smoke Loader)", "value": "1b5757f6bf45612b1cb723dde0c91a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917582, "uuid": "b7fc4716-ffd7-467e-abd7-7caf8eea1b78", "comment": "Malware payload (Smoke Loader)", "value": "d45188226339c4b1a093548c038e3c5650be473fad407d8c5d9e31044ac7026f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917582, "uuid": "0ec49cab-5347-44d8-8b4c-531bf469b511", "comment": "Malware payload (Smoke Loader)", "value": "f36fdf71ab2406f28ea17cc053f4cad27f5adfda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917582, "uuid": "57e7fd5e-79c6-4908-ba03-49655217300b", "comment": "Malware payload (Smoke Loader)", "value": "0a12ce09843937c9de2963215f53dd94874498d237802d1d19dbf4ce8069cd5298f1bae7ff5d04b8cab60ff4f51d0a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917582, "uuid": "fc6ee10b-64df-4b15-a86e-c84142f98835", "value": "T19144CF31B581FC71C485F530483ACFA11ABEBC311965894377A83BAEAE713D1B66621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917582, "uuid": "51d12f1f-8d29-44c7-b668-616ab7379e55", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917582, "uuid": "907d6245-8d2d-4e42-821c-1cda4386e4de", "value": "3072:/HXOsq5Kx+UIX15RPtxYH+QnEmJtUyG2jvbiwHO/hnSMM/h31:vfqTpPtIbJrj2wH4hnSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666917582, "uuid": "c2eaa8a2-d199-4999-92cc-04b7b752d099", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666917582, "uuid": "1b5151b5-eaac-4672-ae71-4e8cbd3e4d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917582, "uuid": "483e6ca5-fca1-4ca9-b513-78290edbd837", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032814fd-5691-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666941634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941634, "uuid": "84a26748-214c-45f2-9ece-2c4dc7fff7f8", "comment": "Malware payload (Formbook)", "value": "11d24c1dc65d56160c1fefbb08fccf47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941634, "uuid": "63ca2436-4d6a-4e9e-8f3e-d4205e9e37fe", "comment": "Malware payload (Formbook)", "value": "d4b2686a0405d7c8e159719a5513af3905418af3cf3ff67b6eca625c4a3030a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941634, "uuid": "33f55319-8b92-4304-8e45-23b67fd95ad8", "comment": "Malware payload (Formbook)", "value": "e0c1d6d970d38aff754ea09a97e643db028db257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666941634, "uuid": "92c17ab2-7502-4aed-8f5d-28ba04f7d935", "comment": "Malware payload (Formbook)", "value": "60f7bed75652d379da5543c17ed7342da5f757897c9c78014263c60c4ec8f2c46000b67897c61fb7ef0df6360c667ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941634, "uuid": "dab2ce2e-cf60-4b17-a328-9c47906d68cd", "value": "T19112D604A3D40272DFB6427A3D774B86C777A3AB98478BE974CC511A7F2254283632F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941634, "uuid": "fdf3f4f7-f5f6-46ea-84cb-884843fa4230", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941634, "uuid": "770d1720-6325-42f4-9351-c0a02756e10e", "value": "96:vQdrf5Ux/JL2J0q+nDFmhlhjvclFlwK3WNtW1jYcFoNVcz1W4oKYMsLYUa:ve5UxBL2J3qFOEHwK8stYcFmVc03KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666941634, "uuid": "d933fca0-3deb-4e63-9a4e-c7fc2739dad5", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666941634, "uuid": "9219fe31-e37a-4540-a92e-e1cdc1a006f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666941634, "uuid": "1b26dfde-c4c3-43af-83c9-de8e7a0c5032", "value": "SecuriteInfo.com.Win32.PWSX-gen.19331.23500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a367fb6-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938639, "uuid": "e542d888-9233-485e-a632-337fd7604f3c", "comment": "Malware payload (Amadey)", "value": "360d5e32bc097d629d76fbfcfdb5de1c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938639, "uuid": "0b24452e-8b00-4867-b081-a4f9ee07228e", "comment": "Malware payload (Amadey)", "value": "d4ed3bcafcc5ac771fad786326d3e2fa9293f8072d3721677e9f900230761029", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938639, "uuid": "f9a9f14b-83d9-4b75-86e6-2fbf0835dcf2", "comment": "Malware payload (Amadey)", "value": "5bfe4602e97839046021e480472d8e4581d8f32d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938639, "uuid": "b618de32-c691-4dab-9c86-2c8b46beb2ce", "comment": "Malware payload (Amadey)", "value": "1b41e2e20e7933e9f796a537b9e8bd75c2e0ee5841fd70f6c9c96c417bfea5a11d8e349e823eb6cf2a5fdd2292c27cf0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938639, "uuid": "92abb996-ad86-4991-bcd9-fb96954307fb", "value": "T10F44DF327692C471C0452D30486ADFA02ABEFC3119654D4377B8FB5EBE712C0A6A635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938639, "uuid": "1a0c4f26-d4e7-494b-a816-672217c90dc8", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938639, "uuid": "fd9f841a-3fe5-4625-bdcf-513e290d6a3a", "value": "3072:A1XONnqGywNxjimm8X159JYB+pfNY7eOsHMNdGSZ1PffUM/h31:yynqYbm8g+HY7ysN0SHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938639, "uuid": "7f402730-1c72-4138-bde0-d1ccb1f6c21e", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938639, "uuid": "d404de24-f0d8-4b3c-9e96-813f93656666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938639, "uuid": "d97c4d50-638c-4c32-88fb-6d354a76be2c", "value": "360d5e32bc097d629d76fbfcfdb5de1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0050e3c2-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994457, "uuid": "2895002b-c76d-458c-8879-9f2653c27ae5", "comment": "Malware payload (Meterpreter)", "value": "fd87146f6e2a130b1454724a961a1b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994457, "uuid": "90cb61ae-9764-4b55-a325-bc3a28eb5d31", "comment": "Malware payload (Meterpreter)", "value": "d5ba504331ca997200de4ef58437095926783685de46254266a8f06d594c8d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994457, "uuid": "b6f06eef-e627-4b1d-9e80-3de83e3afeca", "comment": "Malware payload (Meterpreter)", "value": "f92660e8a4f50ecb51609e4614606e8c7a400856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994457, "uuid": "7f8d9440-7434-41fa-8175-d0eb9aaa2fe0", "comment": "Malware payload (Meterpreter)", "value": "303160583aff2557078a777215a99fa5ae360212d97eeb66acff9e697261b7740fcc11c0ec191d72819ec5a0f152e48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994457, "uuid": "30a4a8e8-97c3-4294-a487-0e6a1dcdf2c7", "value": "T18B73BF42D5C41066D2A6127D17B23A759AB4F5FA3301C19A7A8CCEF9EFC18F097263C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994457, "uuid": "c53d853e-cdd8-4d0b-a1e9-5f0c4bb01997", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994457, "uuid": "a8a8c67a-41bb-4cec-998b-b41d7c433206", "value": "1536:IjMW60ckFnomY1W4OQKr5gZCMb+KR0Nc8QsJq39:wi03omDPRCIe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994457, "uuid": "4f0f8629-d6f6-4988-924c-4d1e5d9e096b", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994457, "uuid": "bf2becb1-7fbc-4884-8296-f44e3fdd87e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994457, "uuid": "f0993496-7bbe-4f99-a437-3794b7be23aa", "value": "solid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356bde17-570f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666995835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995835, "uuid": "22a77ae1-56b3-4511-bcde-4d07437f84fb", "comment": "Malware payload", "value": "034ece222dfdf22c13227c2d357c982c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995835, "uuid": "79417ff4-ed82-40d1-ba80-149d5f37be99", "comment": "Malware payload", "value": "d5f2f9565e608a3d57618b7f25689636c30baf9b4c93de4dfc862997e83f1a82", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995835, "uuid": "c75d5844-98ac-4181-bb57-29948d69e774", "comment": "Malware payload", "value": "62b2d3d070c871ee7d72db7a88114447b2c7e780", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995835, "uuid": "02f89586-d247-4d77-a354-17d60b7ecea9", "comment": "Malware payload", "value": "df6f162aa75707d9099172b36dea0f46386922c68e0217a3cf22a38c4aeaa7d7ab170fbc3a0b398ae90361fe452acd4b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995835, "uuid": "d9d69aed-6c20-45b2-acf8-f46de3accf00", "value": "T1B0A51287F396ECA6E5F3D6366970C2A3A40A4CB44A03E7A73E04757C09F7AC84B45D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995835, "uuid": "c5c6b9a6-5348-4abd-b3d3-615e8d902b78", "value": "49152:Ni9ZgNwCWBHenEjQLCRKUDXcQbT9N4F5Khsz6dQf:NifKGHenEjDDcKTIzz6dQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666995835, "uuid": "6ba19a2a-1ef1-4c97-a620-b3499511f2e6", "value": 2171673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666995835, "uuid": "6630b7e3-250d-4c52-87b3-96d46c75c350", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995835, "uuid": "c369ea4c-8602-4de3-b4e5-78ec910f339f", "value": "lydapk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44691412-56aa-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666952481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952481, "uuid": "ac523695-ccec-4dd3-985a-41eb3b079863", "comment": "Malware payload (Amadey)", "value": "ec16aeb01dd662c91e65287ee3f6af04", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952481, "uuid": "026f60b2-95e8-40e4-9aa1-724ef43db1f5", "comment": "Malware payload (Amadey)", "value": "d61b8c7a14074dfae64b7d7e671428299c9e09882e26eab7e558a533fb19691b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952481, "uuid": "75ba4a8f-e456-402d-a62b-1cd89d58960f", "comment": "Malware payload (Amadey)", "value": "7fb8b244b729ced782636f2df72bd92d096248cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952481, "uuid": "ba79c0dc-dcd6-4506-a695-f9700a52ae1a", "comment": "Malware payload (Amadey)", "value": "1e85d65ce34de06c7d1aeedc7eda5f00d6f02c9947a9e5089702758d09a2818806092f1fd560ca9266e90f28948977d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952481, "uuid": "5e5ce641-6a39-4eeb-83d8-636deb89b7de", "value": "T14054DF313B92C7F2C04211307966CFA10ABEB83D2575884773A82A6E9E7D7C1567671F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952481, "uuid": "4c0fd7c3-5ab0-406f-90d1-407e857fcc8b", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952481, "uuid": "0c0fdf11-3e9a-4450-9b4c-986fbb0f461d", "value": "6144:JLtH8LxFHeTarNxgDSR0bEttwnAG8jhE5ldMqfp:JLtH8ttempxISfwAtElhfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952481, "uuid": "d77fd8db-4c4a-4b44-b212-6483347691a2", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952481, "uuid": "eff55b28-db11-4fa5-91f8-ac90d7b59338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952481, "uuid": "eb66a1e4-fb07-4dee-9418-3b64f745c2da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6209f79b-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949094, "uuid": "53294881-aeb2-46c5-958c-1fb5ac25b938", "comment": "Malware payload (SnakeKeylogger)", "value": "eb027bfb34156d6efbdf4b41333522c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949094, "uuid": "2d1a5fc0-cf03-4df2-9eb5-490f890a9674", "comment": "Malware payload (SnakeKeylogger)", "value": "d65163defaea092a6be7661cdde670e18e54ae79790ffa5f64385daa5ceccabe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949094, "uuid": "5c147732-abb6-4db5-9a06-4dc5a23be1cc", "comment": "Malware payload (SnakeKeylogger)", "value": "41ff50272ab07e51c166c4b1694a147caf0ef923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949094, "uuid": "2bc17eaf-f749-4c8f-a2fa-d6e5f913ffa7", "comment": "Malware payload (SnakeKeylogger)", "value": "5f319dc278ff00d7c90584d76b8bf927c6fa5fed891ee6bc04b5fe121285e74e28ffaf787f39cb752b4c60ac5216e9ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949094, "uuid": "f5f852dd-3210-4592-960c-0ec9bf81ea24", "value": "T173C41284B511B2DFCC57C9728A2D1C34AB117D76639BA143A08737DE5A7E247CB061F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949094, "uuid": "92a410fc-1abb-46c4-87fc-196808c2786f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949094, "uuid": "1f1865d5-1a12-42ce-92a2-b8ea7b959e93", "value": "6144:pcaw7c7oZ0DKGkO1QsZ451KEE+n0/EqlF1grM5PgQX41vE95V1gNUWC2KE0ZLrMr:qh7YBWsenP0j1A+JEyLIEmdTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949094, "uuid": "24b79c66-d9c2-47fb-8953-f31a58b250b8", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949094, "uuid": "a1d50f3a-3430-4934-9545-e7bb5bc58eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949094, "uuid": "e5ce9579-198c-4cb0-b6bd-4006b7154f29", "value": "Ir2ZYvvQglAg4Rf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c891d6-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666937667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937667, "uuid": "ce6d4069-b26c-4f5a-a32b-cfd68c4a0995", "comment": "Malware payload (GuLoader)", "value": "73eeda1daeb9d579d7b5eab09e451163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937667, "uuid": "09f1ea56-c023-44bf-b3fe-cabaa5022c85", "comment": "Malware payload (GuLoader)", "value": "d75f2b8c4c2c2438bb95b8d61b922905a4ea11fa304580bacc8ae1d99d707c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937667, "uuid": "af233448-7831-4908-b3e5-fb31d8f1329c", "comment": "Malware payload (GuLoader)", "value": "fee9beeea57b32de805aaf42ce19b144300eb293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937667, "uuid": "0aff20fd-b5e9-4f55-adc2-4660cb8404b9", "comment": "Malware payload (GuLoader)", "value": "c6828f4b6f67302db575486a38501da4e9b257b77abe1ea33657bdd7c61d5a89c64466ab6b187880759dfa67ad6fca18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937667, "uuid": "04457759-0866-49a1-aa2b-4210f8f2796c", "value": "T12874124DB2F1D0A7F96227B12D32D63B29FEC72218A1921F2B90075574347968E3E739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937667, "uuid": "a3a90914-85d8-49a8-8ada-69e58c489595", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937667, "uuid": "20ba5ec6-1b26-4c4f-ac85-015ea48e7476", "value": "6144:FYa63kAywC9S+m6cS4T/Gx9LsRCPraAwqw5X8UeEtioeuPZjHII7qPFNBEM6Gsp:FYlbyOUcSO/Gx9Bra9tikP+I7qPdEM6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937667, "uuid": "a69c9f6d-0982-442f-91f8-29e1ab261c5e", "value": 347784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937667, "uuid": "2f35f22e-4c56-4b54-b94e-d9a886631497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937667, "uuid": "92cc0d34-0ca1-4e4a-bf3c-e0a22dc36175", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc483b9c-56c6-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666964815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964815, "uuid": "f48d16ec-7229-4fc7-9914-ff835a3e8114", "comment": "Malware payload (GCleaner)", "value": "b80f8a05346def38b9adbb63ef9ca6e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964815, "uuid": "bab21ed9-5a92-4d39-99c8-3ec3e1a81221", "comment": "Malware payload (GCleaner)", "value": "d81e10a7b0f6b3d9cc4afbc1d949c95049ba64819fb749684ff7b8befdb2c5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964815, "uuid": "8e47834c-93e6-4b9f-8e44-35b4b683f5eb", "comment": "Malware payload (GCleaner)", "value": "d615568aeb46ca3812b49fbec4dfaae101696da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964815, "uuid": "d4d6dae3-f881-4748-9a3d-7fb3fdfe92ea", "comment": "Malware payload (GCleaner)", "value": "58c4deb81de0eab8b925086d4f43adcfdfdbd9c57b8eb37ab796fe11e474c683e754ac8796fcc2338e55c89b62b1c3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964815, "uuid": "1ef2929b-f1e4-4585-b30b-f5534fb928b1", "value": "T1C6B53394AF4A88F1C12095BE2C2DCD1DED923E260D397A98BD9D8CAD4F77D41B081F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964815, "uuid": "f4554858-23ad-4ffd-9895-cfad5582bc1e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964815, "uuid": "27c5ea27-a612-4b5b-bb1f-582eb827fc2d", "value": "49152:Z2qK2xlZLEu8rlFHUJv/7EK0kVt3NVatwRvBw3MYC88A5hq:Mqnmu8zcLTdVtnasBwjC8TDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666964815, "uuid": "efb82673-ceba-40fd-8c67-82bebe0c04ba", "value": 2462571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666964815, "uuid": "efef98a7-bd7b-4d2b-aec4-640c5f4123a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964815, "uuid": "8c5356f6-2051-40a9-8e28-3356d0af2bdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da55e95-56eb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666980386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980386, "uuid": "7c78966e-70c6-445a-9e73-64d4dd6054c6", "comment": "Malware payload (RedLineStealer)", "value": "0eeaf9bbbc588217d2d3d91db2147ab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980386, "uuid": "9785000c-d7d6-4d3e-a91b-7ed96117a592", "comment": "Malware payload (RedLineStealer)", "value": "d8fc3434a00b7ab79cdccb41a5dcd0dc373353fd0da916f042095017e70b57f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980386, "uuid": "9be9f7cb-f37c-4c45-bddd-4ca0d18a6699", "comment": "Malware payload (RedLineStealer)", "value": "11bed4a9dedd2c38793485cf44ce01f9280cc799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666980386, "uuid": "983edeb6-a44f-4116-8817-f8a27f3075b8", "comment": "Malware payload (RedLineStealer)", "value": "6d189615256ba980704a891bf672206ae00c97f017ff9fb07d704ed2ca6be0906712d6ee420a80f288188cfaea323065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980386, "uuid": "3b497d5a-2de8-47e7-99a0-4070f5e5cc2c", "value": "T1C8D3391827DCEE10E5BE4B76A471A05187F5E543F953E33F8AD150EA1E72B80CE216B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980386, "uuid": "e12620fe-a7a5-47df-845e-515a6e4b1f83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980386, "uuid": "2e4d133a-1bc6-4d7f-9804-2b02fa19fb13", "value": "3072:TYO/ZMTFf/4Y7DcN5eNdQO5izV3gDFzSRXlhhSSQP:TYMZMBf/4Yk2dQOk1gUBlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666980386, "uuid": "3cbc3bc7-4467-4e39-8600-2611f62bcdd7", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666980386, "uuid": "4dd3b1b9-35ec-4bf3-b74d-f0e052762c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666980386, "uuid": "dec972ad-adde-4997-b847-85fa64cf24fe", "value": "0eeaf9bbbc588217d2d3d91db2147ab1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe456b4-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666937709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937709, "uuid": "11432855-256a-4fa0-b072-6e07b7354a65", "comment": "Malware payload (RemcosRAT)", "value": "4777279d6956d9033569cb565040668e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937709, "uuid": "61f734bc-625a-4590-8576-935a2a6bc8ad", "comment": "Malware payload (RemcosRAT)", "value": "d90bbcbaa704d7ba333fe1df351134fb9df73a6a9d96b81b5c36062134199a99", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937709, "uuid": "7bbaac43-8823-4797-9052-f2238fceed8e", "comment": "Malware payload (RemcosRAT)", "value": "a3f031fa11cd1b7a8eaf7e33cc999a2f665ffec4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937709, "uuid": "38bd83c8-8670-4e2d-ac84-ae220681d844", "comment": "Malware payload (RemcosRAT)", "value": "934a4ce789fdfea56123df32aa4d1af5734dd1309553ed2bd90e29cb36c357aa6ea718b9448455a36bf45c6c847862ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937709, "uuid": "955f649e-42dd-43df-8a0e-f40a2b684a4e", "value": "T147914E8522C1A8D0ABD78FA3AD2B65C7FD885C76EC28695FF441FC603D84104D6DD632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937709, "uuid": "c6854721-d03b-4b15-aa20-823244be24e3", "value": "96:fRj58omA4ySg3/DIKQWTmrm8UnNm8UCnnhCuCwCKYvcWcT/FJltva33HRUY5BFvx:fRj586psKQWYYNYCnhCbwLWm/FJltinJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937709, "uuid": "4b29d7d6-b93d-47df-806c-35cebfa2ec0a", "value": 4446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937709, "uuid": "db121dd6-d5ad-48c3-91c3-146cef2e98e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937709, "uuid": "99472df3-a55b-461a-9f95-ae8f53bbee84", "value": "TNT Shipping Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbe8e90-5694-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943180, "uuid": "cdbb7f69-7038-4a73-8e8f-e6b7cddce0a3", "comment": "Malware payload", "value": "d73a8e6682785632f1704bd5921c4962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943180, "uuid": "6d1eac40-4944-4069-aa31-a45b897fa323", "comment": "Malware payload", "value": "d99d135d8b437715898381e976cc94af8bc3bfb0336b134df5a641a6ade9655e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943180, "uuid": "8e1093f8-0a78-4b5e-aca5-cd90130307c7", "comment": "Malware payload", "value": "3e8cae694d6e44d3c7545ac3b7f1510ae0df0ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943180, "uuid": "f0e19704-4fed-4b9c-b84e-9672ae85d1ff", "comment": "Malware payload", "value": "c11e762a7656da012d2bda74fd502705a0cd70cce34bb33eda9e73a139949268f01e7b9c7cf4bc4a9efe0c3fec118055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943180, "uuid": "9f8e206f-a009-40c9-b0b6-4a10f923e763", "value": "T1EDC1E714A3CA533BEDB147716CB323C2127EBB226897EBAF9D80611E5C017401A60BF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943180, "uuid": "47157189-570d-4750-8ca2-fa4abf2860d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943180, "uuid": "3d97effc-b680-4d11-818e-10e23d00486d", "value": "96:w6x8GbcXhaltiS3oO6SzW+kEFpinIBHNITFnU:wA3cxalVZSKFp6ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943180, "uuid": "0a4293d2-8a20-43dc-a9e3-adfbb0e6bcf8", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943180, "uuid": "624bb4b6-0c0c-414d-84c4-652a49dd376b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943180, "uuid": "dca77004-91fd-48da-bd75-7d8242d82a1c", "value": "Due Payments 23102022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e462d4-5693-11ed-9266-42010a9c0072", "comment": "Malware payload (StormKitty)", "timestamp": 1666942630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942630, "uuid": "4a794e4e-275e-4846-a1b9-4e613fabf7c8", "comment": "Malware payload (StormKitty)", "value": "d97e41f8d67fbb966509824bf34191df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942630, "uuid": "e2ea4bb1-1efa-4b3b-b10e-c90fa7beb1af", "comment": "Malware payload (StormKitty)", "value": "da1affe84e54055e68af38dc7fda253d538925805b563d7a87686338a7b8d0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942630, "uuid": "1e88d2c8-7ab7-48fd-bfdb-4fd36b99bc0d", "comment": "Malware payload (StormKitty)", "value": "f7475eee9fe28e196d2d65f4803ffe48a3dc2b26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942630, "uuid": "efc6a754-2ffe-47bb-a2a1-8ce492e0defe", "comment": "Malware payload (StormKitty)", "value": "9d65ea9edf78ebe55441f7dbc41f3cb63c112a017e7a6853fa978bd2c47d84799e6afe4e7ce103cc7c959b3baa4ed9c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942630, "uuid": "8937a792-09e0-47c2-b7c0-0e4ecdde5861", "value": "T13EB3E8D2C58412F0EAB94B31917B5E0A472BBF3AAC24F95E749CB1627FB31C25122D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942630, "uuid": "d5d445e7-d115-4956-bf08-cb8e3aaae1a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942630, "uuid": "a3b422eb-225a-400e-b707-9b8c72a654ee", "value": "1536:gx/tmQiKh0Ovt0Xo++vw/18AyMMK4MIy+ZmVcl:6tD3OXo+mwNJb4MIy+Z8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942630, "uuid": "135aa2b7-0dc0-44ff-b2b9-d12582273fc5", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942630, "uuid": "249328eb-3dda-4e58-b2c6-f0c9067e9d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942630, "uuid": "791ca859-f69c-4958-ab1c-ac12c526a85f", "value": "182376,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5766539-5694-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666943275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943275, "uuid": "dc586763-9eb2-4345-9d2c-27b9147f78ae", "comment": "Malware payload (AsyncRAT)", "value": "750984a5dbe06c1092efbfdcaa2c0e45", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943275, "uuid": "64136996-350d-4e29-b5b6-fd70c687dcc5", "comment": "Malware payload (AsyncRAT)", "value": "dabdd1dc8f9dd5c796a50f9b09c2831073b318a0421a49af0caa153109e0488a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943275, "uuid": "712e9ce8-ffdf-4454-8ece-84c8aab6ec8a", "comment": "Malware payload (AsyncRAT)", "value": "7a77048b108835f4ecc15cad2ae2fc3bce2d8b10", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943275, "uuid": "3c14e276-dab5-4996-9a93-5e921bbf7a51", "comment": "Malware payload (AsyncRAT)", "value": "a873faaf6c1996c644daab0e510bc1e52a29aed23d00a54b32296223d5ab4e5524d83a9730de68fc5b85ace92ed8f5cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943275, "uuid": "2a692fa4-3ebd-46aa-abd1-bd7570467be7", "value": "T15723C07DA5831080E3925567F3F6BD37D226D976DEBA229C37082B60382560B2F41DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943275, "uuid": "2fd4036c-f3da-432d-be62-57763edb825d", "value": "768:otwjF6wFIk//xGWU/NaqjN+yUv4CZgS01ZNuIDyHmPHaPbgtlNJzLa2p9bn+ImY9:WwYwFDYWsjg/48euBtP83NQsSpr47pP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943275, "uuid": "54133db6-4a75-4dec-bb6f-0bba35020cfc", "value": 48063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943275, "uuid": "95d86f31-e16e-4f94-b2a2-952b671fe369", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943275, "uuid": "3af9cbb6-b8aa-4a44-a890-804192173cb9", "value": "GORILLA_Last.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8faedc71-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666959049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959049, "uuid": "45e5e1e9-8a36-46db-9064-8a555715066e", "comment": "Malware payload (RedLineStealer)", "value": "85d45be502f847709f874e7671d3c4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959049, "uuid": "1676768b-8dfe-4ebf-a1c4-c66e099f030c", "comment": "Malware payload (RedLineStealer)", "value": "dad67dd1d5da8f3e280317d922555ae44fae74b94e22c227bc53933b55348ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959049, "uuid": "0faa0236-b60f-42d9-b85d-68bf87228456", "comment": "Malware payload (RedLineStealer)", "value": "10f42d9ef8ea64c7a2888e5c89e6b5865c1ad7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959049, "uuid": "6b7cc9c6-5194-4c29-ac66-76e2b6e98dde", "comment": "Malware payload (RedLineStealer)", "value": "4c49e8273127f7f52c31443b9f2fd65295950a987218f57914c44036456ca755ca19a6a3eba4fa30743ac88082800a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959049, "uuid": "e16028a2-4f82-45d7-8014-c78eeaf17706", "value": "T12944CF317A92C432C485DE30042ACFA1DABEB83156754A4F37A42B9E9FB13D195B631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959049, "uuid": "97f9108c-bcc0-4fff-b586-a4002177bc6f", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959049, "uuid": "4d9562a5-6f05-4544-9b94-62a9036225e5", "value": "6144:5i+HnLdssqHVDN5I+qTPNZZUUXBBU6SkT:5i+Hnxnq1B5I+qDLBRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959049, "uuid": "f9ec3fa3-7374-45a8-a5e0-8d4217dbcab2", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959049, "uuid": "ac99fba8-c4b1-444b-8888-4d8b4e7f264d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959049, "uuid": "083753f9-3a02-4c6b-b87b-972e2b6c4126", "value": "85d45be502f847709f874e7671d3c4f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca8d284-56e7-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666978721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978721, "uuid": "7c179137-6952-4c72-af3f-01b41135dc3d", "comment": "Malware payload (CoinMiner)", "value": "7bb0d2298c885c4bdf37ef6e706a174e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978721, "uuid": "7006662a-d03d-4b57-8f18-cc212daf45dc", "comment": "Malware payload (CoinMiner)", "value": "dbf0aae6c8287ddb154a39afcd00415368d0ec92e9f7b7137639f277e73937b2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978721, "uuid": "9cd35116-673b-4dd9-b38e-274875407af6", "comment": "Malware payload (CoinMiner)", "value": "c50caee3b4eee9efe8402e60fed3d9b17ac40078", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978721, "uuid": "555e8fb8-5ca5-4bd7-bcf0-f236bfc6286c", "comment": "Malware payload (CoinMiner)", "value": "5980e024eaafbe44abdc2158365b666588da3ed9c0f2da32c1dde12fd238234990664072e6c2249fe7a4fa52230ecfb8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978721, "uuid": "e4403bc2-78d9-4149-9379-8be206587b7b", "value": "T17444D0317592C5B2C08165304426CFA15EBEB83125B44A8337A42BEEAFF53D1A6763DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978721, "uuid": "48285965-eb93-4697-a86b-1bdf31260038", "value": "c77dd599a098ccbfc3230384663cf2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978721, "uuid": "a085f53f-c771-4aea-a234-056f5162058d", "value": "3072:KXOiZJcPSy8zLGXSY27n59Uvp9wDwUo0qhVBt6fOoENE9vy+M/h3R:qPcPV8zLM2DrDwhx2fXEsx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666978721, "uuid": "a5dac778-c6dd-4a2e-8125-802baa012f69", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666978721, "uuid": "a836d9a7-0daf-4119-83e8-13c09d571bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978721, "uuid": "e46ecf0f-e13c-4539-84d8-b264b9168f64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c555b1-5671-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666927948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927948, "uuid": "87dd4644-b29d-49dc-b4e7-b9fa0aa8e54d", "comment": "Malware payload (CoinMiner)", "value": "33bbadd1424f695553f39c9992cff547", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927948, "uuid": "c85c7427-6798-4033-ab6c-48df7ede1045", "comment": "Malware payload (CoinMiner)", "value": "dc3ad407d38440453c61d2c67c6365f4a6ac9d403c28134ec339ef87af494841", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927948, "uuid": "b65fd943-c494-40c3-80d9-9908128e4f22", "comment": "Malware payload (CoinMiner)", "value": "2c5c4d4674fa1c7b5c3e6587ed552842e04bda9c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927948, "uuid": "9eab821e-7c24-4362-9639-1132aff24b01", "comment": "Malware payload (CoinMiner)", "value": "f2c9581fdb8818596fffa8444adc104cc4999564a228d7a9ce366d780470590eb7d7d2630a62d212022e3c13a37af974", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927948, "uuid": "4ac924ce-c448-4d5d-83be-21b93358e74d", "value": "T11944BE317581F8F1F4851130842ADEA329FEAC311665C98377E43B5EAE72281AF7625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927948, "uuid": "ddacd7fc-bbab-4e09-b7a8-ed233ff466a2", "value": "7b61acf6f32731558508831ea4bb0cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927948, "uuid": "19347564-ad7d-4abb-8152-08291b320f5e", "value": "3072:ovXOYHi5qL/jvQgt4bGC8c5leNCdNaLoy5vNwZGF/q45yChqlmIyA0nP8E3hZDM2:ErHcqL/jL4SCvDeoy5veYhhumIyRUEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666927948, "uuid": "33bc3e51-b84e-4d55-bb48-f891f071c5ed", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666927948, "uuid": "8df7e568-a025-429f-a65a-a9cfa3017a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927948, "uuid": "08b1e182-38bf-4034-8dfd-cb52cf3dda4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d605561-569f-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666947771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947771, "uuid": "55e68436-e91d-47aa-8236-63c42aa071ff", "comment": "Malware payload (Amadey)", "value": "43321eaa879437eae46270999e007499", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947771, "uuid": "33640a2c-6d76-410c-bed3-b972d2f2e02c", "comment": "Malware payload (Amadey)", "value": "dcc719901a99ee52247f18c4caada3b17eeead7e6fea2a2a820b088b0769f9ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947771, "uuid": "77acda88-7f43-42a3-acca-2267d6870c7a", "comment": "Malware payload (Amadey)", "value": "0f1d4edfe15d409359891d73539cab4fb16e7982", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666947771, "uuid": "d68e2f2e-9c0b-4267-a1aa-3fb0ed895fe7", "comment": "Malware payload (Amadey)", "value": "bccd7d3e1cc8eee63db33c068027b3d203ca7c39dc18d585bcce91981dc6f40c6747a531a05332cde242587d42e5d997", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947771, "uuid": "84bb3d3b-4a30-416a-90d4-1bccc7803fe6", "value": "T1BA54D0317992C472C44D2230842ADFB129BEB8F515A58A473BB4379EAF707C0A67635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947771, "uuid": "39a17be8-a508-484c-bb9f-3711398b4719", "value": "ecc19f5aa0026940f7f3361f97f4f032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947771, "uuid": "a828b781-d2ea-494f-93a9-f8cc5cf4c1cb", "value": "3072:rLXOnpHihLimWA767MG8dVZ5b0akiqAMJ2lbgAJYbFnqGc9OYeHcLWZlzg1UM/hl:rjKpHKLim67H8d1Zk9ZxFqF9QH0WHDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666947771, "uuid": "0c8b4361-44e9-4a6e-983f-2ff37df78d7f", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666947771, "uuid": "4c8752ff-b422-49e0-9de2-621b9e2def70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666947771, "uuid": "f7a4f7ec-b3ab-4b4a-9df4-cc048adf27dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddf9048-570b-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994399, "uuid": "fd705827-584f-428d-b0ee-bd1187d2dfa5", "comment": "Malware payload (Meterpreter)", "value": "b7a0bc8b94f5e9ae7da97a4b96671aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994399, "uuid": "b100dd78-1789-4ea2-b8f6-ee0d9588f162", "comment": "Malware payload (Meterpreter)", "value": "dd8522017feb8e056492e271237e316582c8102bdeae2ef9e61fbf175fad654d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994399, "uuid": "278ef157-63e0-497b-a7a0-71051b06d883", "comment": "Malware payload (Meterpreter)", "value": "c14528b2683d7a9d3fb75a73d28d1a21529216e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994399, "uuid": "ac275cda-61ba-41a3-bc6a-1df7d23ef228", "comment": "Malware payload (Meterpreter)", "value": "b5aafa4f2c7d693b07c27a1b0202ccbfd776cfef6f8a53705e6b1f6d45c7e5e1b50041d6fe76657bc0ebed0cb3c63697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994399, "uuid": "b6063025-accf-45a9-a105-0219b5199234", "value": "T17B73BF46D8C41572D1A6113E27B13A719935F6FA3211D2AA3A8CCDF5DBC1CB0672A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994399, "uuid": "7e175702-5fbb-4c6f-9a70-b452c5df3ef1", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994399, "uuid": "716a6960-12ff-46e3-9cdd-23d9028848c0", "value": "1536:II8kEx32VaOyVtSbIRrygxTwhkX9YsMb+KR0Nc8QsJq39:Kx3zOossWtGe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994399, "uuid": "c7ed1860-8be7-47a0-9709-81fbdccefe90", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994399, "uuid": "d7b28640-4dec-4ace-b1ad-5b34e7e393e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994399, "uuid": "1ec468bc-cfc9-40b7-b861-d2bc8dc1c024", "value": "aboki.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502d1bb9-5689-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666938327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938327, "uuid": "6b109369-d8bd-4736-974f-2b86d2f6cc76", "comment": "Malware payload (Smoke Loader)", "value": "46527c519ea53ff014d817d36a299ee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938327, "uuid": "c3ecb943-09e7-43d4-9bea-b18942861b3c", "comment": "Malware payload (Smoke Loader)", "value": "de118b112b71ce9ccdc9096e9f9e604ec8abc863968f22f76d6388d590dae54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938327, "uuid": "e68072f9-4e40-4a4f-8801-c4e4b2045543", "comment": "Malware payload (Smoke Loader)", "value": "941156c6121cd7ab585a9b3b7dc9a2aecb87b0a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938327, "uuid": "4aaca9d1-b06d-4e0f-a859-c1cce087d78f", "comment": "Malware payload (Smoke Loader)", "value": "0ce4423a01001ad3460cd6d999d9f358c92e58bce72139012500525b0e97be19bc3033ddd51702a9cb5fb4211e7b8561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938327, "uuid": "3a2b3bd9-f85f-4d86-ab9e-673125793349", "value": "T19C44DF19B682C871C48501304835F7B57A7BBC715629884B77983BAFAEB03DDA773362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938327, "uuid": "5a804d95-407f-464c-ada6-d0498d2eef0e", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938327, "uuid": "ff2df698-97b4-4031-88f0-b14168aa1b84", "value": "3072:wxXOtwqI5x+20nq5HYpkTyp54zFNeMtJqWYLkvb4e0Kv:WpqJgYi04zRJ4+b0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938327, "uuid": "0dffc5a7-b355-4999-8f87-604b1033017e", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938327, "uuid": "aceda5d6-1286-4756-94ec-c153fef23e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938327, "uuid": "c6d29b8b-075e-4f0a-a104-cc57315981f6", "value": "46527c519ea53ff014d817d36a299ee0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4979a5c8-5709-11ed-9266-42010a9c0072", "comment": "Malware payload (Heodo)", "timestamp": 1666993291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993291, "uuid": "435151b2-3024-4220-9e98-5cde41471ecc", "comment": "Malware payload (Heodo)", "value": "b017136d32360f97176ee265a021a528", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993291, "uuid": "306a18a8-01e3-4317-a26d-96e7de27b87e", "comment": "Malware payload (Heodo)", "value": "de11fbbfacd6c871dc2033f96f1dacb1815ef7122825f3a2fd1fbcc9459ce4ce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993291, "uuid": "c0f01577-e8fe-40e3-a72e-2ca50911f091", "comment": "Malware payload (Heodo)", "value": "c4bf52518f0bcf2d3982c2bdc39d7d7346a8f7e6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666993291, "uuid": "877b9afb-acda-4567-b617-cc807182d06a", "comment": "Malware payload (Heodo)", "value": "ba149c8bf8b149462942a30dfbac2d72fa09fa81e2100e0958a64eb65bf015a56b36c7d17ef3f08599ff4c7b65a81e55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993291, "uuid": "aa89a0f0-cf4b-46d8-9669-66770829bdca", "value": "T1B123CF5FE5AA6D57C2A6DF3C7F448CB8A70D268E958235D90894AF0E3F046631E4F02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993291, "uuid": "6f5fd1ac-0962-4198-b516-f02210f540be", "value": "768:AmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:RBlntTEvDLmXi3JvG6YzATOJnXYSXRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666993291, "uuid": "7e39fe50-6955-4d21-a6c8-1d5bb9e258d2", "value": 47738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666993291, "uuid": "5c1b9860-9f4a-4c19-b217-c28610eafd98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666993291, "uuid": "fa01fd91-a209-442c-b9c2-405f55871094", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ef57b0-5702-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666990383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990383, "uuid": "7a59350e-aeb1-41ce-82e9-aa1ca00a181e", "comment": "Malware payload (AgentTesla)", "value": "416a9e3e39d9ecc951690848955b60e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990383, "uuid": "2ced8570-cafc-43df-b1e4-ae066a771944", "comment": "Malware payload (AgentTesla)", "value": "e1e0db63d4013593071a7b4e9e171eca2efc3f5b0978204eebbd5462400dca28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990383, "uuid": "3a7ed1fa-2e74-440f-ac35-17f139433414", "comment": "Malware payload (AgentTesla)", "value": "861815f3eb4a09e231db78572b45ab260ed4984f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666990383, "uuid": "88124916-c978-41e5-b61b-b1d66e2d77e0", "comment": "Malware payload (AgentTesla)", "value": "dc61284829d286325daa1ba23b61317628a9eb0826fef1edbcc8ccd7534716113b86500703e9fcd81967e6938150246c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990383, "uuid": "f3f56d44-0512-456a-9e46-1eb23bad8e99", "value": "T106741220F8C0D5BBDA228732A5B04FA7D27721156931398B27705F7BBE583C79E0935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990383, "uuid": "ede3e8cc-dc42-4b5c-aa26-f72456b69f3b", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990383, "uuid": "e821ad77-03a0-4983-9f7c-4a0b76895750", "value": "6144:qweEpYYa5BkXyj0Ti7RFcF3qIdIA+aJm8l2IJN1bQfdd9XqOihds:bYaIlPSrFA84IzqlPXqnhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666990383, "uuid": "e929525c-e9dd-4b91-a816-cbe94bc8cdf4", "value": 342971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666990383, "uuid": "856428dc-ae8a-4fdc-b8c8-bcb9070ca446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666990383, "uuid": "83c052f2-ab3b-468a-9116-6bcd42675a55", "value": "invoice copys.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054ba6d0-5670-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666927464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927464, "uuid": "35d7f235-e3fd-4aea-ae54-a62240ae97b7", "comment": "Malware payload", "value": "42a8ea5bed2eda1bc98cc35fd544b1ad", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927464, "uuid": "e0faa83e-cbd8-4b3a-b470-5ceff72299e0", "comment": "Malware payload", "value": "e33db7c76ffc8695ec784913ce0bbd3542c7b5d3828adb27dee40305c3037413", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927464, "uuid": "b89e5188-b7e6-4577-81a4-b28e2349a3b2", "comment": "Malware payload", "value": "274c97ad1d17b9cd9ae078254d6aabb8942a007d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666927464, "uuid": "8933aac5-f618-4438-b5ef-9fbf69bdc146", "comment": "Malware payload", "value": "1747389e87b7a79dbd0fdaa709dd0ea1179e441ba55390a506d7cab8fbedace3c0939f4c0df3ed4a6361a71ab3245b96", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927464, "uuid": "fb1d31ac-7020-4f32-97b0-b2efeb0ecfd5", "value": "T17352A547DC4F8C56811088AA7BD9D11DF267D4A5C97E94E4B0EE3E0A8747CCD04B3AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927464, "uuid": "0067d10d-008c-4ef3-bae1-93abc6aa8472", "value": "384:ZvsKrU12Y64A1nnC7AD4H82IU9alCQnPhBGFOKG3:ZvsKrU12YTA1nnC7AD4H82IU9alCUP+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666927464, "uuid": "c1b54363-8fd2-457c-a6c0-e1fd9b44fe53", "value": 14445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666927464, "uuid": "4fc04dfe-98ec-469f-b72b-3b48e44e1bd1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666927464, "uuid": "19494364-ad04-460b-bf18-438f87d9f66b", "value": "e33db7c76ffc8695ec784913ce0bbd3542c7b5d3828adb27dee40305c3037413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b88c6bd-566e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666926830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926830, "uuid": "05bd618a-bf57-44ac-98bb-092dc97c979c", "comment": "Malware payload (RedLineStealer)", "value": "588a8fdeacae2dfff85fd4a8423d66a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926830, "uuid": "0830c0f6-5b5a-4964-86eb-c7c1c0bd2b44", "comment": "Malware payload (RedLineStealer)", "value": "e41c6f2ea948ada4071efb5e95e528d5f640714e0c5c14a98e7e7ced0f924a88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926830, "uuid": "aedbe8f9-ea08-4eee-b1cb-a1a218180e7d", "comment": "Malware payload (RedLineStealer)", "value": "aa7a7dd2b03258fcc8a50d8419852dd71dc34326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666926830, "uuid": "9f50cf9a-edb8-45f4-9cce-6a5c1a49085c", "comment": "Malware payload (RedLineStealer)", "value": "f9f0673dd20ee08ee3c05e5d9330bd227fa13043785c7b04de18150a3c80faad0d750ebbee6cabd184e06c7674c715cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926830, "uuid": "027ea5cf-ba72-4d0d-a090-6dd0ec9cbe64", "value": "T18284F1727951C471C4821530482AEFE429BFFC7529644A47BBA03BEEBA703C25A7635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926830, "uuid": "5ef6e49b-9bee-4e56-be90-80be7bc0a0ea", "value": "7b61acf6f32731558508831ea4bb0cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926830, "uuid": "7889c969-a768-4582-b8fa-2e4340e29f4d", "value": "6144:mlHU0LLozZs+7NjJME2GvQisHdkOC1UAEFN2wCS1aupUPE:mlHhIm+Bj2tG9xOza8U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666926830, "uuid": "b7cc0dc1-a037-48af-b8f9-a0ce8858ae39", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666926830, "uuid": "fc108efa-cb27-46db-8544-68972a0fa82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666926830, "uuid": "48343437-b9ac-487a-b9c3-060270555c47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6667d1-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938646, "uuid": "cbca6573-634a-4a3e-ab1b-cd8684fb2e58", "comment": "Malware payload (Amadey)", "value": "96f64bebaa94846c5136514abeb29ef5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938646, "uuid": "bf86b921-7a26-4f62-861d-46a40279c7ae", "comment": "Malware payload (Amadey)", "value": "e5809497c25820755e6eee39dada49bcf05e10a77d52f51a90c86cfa059e0385", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938646, "uuid": "a7f7b3ac-d66d-441f-acad-8b92e7d18d6b", "comment": "Malware payload (Amadey)", "value": "7f5870e6b8555c3750b3bbe859202ec634be253f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938646, "uuid": "0a3c23d9-c578-4a9b-af54-ec57cba3c587", "comment": "Malware payload (Amadey)", "value": "8718d452b247a598d049b9f25bc57242fd347dddfa474916fe494c07fe4c4bc09ed377c44107550ad0c6120501077966", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938646, "uuid": "75e60905-4535-4c2e-9782-4075474700bd", "value": "T1FC44D016B692D871C48207304827CBF0797EBC711EA58A7737943B6E6E702C1A67637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938646, "uuid": "6c9d143a-764d-436b-adbe-231f0d7ea3de", "value": "e558f40aca4f32a75ed234dc7b40d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938646, "uuid": "29e0a39d-62dc-4f59-b92a-d8f2078107f3", "value": "3072:TmXOVqG5xslMnq5yAA/bW3tVqGRDjdhFGRcfmbcF48lPHxKLPjkGRvOX0Kv:CmqMnAA/63t1RfIRcuW4+PRI46O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938646, "uuid": "30c80353-7405-4158-9912-3d7d0093b7c9", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938646, "uuid": "dda91921-1643-4966-b1ca-1950668037a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938646, "uuid": "63958250-0712-43e5-bb31-e1658c2172e2", "value": "96f64bebaa94846c5136514abeb29ef5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49d6e23-5698-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666944992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944992, "uuid": "6b8415fa-7f20-4992-be21-5662917a27a0", "comment": "Malware payload (GCleaner)", "value": "b000181aea5d138c69bd0c6ccea90701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944992, "uuid": "08404465-5527-4e46-97c1-173e82ac09ec", "comment": "Malware payload (GCleaner)", "value": "e5c1e7ce7b1e241db231192e5807c39814aaaaa41b681bc53580d896bd040beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944992, "uuid": "f83668fd-22f2-4055-982e-c1fc80a40727", "comment": "Malware payload (GCleaner)", "value": "40009af2994acaaf5544f61433dbc6fcdc60d874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944992, "uuid": "c9948369-9fa1-4816-911a-a7de8876251b", "comment": "Malware payload (GCleaner)", "value": "7e17aca6869eeda41eebb9b175df8e2fd4d96b416295b97c99b4af3a7dcac1def5113f87cf2edad84c908347829c183f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944992, "uuid": "5b1c515d-e62f-4953-ad5c-abde9b1f20de", "value": "T134C533239B5E4572D0E481B58D3F936C4873B4354E1D9028BBCC55AE4BBBBD0E60ABB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944992, "uuid": "3b0b155c-26b3-47ce-b5ce-c1d6f30abf24", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944992, "uuid": "2d2e5d29-2637-4f15-ac7a-7fe0577e079f", "value": "49152:Z2maAUqfZMZoQojlw69RPOAB+xv/QVd1VHvMUgmM3/Al8A5hq:ML2NvZOAgx3QVDVHvMUgtAlTDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944992, "uuid": "2ed27a34-e316-4825-a08e-9b2e3803134d", "value": 2590502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944992, "uuid": "7053cbe0-25fb-40cc-9faa-bd4b3c326de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944992, "uuid": "53867c2c-f3f9-4745-86fe-6bc455221576", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a426ce-567c-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666932753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932753, "uuid": "f9e8fb14-6d06-4e5e-bf0d-168da421a9a4", "comment": "Malware payload (Amadey)", "value": "f3db52b965828c05385748c0f4177098", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932753, "uuid": "272071af-7b92-4b22-88f0-6f34be41e243", "comment": "Malware payload (Amadey)", "value": "e5d8b6b4d63f5af82439170e976855eb7b6eca35ff33dd43a2e16356788e4679", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932753, "uuid": "80b70b14-135f-497d-a7eb-2aa9d103de7d", "comment": "Malware payload (Amadey)", "value": "44163dbc86e7cc03ac952654c816b83c4c23680d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666932753, "uuid": "e2be05fa-b7ac-4488-aade-0b830fc0452b", "comment": "Malware payload (Amadey)", "value": "324ffc4ee63e50f95627d96b1398ba4341d46c2475be6e6fd60692f4e37ef7d6f937a4e2a816b0a967fa1a9afb622368", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932753, "uuid": "002197fb-04da-49a3-adc5-cb93e98eff73", "value": "T15664CF32F592C47EC4821130882ACFE5297EFC31196446C777A83B5EAEB13D1A96635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932753, "uuid": "802abbbe-f63f-4400-a939-8848d2d1db62", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932753, "uuid": "60d8a562-2c18-4f88-a333-01a861df101f", "value": "6144:F9hHNLkC+zKLusZS52r1Jk8y3lxoojXHn1P1dzj:F9hHNALziushxJk8y3zZV1tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666932753, "uuid": "ed40df77-05f1-422d-b251-502377c95eee", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666932753, "uuid": "682134a6-c54c-48f4-ad71-55be49b8a084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666932753, "uuid": "d8211a62-91a3-480f-9677-e5828db640e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9288c199-56c2-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666962920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962920, "uuid": "05669ee8-d84d-44e0-b64e-a5f2dc1c6501", "comment": "Malware payload (GCleaner)", "value": "3c3067cc977dbc3cc1933d4dc610b409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962920, "uuid": "be165c6e-b04e-426d-a1aa-95415e2a6abc", "comment": "Malware payload (GCleaner)", "value": "e60ef5b57dde006713451fc604f9896dbe79763734189aa39e86d0ed6dfd9b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962920, "uuid": "4d00b378-8311-45fa-87de-a9c168e729c3", "comment": "Malware payload (GCleaner)", "value": "1ce3023c69012cc637bdd3853cafd2e4bd8b128e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962920, "uuid": "018c43ab-cd2c-43ee-a0ae-d12c45264a95", "comment": "Malware payload (GCleaner)", "value": "01b7549bc1e40ed460959c69359788f9b8ef17653da4e6df6e876c1f9ecb6371f2896bf4fd8902da0dd029e1c604c84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962920, "uuid": "1283087b-d7e1-48ba-89f7-bda1a3b195fb", "value": "T121C5330BC854C974C4A0ECF98F35A6284A637F0934B9B025299ECACE8F7B5C5C4197EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962920, "uuid": "32facae0-ec7d-4c19-abc8-c1e6bcc5d8b6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962920, "uuid": "5ab2baf0-f88b-493a-aa23-31e63983560e", "value": "49152:Z2wWYHzKRm1iS7TyVWAMP3JKym8U2swUm6RKD3LtYiUckhDA5hq:M1YTG07BAMPjm8U2svm6RKD3LtdDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962920, "uuid": "5952ff4a-3549-4fa5-ac87-6316dde0d330", "value": 2642162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962920, "uuid": "8ee6f279-131f-4c3a-916b-5dfaa81acff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962920, "uuid": "901bc194-4c13-43db-8215-852d7ff62f55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229f61c4-5674-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666929231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929231, "uuid": "c35c95d7-af93-4747-ac20-f2fcc0abfe6d", "comment": "Malware payload (Tofsee)", "value": "820dcdce3150b364022f0714926e924d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929231, "uuid": "8eccc19f-d817-4e79-b0e5-1877c0729349", "comment": "Malware payload (Tofsee)", "value": "e61fc7a09bcabb92811f1e471c98de99bef42bacf595f332413fa63048220fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929231, "uuid": "e6677887-c0ae-40ee-be97-6f5d666dbf13", "comment": "Malware payload (Tofsee)", "value": "d53da307c7d02a3cd8027778940892f8d5ef23b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666929231, "uuid": "b875274b-1984-47ac-b67c-70f827e59017", "comment": "Malware payload (Tofsee)", "value": "80277281a498f233770cfaa2f5f23b141c3826bcc50747e31aa86c8675e980fa5a707ff73c6027e9cd252b22f2561709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929231, "uuid": "34598b26-80b6-4767-8d7c-75da40f1b3d7", "value": "T1A644CF327A81D871C44511304829DFE42ABEEC3119648943B7EC3B6EBFB27D1A67625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929231, "uuid": "05885fe4-3c11-45ab-80c3-77ca0f9fd45c", "value": "7b61acf6f32731558508831ea4bb0cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929231, "uuid": "f0594a7f-9056-4066-bbc3-cdf81d4115ed", "value": "3072:CAXO4HAZl/LkDXQQEujGW8c5zWePNt3XLvmghqEolsPRhQFxOh4j93k4b+M/h3Q:1zHel/LkDOuqWJWUoqP7QFljNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666929231, "uuid": "fe970072-657b-4c63-ad62-556a09fb6f6b", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666929231, "uuid": "443b6f64-33e8-4640-b0b9-d90b2b54bbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666929231, "uuid": "b7f0e3b6-b4d2-47bd-8d91-b3aef44f75e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d54d25c-5697-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666944389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944389, "uuid": "afeac237-5d53-4821-aa06-99bff05409d6", "comment": "Malware payload", "value": "958318b163eea97096e345be7c53c517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944389, "uuid": "0725147b-2af7-4006-b371-ad3f2bf51a2d", "comment": "Malware payload", "value": "e65663ea318c6ff19b2610d29a5b2bfd706fa82dd48a432be7717b9de91d61e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944389, "uuid": "8491c5a0-398a-4636-abe8-e6696fc461b0", "comment": "Malware payload", "value": "7a372db317f231d915865ee39cf32179e62e6ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666944389, "uuid": "c5d2e99a-9edf-4901-96a6-da7034b4733c", "comment": "Malware payload", "value": "15d54b40f45d12a0110e51266c9736c6849cd44d033562fcd0c3910497f7b5e64c2507733496c2aaf196b2ff27b97bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944389, "uuid": "e5d02346-4492-4c92-958c-ad05dde3e1b4", "value": "T1E502B8F72580E86EE7B613B8889628E9577C2A60936F46F7007BB8C50FC0DFAB535505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944389, "uuid": "2b11e266-3d14-44ea-a833-7e893a8fb9fc", "value": "f86c40951aca23ae35ef383caa15b678", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944389, "uuid": "1822c41e-6151-4b06-ba1d-e92e07686b5e", "value": "192:xOXRuTkziaDivWeA193sNC7W2vZwqiOU7Xan1oK:yRikzifvWx8NC7VZwWUran1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666944389, "uuid": "391d74c7-44b2-4549-bcf3-52342ac4a7c7", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666944389, "uuid": "1b4d5cb5-b414-4043-8552-2d105dd1aa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666944389, "uuid": "31a7c970-01b3-4bdb-8f9d-59aa8ed66dd5", "value": "Build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315a8e35-56a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666949442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949442, "uuid": "46b80373-17ba-4b83-945a-fbe60605d3ab", "comment": "Malware payload (Loki)", "value": "8737f5c662725889b090e01154623c0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949442, "uuid": "9016367c-2185-4e40-a369-fb31d0aa676f", "comment": "Malware payload (Loki)", "value": "e6c6e6e78b71aa2052f36f9a965ea140cc231cbff6592021811539ab5950891c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949442, "uuid": "8badab3b-4b8b-4942-93d6-131de244b571", "comment": "Malware payload (Loki)", "value": "200055f788da1e35b5dfd9ca28f4bcbf59e94454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949442, "uuid": "355586e0-7342-4b85-9473-8cb20f1984a9", "comment": "Malware payload (Loki)", "value": "66128f761951d3499056b4bddbad6f7a4d015659e3fbfa28996f1e591fb4117132fb8ac49b6cc56b558577ca89492531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949442, "uuid": "958a9bd0-2fe9-43ce-a8c6-c365471f6224", "value": "T1C904122574E058B7E9420B701C7BE7FFA9F7D9216215054F97B00FA96D662DACC080AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949442, "uuid": "c1b6ccaf-d1fd-4a62-9c60-0f1d2e8ff51e", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949442, "uuid": "5bdddf3d-9860-4bb6-b75e-c9fffe750cbf", "value": "3072:qUJoFfWzzl+cSMPALFD0GLUK3ZEjQSIwfeIqRuRVBfzvEa/Re7CuHRwKuicmt1UG:qweEpPYR0GoKJIIwfLxzveXtcm7+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949442, "uuid": "922ba641-fb00-49ab-a739-84cafc9b7c11", "value": 184127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949442, "uuid": "0f9f3fe1-7528-49be-8fdf-3fc4f774e8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949442, "uuid": "211e8856-7c68-46c7-8046-01a1834e54d6", "value": "8737f5c662725889b090e01154623c0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51404be0-5710-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666996311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666996311, "uuid": "78bc8b56-baad-443a-b2fe-416d60a46f85", "comment": "Malware payload (GCleaner)", "value": "4171b6aadeea83b05a615b6c0bd8fcce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666996311, "uuid": "25eeb191-e313-4613-9190-0b3f987ffa5b", "comment": "Malware payload (GCleaner)", "value": "e831fcb1c9929f4a88ea82c364de4114a5f2012e90cda1ba35316b8eb311e39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666996311, "uuid": "d23d9343-6113-4b91-b228-9106e353388d", "comment": "Malware payload (GCleaner)", "value": "20106c4c416c729acf92eea51c284f83105a8844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666996311, "uuid": "44fc813e-5f83-4263-b447-9c1aba30ee7b", "comment": "Malware payload (GCleaner)", "value": "f6d722cca22a729f41f3f55840c6747ea1d4bdf420b3ede82e4b63b6f08f0fd1603dbb29c15b0ac569e02b148c6a6f37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666996311, "uuid": "219a3c8f-1beb-4ce7-a2a5-3737fb3a4b63", "value": "T110C533D082A0B178D17249F008FADD31DD333CD8A86C5955FCDD49D8AB27AF5E2213AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666996311, "uuid": "e0315984-9c77-47d0-a1b2-68fdd4ee8f20", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666996311, "uuid": "050ef00e-79f3-4c75-836c-313e6c7413f3", "value": "49152:Z2eusNpW8xNxjVjkSjU1aQMikUS8x7MWNlk6Y+RXPtK0MROb2EmZLCtA5hq:MexN3xvhgdaXi175sgRXE00LDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666996311, "uuid": "0e73494f-d3e6-4cb5-a312-869df83324ad", "value": 2566305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666996311, "uuid": "1d71a0ea-756b-43ea-a7f2-bdca36fa27b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666996311, "uuid": "0fb9afe5-1721-4589-b2c0-06e31afd9571", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589defca-56e6-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666978284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978284, "uuid": "cb436c0b-e15c-44db-9aed-973dc7bd57c5", "comment": "Malware payload (Smoke Loader)", "value": "bf801c2fb909f3ce58ba2e04466b55c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978284, "uuid": "d9e9c13a-9a4f-4008-b695-fb7bd0568084", "comment": "Malware payload (Smoke Loader)", "value": "e8ef433038b2b91197b4f616ecdfd5a8abd699df6d0e806c376c5ae249923757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978284, "uuid": "f75c0bc6-d017-4b0e-8712-109115f9e985", "comment": "Malware payload (Smoke Loader)", "value": "618dc594de3e3790ab8d316fa276a3ca2e560231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666978284, "uuid": "a2b568c0-9863-48e8-b166-2605b769ea05", "comment": "Malware payload (Smoke Loader)", "value": "6a4a7997c192c0ddf9ab049b03eb5ddef7a70420f827fa31eba8e61e14212080a83abb7a1fe65615b74797ed34dde447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978284, "uuid": "1cf07197-3084-4674-979c-ad7d0f0dfd23", "value": "T1B944D0327AD2C4B2C44A1634042ACFA11EBFBC3115654A8777E42B5EAF753D196B630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978284, "uuid": "cb2f52a7-1cb3-4313-af51-17140520bdcd", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978284, "uuid": "80799642-07eb-476b-bfef-85731451479e", "value": "3072:tXOFXHhNLqyAc+8XGNmj57fZYm6NL7IhvHkT1yW0+IJGCW/qGzT9mc5M/h3i:pSXHDLqD8WNkxYms72knqGfj9mc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666978284, "uuid": "588d5e72-0fb7-4c57-a02f-21736f158f0e", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666978284, "uuid": "b77742c9-632b-44df-9d52-02c7d2d4d69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666978284, "uuid": "4d4386af-cf23-4000-be4d-f649cce11349", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ee57d7-5687-11ed-9266-42010a9c0072", "comment": "Malware payload (CMSBrute)", "timestamp": 1666937369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937369, "uuid": "fa8ed3e2-561a-4edb-98dd-f21e77ddbe95", "comment": "Malware payload (CMSBrute)", "value": "f2a2c29f88de62cc3e85e20a3776506f", "object_relation": "md5", "Tag": [ { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937369, "uuid": "4006d4c5-df6f-4552-8aa0-c27534dc1246", "comment": "Malware payload (CMSBrute)", "value": "e9e0d434434317280e474dedd4a72f60a9136153acea4d8e8ac64d77ddc25b38", "object_relation": "sha256", "Tag": [ { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937369, "uuid": "f0e9d35d-0204-4f2c-afed-c8ee9fdb1ff6", "comment": "Malware payload (CMSBrute)", "value": "585ea62f36786f19a0a0ebb1e9c781cc1b195bfe", "object_relation": "sha1", "Tag": [ { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666937369, "uuid": "7727d2bc-0569-4a72-947f-ce482f024c8b", "comment": "Malware payload (CMSBrute)", "value": "8c65df7434f4fafc77e1d8c6af65de3be0ef192a62da209ff41f4262c51c2512a9168e546eca0e8616ac4a6675f5a795", "object_relation": "sha3-384", "Tag": [ { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937369, "uuid": "9f5a0144-6aa8-4d6e-90c7-2d2b3f027f8e", "value": "T1C99523307B51CC72C163143DCC34D6E56E3A98326EAD1647EFA4AB9E2E707A9932D341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937369, "uuid": "4fd7d7b2-6a76-4da1-a297-c351d2b5e25e", "value": "e8e661a38e14e660bf8d40ad7ce84bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937369, "uuid": "c2151089-4944-4e6f-9b60-428eea13e37b", "value": "49152:CcUpxhH6Qy978g+PNHQznp6uvCjgYkOCF/BZTet2AB:C3dajd872znpMJ3kZCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666937369, "uuid": "e9a60f1a-354d-4a3c-b3ef-40d449ac952d", "value": 1979904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666937369, "uuid": "a91790d2-818b-4adf-86bd-de7ee4c8b096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666937369, "uuid": "b56e0d93-30b1-41bc-bbcc-fa6f8199d194", "value": "f2a2c29f88de62cc3e85e20a3776506f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fef243c-56a9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666952151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952151, "uuid": "5cba1efd-0f0f-45de-b4db-46c24e081ff4", "comment": "Malware payload (RedLineStealer)", "value": "47fea11d088bc58cd13a1859ef6d4d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952151, "uuid": "8807a352-1432-4c9b-8f97-f76beef943eb", "comment": "Malware payload (RedLineStealer)", "value": "ea51e33db045191976e76dd44df190ee1bb70885ece09a3ea3ec5ddde21d6fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952151, "uuid": "08ad004d-a8e5-49c5-81f0-4a701cebe513", "comment": "Malware payload (RedLineStealer)", "value": "a025fe6d00e4793226f2b63ec2bf735685816e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666952151, "uuid": "b535f027-c924-4d9c-8406-5bdfead8b04a", "comment": "Malware payload (RedLineStealer)", "value": "6b2b92009af853d67f297a86731d87c39eb8c5897122e5956efb4e3f675fe2c7253cbb4513d8aa0f0fc77af6f07a16f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952151, "uuid": "105abc9a-2b11-4450-a84c-4dd39efdb689", "value": "T1DE456B29FB0725B4DA275371895FEA7B9B147A148032EE7FFF8BDA08B4330123845665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952151, "uuid": "b9cab642-c29e-406a-aec4-e1fd3a8cbc4b", "value": "f9dd8a0feaf4fa9fd20d4d8ea4827100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952151, "uuid": "e081a633-5b57-4154-b9d7-425f5361441c", "value": "24576:phBxVaYJY1ghfEMr9WYRZhnIPOiZ72M/0Bwxj:7BxMLOlYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666952151, "uuid": "ea827e24-eebc-4604-a698-e6220c84bcea", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666952151, "uuid": "fa3f0728-2a41-465a-8339-5396ff4b7a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666952151, "uuid": "897637b6-c2f0-4d38-9847-cf68309d5e8b", "value": "47fea11d088bc58cd13a1859ef6d4d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2afc6a-56c1-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666962558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962558, "uuid": "42b4fdf9-ea79-4a98-92f2-928a539d0a50", "comment": "Malware payload (CoinMiner)", "value": "4e9e4073634ab0bd15bee51720ccc78f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962558, "uuid": "8041d865-6a56-4dc7-bade-6f4dab5d513e", "comment": "Malware payload (CoinMiner)", "value": "eaa3f3b508d7d067cebd6fe0cfd8f429c691535f2863343917d8d292e880505f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962558, "uuid": "ffa60c4f-33a2-4049-969d-41da8dc729a0", "comment": "Malware payload (CoinMiner)", "value": "6486dd373e3b712e20edc520e0e2398cecd32003", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666962558, "uuid": "4917aeb0-535e-4d98-b998-4d7403c0b6bb", "comment": "Malware payload (CoinMiner)", "value": "ee260c16302c82a04eb00a17df16fe83da4830b42bc4b306a9fae54d5af5f8fdc91860ec7e186d365ccd07705df6f19d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962558, "uuid": "a98592f6-4a38-492e-96ea-50d542b4aaec", "value": "T13844D0357A92C472C3851530446ADFA01ABFFC3229B1498737A02B6EAF71F91966731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962558, "uuid": "971f49a5-7cb2-499c-9d5a-779c301cbd8a", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962558, "uuid": "379b9fbe-f1ea-4d93-a878-6c588d9fb34c", "value": "6144:UiOHqLjLppiNJ69+lx3lCZqASL69Kb9GZx:UhHqzpgPisASLfGZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666962558, "uuid": "1c051973-3e7e-46d5-b8ec-1babca3a7457", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666962558, "uuid": "68c5d53f-89f3-409f-ac90-f2ef770dcf14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666962558, "uuid": "e70d9473-16ca-40b9-a877-ddd43ac8b5e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6aa812e-56e3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666977154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977154, "uuid": "4d88f9b0-95fb-43fc-b703-f0232f102074", "comment": "Malware payload (AgentTesla)", "value": "114c527d76cb90a18bfdde3a4474fb1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977154, "uuid": "6a831ed4-5d14-44d2-bfaf-638c97166bd7", "comment": "Malware payload (AgentTesla)", "value": "eb315f25a82f07dac9c40b3eac6db816a46ed3755f79d01a64c1681e148bee82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977154, "uuid": "dae2e169-9309-47fb-a070-11958c985066", "comment": "Malware payload (AgentTesla)", "value": "8f8d8105206bb7b64971732e9e59b1300fb1de44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666977154, "uuid": "c2abc551-748d-42be-99df-383231fd815f", "comment": "Malware payload (AgentTesla)", "value": "14c1269f825dae3ff9ec0cb35a4bb49ea5c4ee733d012195d2627835210fbf6f860236701a6b82492571f48cc1fea27f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977154, "uuid": "ab53a9e7-1683-49c9-b158-3b4461fb2b5c", "value": "T119644DA97AFA7999F1F796431E3BF8884B3F38D425209E0D46DC194C1AFE61040A57E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977154, "uuid": "97a29d24-cf0f-4fe4-bf2a-a35563bcd417", "value": "768:Ar1dsIKy3d5dwx385lSaPEfriF+uW821rG2:ACg9WkES2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666977154, "uuid": "acfd99f2-29f0-487d-8eb1-2a58e162b74d", "value": 327994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666977154, "uuid": "0512a393-b69a-4e4d-ba82-44e091cac323", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666977154, "uuid": "4e23ff17-28b9-4aeb-bfdd-8981bbe96a88", "value": "documentos DHL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f63128-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994604, "uuid": "13184394-bec2-4c94-99f6-45cd08141b5a", "comment": "Malware payload (Meterpreter)", "value": "d269ca499f52149626d2485bbf74ea35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994604, "uuid": "9f221711-34c2-4c82-ae6d-b59903fce4e5", "comment": "Malware payload (Meterpreter)", "value": "ebfbb6b523b8292ca9dcff470296f1c729ad0e8809a366a6e060478dfd4bea1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994604, "uuid": "dc7273ce-c75b-4e78-aed2-03aefb6d9723", "comment": "Malware payload (Meterpreter)", "value": "27b41e613776aef4dc9094c80ac0d78bf72602fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994604, "uuid": "e0d2df15-ae57-4601-aeab-2881ff331710", "comment": "Malware payload (Meterpreter)", "value": "621ef8d26e7d0442ccd2c74143c149513d18e5e1c411e95af07c973df380d83adac806e7fe6bb2e5e7abd18f6097b7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994604, "uuid": "940dddd2-7157-415f-9721-606abc317a39", "value": "T1AF73CF46DAC45077D196123D26763AB26870F5FA3302D5CA7A8CDDF9DBD18B0A2233C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994604, "uuid": "9f6fff19-dcb7-4f3b-909c-0bdd12186c76", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994604, "uuid": "401a6d69-00d0-4dae-a4d5-870a614ec432", "value": "1536:IjSsWeza/J5adfvDNjM4e7ahJUI9DNYtg8BGMb+KR0Nc8QsJq39:OSNb8fbFM/Gug8se0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994604, "uuid": "b1554c8f-7b6d-458e-80b8-67be9497f938", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994604, "uuid": "1a688d47-5fed-4acd-a426-5306a7ff7f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994604, "uuid": "bb902f90-b44d-46fc-b7f8-6dba8b20f2dc", "value": "buga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4661ffe-5695-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943622, "uuid": "fd3f9fa4-eb54-41ab-ab5a-cf277cf497ff", "comment": "Malware payload", "value": "1e4560f6bf7687bfb60cf652712df5e1", "object_relation": "md5", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943622, "uuid": "8eef79fe-e42a-47f9-97ed-6f5dc86c5357", "comment": "Malware payload", "value": "ec963919f66e042c3ba38b53f13a9dbe3ed17de9697b6568076204c05f394e1c", "object_relation": "sha256", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943622, "uuid": "754eaf3b-2653-4ce7-a7e7-e4f3fcfe50dd", "comment": "Malware payload", "value": "e2a45368e5db7b7e376a12a4003827b90eb2a559", "object_relation": "sha1", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943622, "uuid": "ba38a21a-388e-4b18-ac85-8aca5eace1f7", "comment": "Malware payload", "value": "725c9715aa4af76d5b3ff1f00becbd38d7c87314e6bcf9c2952ac29122a0e247c35503bca1bf2b4a74e9003387b03a8a", "object_relation": "sha3-384", "Tag": [ { "name": "pw unisoft", "colour": "#0B1833", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "unisoft-store", "colour": "#ADAE1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943622, "uuid": "253aaf39-a6e0-4ea9-9370-65a7672eaaf4", "value": "T1B517333558B750D02FE8941E1BD646B81A36FF4F1F9049C2072389776C78CAEBCA15BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943622, "uuid": "de2cef75-1401-4913-994a-69381d5be388", "value": "393216:FuG98wpKRWKMi69o5zfsRGk/1Rl2Yd6xMtWHgASJ0ZHtZuj+DNpfW9zI99:1988EOiBdfsv43MtWHRHPu0W9zIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943622, "uuid": "f38c45c0-fa5b-4a51-9244-ffdcf4861264", "value": 19724136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943622, "uuid": "2e9f6909-9291-475b-8ce1-47bd4b902d31", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943622, "uuid": "afd2bece-8f10-4b3b-8846-f11a1d114ad5", "value": "Adobe_Premiere_Pro_CRACK pw unisoft.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca78acde-56c6-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666964731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964731, "uuid": "f4b96424-c9b0-4f0c-b877-630753657114", "comment": "Malware payload (RedLineStealer)", "value": "ae1d34fef8efe214c82222ebbe69651b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964731, "uuid": "998d0f54-a75e-4867-b537-814d9d8337fd", "comment": "Malware payload (RedLineStealer)", "value": "ed57896c997e7bcfce0a5cd13d1107ee3ea4e1b2f8eb8183eaa7de85b7c70d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964731, "uuid": "acda3006-bd28-4090-98af-1b44c7dee1a7", "comment": "Malware payload (RedLineStealer)", "value": "6cde32b7080c7f655fe66c5b5fb178ccfd985225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964731, "uuid": "6fa30b33-29a8-4c01-a27a-46b98536b9d5", "comment": "Malware payload (RedLineStealer)", "value": "e91a72c3035badc6b01185a22b985375be7604b6ab87fa5fb81febb4159271d3db65193602a8c7f9926b77410b2e6ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964731, "uuid": "bd932eee-d035-47d3-8a0f-06553b5288ea", "value": "T10C44CF317992C072C4552634482BCFA01EBEBC311AB74AB733A4275EAE717D1667632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964731, "uuid": "631a7144-b0ef-41ec-a4cd-a6c5ce816324", "value": "55ce9fb6dc30e1e2bdf26439f9e36d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964731, "uuid": "aeb4740d-cd64-41bf-aa68-fd67c08d1cb2", "value": "3072:HXOTHLaL+gAx3TSG1mj5VI9HdXDyWRto0x4+ablErtV7d5PmLDedNaFGM/h3m:3YHOL+fTt1SIBdX/oi+irtV7d4ON4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666964731, "uuid": "fed361fd-2894-43dc-9e07-b93522efbf36", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666964731, "uuid": "69ece2c4-b44b-4d49-9a3d-05550122b95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964731, "uuid": "73e521c7-75e0-49e7-8678-93743ad1fbf6", "value": "ae1d34fef8efe214c82222ebbe69651b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3926ff20-5679-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666931416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931416, "uuid": "accb64b5-9c10-4ce8-a89d-a445eeffd24d", "comment": "Malware payload (Smoke Loader)", "value": "b835c3918d3c52db50763202e88c7282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931416, "uuid": "de1fa601-2ddd-4ce4-b154-ef675ab37caf", "comment": "Malware payload (Smoke Loader)", "value": "ed782198bcb26da1ab41a4df9fc476a3806cc4806bc4bb5c58514f76fb759436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931416, "uuid": "6e76aacc-507f-4a8e-bf39-e05774a279ce", "comment": "Malware payload (Smoke Loader)", "value": "b11cb56e449a6fd0ead0172d5a1d58107e1a0fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666931416, "uuid": "c621d044-75d6-495e-bb67-a7e3da17d5df", "comment": "Malware payload (Smoke Loader)", "value": "f7de7cfb3f8f33b41098a3c2168a8b6fff7e7f6e56891b192602025e5e491c179404d81104b8ad58d429ecc6c43a3b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931416, "uuid": "61170cf0-c1bd-4bb5-a2e6-94c9d4c8f003", "value": "T12544CF317592D871C0B11D30443ADFA02ABEEC3119644A8777A43B6E6EB13F1A57A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931416, "uuid": "1d0f1b15-e79d-41bc-a7a9-cd1b81e4e6af", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931416, "uuid": "3941fa88-26b5-4453-bbea-44af9764595b", "value": "3072:lm5XObHiWL06+AxpXfVGifmlk5Wk6pFItOXp8WQSlgaiwCp5o3M/h3gU7:kdgHZL06PXfsiuW640vlJiwOq3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666931416, "uuid": "af2e0db3-7170-4ce7-a791-6af783a015cb", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666931416, "uuid": "6d089b7d-9cf5-4df0-8d7b-9ea33a927328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666931416, "uuid": "100d456d-5611-418f-bffc-7e2ca95490a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e99f3a3-5666-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666923265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923265, "uuid": "bd758083-a9c3-49fe-888b-bf8eee57f452", "comment": "Malware payload (AgentTesla)", "value": "619db8493c664e054037deb6117ca140", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923265, "uuid": "75ef57fa-2625-4f96-97aa-46704fd69c62", "comment": "Malware payload (AgentTesla)", "value": "ee0c99e7ec4467b39f4096ff32d45abc0599a93549524704737e8670045ff6be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923265, "uuid": "7e4fdd2b-4efe-4dac-9e3e-3ce0124bf774", "comment": "Malware payload (AgentTesla)", "value": "ddc7a767c937689f506c4e870b9b0e86a7ffa425", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666923265, "uuid": "36b80548-8ec2-4627-945d-aaead4415f77", "comment": "Malware payload (AgentTesla)", "value": "0134c8c100551fed23de096b3bd18ed62b59c13c51c3e7c947ae5259ebf18516a045331ea06ed61341668c78b1be7803", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923265, "uuid": "4f1d611e-2d26-485d-b33e-13939bc408b5", "value": "T1E934F782E9006674EE68AB346A33CD3507127DBD6D78942C24E97D5B3FBFAD36026413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923265, "uuid": "fb26e260-db62-4b2c-a6c2-3b045a63127b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923265, "uuid": "99276aff-a7da-4939-90e7-2581f51989ed", "value": "6144:AE08tYL/Z8EWrdm4Vz0RpppppppppppppppppppppppppppppIV8:AnWrdm4Vz0Rpppppppppppppppppppp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666923265, "uuid": "5ecced01-553f-4dfe-b37c-e31c98481354", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666923265, "uuid": "c7d9148a-e932-4d3d-991d-dd2221affb9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666923265, "uuid": "b988201f-20f7-401a-8c80-56c4304473d7", "value": "SecuriteInfo.com.Gen.Variant.Lazy.257602.5908.32468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8e70cb-56f2-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1666983683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983683, "uuid": "c7937de2-6f91-47e4-b96e-8172a5ef4aab", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3dd10051662e6732e176b123e2db83c6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983683, "uuid": "46580f1a-fa21-48fb-af54-884de9efc5d1", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ee1e5fcaf442282176717ce59cc1993b6ec84317669ab6fa66633d9b5c8e172d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983683, "uuid": "17cd922e-cae9-4ba0-af94-48ca8d323303", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b3057c401514f186b9b455ab4d5e1983441ae259", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666983683, "uuid": "b90583ac-d51a-44b4-a283-f3b9b6965285", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3d1ab978e4269833989d905145e79545a14f2cec3612a6097c1bd50966fbf09899083eb8e38827645dd50480f5fbeda2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983683, "uuid": "68bec1f4-e956-41c6-9231-a62b12573668", "value": "T1B1923B22AB1C5613E269BE3FC0E7F85057F4FB835407CA0BB4912F492C0775AE6622C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983683, "uuid": "2dd280da-6410-4267-8b4c-e73f08ccd28a", "value": "384:1jWJewVA6gCgu7eLVIhYl/GcKW/GJ6LW4/sOCiWTlWc8:1jsVAkgqqyELBVCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666983683, "uuid": "ed260779-57bf-4d69-9c3e-72d29d450b8a", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666983683, "uuid": "aee708e9-5ac1-45a6-9797-41c6e28c6a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666983683, "uuid": "4aa3d262-c258-429b-a3ca-1aec8f18cdc0", "value": "3dd10051662e6732e176b123e2db83c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431dd9fe-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994569, "uuid": "f5c0f015-4e0b-4d28-9d7d-14683d5ef38c", "comment": "Malware payload (Meterpreter)", "value": "facb41b0215d5399bd97b68f05efe5aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994569, "uuid": "c1c5a6e7-a0d6-428b-af01-2348f7f61355", "comment": "Malware payload (Meterpreter)", "value": "ee87ffb45659e228e23bfc712fb84d5fc5ab33bb02614a2651ff3cd773b5dba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994569, "uuid": "20450b6f-c8a0-4c49-bdc4-989ea70b446a", "comment": "Malware payload (Meterpreter)", "value": "fc2d3d0ee139241db5083443d7a19261456682ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994569, "uuid": "e67306e9-80b8-4a1d-a8f9-ab4f129582ac", "comment": "Malware payload (Meterpreter)", "value": "e7d817200026bfb622433f0eb961d154d2748da9ccdf09c61dcd3667deb2e92fdab549268ab6f55415b413bcbed966d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994569, "uuid": "c35f0bce-822c-44a9-9e80-0c94d12a675b", "value": "T1B973BF42CAC40576D161127E27753BB96674E6BB3705C1AB3A8CCEE4DFC18B0A6363C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994569, "uuid": "ccbe8729-eebe-4a8d-995e-76ea61dd0fc3", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994569, "uuid": "76f089c7-a236-4776-bb46-7a5f4b792345", "value": "1536:ILNhM/ghKktYjOjKmxiHefyhxSv2Twtrh0Mb+KR0Nc8QsJq39:ahM6K1yKmf0xSv28trh0e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994569, "uuid": "d361e018-8d83-4113-b45f-d8a917596bd3", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994569, "uuid": "c1b8e961-f89b-4b43-bdab-ac26301ef46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994569, "uuid": "1cf58d7a-fbb0-4f5c-8854-cc2f5c4a60cc", "value": "dollar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e88890-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666949133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949133, "uuid": "d9dbe994-cb46-4b57-907f-302fc7f57d2d", "comment": "Malware payload (SnakeKeylogger)", "value": "2d80da5b6e7653060d1631ecac95f38f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949133, "uuid": "1ca39540-2b10-4687-a81f-bdfb15dd3529", "comment": "Malware payload (SnakeKeylogger)", "value": "ee9a1fcb9033c0591ba6a1ca56e953df661b1facb4103372aa82d69065dc1d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949133, "uuid": "26d48942-8870-41f9-b3c1-ef2ea18baa9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d87bea6952acef2898ba307c9edc83b97ffb842b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949133, "uuid": "0f02606c-e900-45bc-b236-5eab9de499ec", "comment": "Malware payload (SnakeKeylogger)", "value": "bbdcd613d6b8788fa74e81897d76a34fdb8b00ad647ebe0ae4e275fcade6a8d663b23926807ddf84500344a50b60afa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949133, "uuid": "615a124a-1b5c-474b-b968-7bb3ca06e927", "value": "T1B4A42246EE6582C6DC0A4DB5DC1194E46F4CF893FD8E8FAF660C204C58B9366D087AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949133, "uuid": "0d57a3a9-ca14-4b6a-9595-277161b1049c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949133, "uuid": "23eb70e5-93c6-4df5-9a75-0b53f0d5aa3e", "value": "12288:SI8+xczNZMkIBcNagF+/bB9iYb9thvZng4:fxczNuoNaHfvZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949133, "uuid": "fff57e52-0b18-4443-8de6-e7b4f49e2682", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949133, "uuid": "d7fb7a6c-73f3-4593-aee6-d71e80d5abd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949133, "uuid": "0619e5ce-55b2-4162-856c-b097c7ae3742", "value": "Product_Specification_A83984-TCF009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30e94b8-56a2-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666949203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949203, "uuid": "a5f2f581-e23b-425e-9466-1942c0e43053", "comment": "Malware payload (Loki)", "value": "3c460b0ccfb7c2aed06884776593d277", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949203, "uuid": "d2da8c3b-7531-4aeb-88f4-09a31ac09e06", "comment": "Malware payload (Loki)", "value": "ef44f5f5d5f4e0788abc40ff016c501b6130cb77b653cb1b813b0e1e0d31122b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949203, "uuid": "717cab92-f8e7-4924-8f96-2f775852893d", "comment": "Malware payload (Loki)", "value": "246ea8f2bd9cc3593557d5b1b60a414544491937", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666949203, "uuid": "71c984a1-b9e7-4e12-9fed-3dcbf760e930", "comment": "Malware payload (Loki)", "value": "3ca69f70b2543cb3b55e67381484ab9c4edf50e4ce396becc1bccb6c1fd3a09cda92aa6a22fbb6a9499b9b744db248c8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949203, "uuid": "ad8ec8d1-0eee-414d-b3bf-964b77ec030c", "value": "T17A4422ABB9E5B449F86DA3343603C189CA7ACCA43856030BCE1A718D7C7B9F195B5D0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949203, "uuid": "c75e95dd-738b-4473-a35a-de8a55860186", "value": "6144:0urBxQ4SJvcEjsx10SefbPBZxapd9/UD0hD5t+OGQ:3510SefbPjxa7+D0Xt+O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666949203, "uuid": "5a24da25-f396-4c36-ab0b-43ae70cf2de3", "value": 277864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666949203, "uuid": "a3ac2b84-d214-4e7b-8e98-6d245416ba5b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666949203, "uuid": "11528ea6-8dfc-464a-bfba-15ae9477f487", "value": "Invoicing_Guidelines.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe9ccc1-56fe-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666988551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988551, "uuid": "4fd44511-8e83-4129-904b-401a679dcc15", "comment": "Malware payload (RedLineStealer)", "value": "7764d60af970a9e6e4b7b176a14017fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988551, "uuid": "0b587090-a5e6-40e6-aae8-b25b14d1f82b", "comment": "Malware payload (RedLineStealer)", "value": "ef72a8ead2feee983f6d9b8acae54da2f11bb95e54b54b5e244a4a6e8f81f3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988551, "uuid": "f58ae194-ff34-40b4-a717-d125e33e225b", "comment": "Malware payload (RedLineStealer)", "value": "00c9cdd93f058fc964823b4a7a892009ce7ee906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988551, "uuid": "1f17cf3b-b18a-4279-a819-f834f2c0f250", "comment": "Malware payload (RedLineStealer)", "value": "b08f31e028b82826e6873d5abd7cced4fe0b53b6f8e2a4be69a4f34e3a3ae1b9cac2dc0171dc0d762027d405e8a729fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988551, "uuid": "8ce47140-c83e-44a7-b238-bb2439977821", "value": "T1E304E05D33902A2DC618217E18A352C83A31D83EA0BFE7ABD64D513EEE523E917537C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988551, "uuid": "0d78bb9f-7622-4a3a-8aab-4b74de1d2ba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988551, "uuid": "4cedcb34-848d-4225-8338-419fd428c585", "value": "3072:1gtE+wfXTb/1OObkV9VdFCVZOfm8EfkOaT6h0URvUCOM+9C6OHONgAyvpR5IYXVR:QwfDb97k3TxET66bvUU+9NOHONgAA9FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988551, "uuid": "77ab64ed-085b-474a-9fe3-f7e837466d11", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988551, "uuid": "59b569b0-944e-4774-acde-aabbb82595e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988551, "uuid": "d3fa9398-a8a9-4ba1-a749-3ce39c355bcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1de60a-565f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666920439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920439, "uuid": "607c52e6-bbc7-4265-86bc-85a33260d7c9", "comment": "Malware payload (Mirai)", "value": "7744b58aaec76ccb655589a98e46f6d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920439, "uuid": "6fed2586-3bd5-4cd6-8f40-ec95117a7a5b", "comment": "Malware payload (Mirai)", "value": "ef7a3d9931ac880161398792704e78b6db12e387651c4c52e04291b1a1c0a284", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920439, "uuid": "1337f970-52b7-4a41-a53e-b4365c33334f", "comment": "Malware payload (Mirai)", "value": "e29e0d174602a8b35d131507b7be4f5cca97c496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666920439, "uuid": "9990e4af-5d08-4a73-9ef2-f08e1fe45c0c", "comment": "Malware payload (Mirai)", "value": "145bc2465b1fbaa6c6e8df3c4222e9b683df765eefdbab438b112a9da50afa0cd9a118264ebac952be6120b4ed529041", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920439, "uuid": "ffd89889-3e40-4ee7-862e-98d9f0e619d2", "value": "T19393D805BB610FF7ECAFCC3749E9170625CC595A22A83B367534D868F64B24B19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920439, "uuid": "9061aaef-93ad-474b-84f8-7f81dad51bb3", "value": "1536:Hht1gKGNlIbn512m7yZODd70BN1Z/ZOLZYSF686rYclGI:B/gKGNlIbn/VR7M1Z/ILRj0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666920439, "uuid": "2427990e-0013-45b4-96cb-ff908586a99e", "value": 97160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666920439, "uuid": "2db14959-7e47-4b05-9abd-296ba0eb2951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666920439, "uuid": "31b396d7-6c28-4351-8679-783a6e773d63", "value": "7744b58aaec76ccb655589a98e46f6d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fd5661-56b9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666959063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959063, "uuid": "c99eb953-bb61-4316-8a25-a59c5f47c873", "comment": "Malware payload (RedLineStealer)", "value": "50ecc021725a928855df4975a1cd9f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959063, "uuid": "d99a78b2-756b-40f7-9d20-d9d4be282ddf", "comment": "Malware payload (RedLineStealer)", "value": "f017b2c37dc4d96b42279f41259212db2f369887b887cdb0045be333eca55cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959063, "uuid": "62373aa2-af9f-4af2-9229-d89622b444a0", "comment": "Malware payload (RedLineStealer)", "value": "b51e3001da018acc64eafdb54a78fb3f2c0977d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666959063, "uuid": "40e5aff6-5b5a-4eaa-9e4e-68d7ee6aa4a8", "comment": "Malware payload (RedLineStealer)", "value": "74981175391917ccdac247dd2374728d66f2225e000408f18de0ae2b90cad88cd4fd44cb0da9b69e8a1d1763e3596f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959063, "uuid": "10ab2be9-7b44-4462-b379-2dba137ac957", "value": "T1A075D6F0A5FA40A2F5479981247CBDE206B231B3ADDE0978532DBA04CFBFD58394594E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959063, "uuid": "af28eb13-ff7a-403d-8f62-e18d027c47f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959063, "uuid": "b0567868-cf9b-4de7-af18-d8820b2d7411", "value": "12288:rixQChYPYJ9GlF0bVMTrKdP1CBCRznWZQzjFeM6DJOjB9sTTHykb0kaY:RY6ziT3CBCRznYQb6VOgb0ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666959063, "uuid": "01fe9243-aec8-4ddd-b9dc-743990b5d209", "value": 1646080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666959063, "uuid": "76dd7920-dd6d-4e6d-b9f5-11417be5c271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666959063, "uuid": "317b15af-9710-4d56-bdfb-5d28b1e60059", "value": "50ecc021725a928855df4975a1cd9f2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d232ac6-56ea-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666979876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979876, "uuid": "d8800d8a-761b-4494-afff-446afd618a5d", "comment": "Malware payload", "value": "d81756881f148201a202dbd2ea23f503", "object_relation": "md5", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979876, "uuid": "2e1ef6bc-6db2-4988-bdb4-a18a9a75ee86", "comment": "Malware payload", "value": "f09e4483e9bcd6e057713575132d30ed602f41a1a9699d5124b2f28ba2c9a7b9", "object_relation": "sha256", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979876, "uuid": "23304fd5-2f2e-499f-9745-a853c35156c4", "comment": "Malware payload", "value": "053605a3fefcc58009ab5bbe5a428df6bad13d36", "object_relation": "sha1", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666979876, "uuid": "3e7b748e-3132-4ada-b4e5-e8576cd7a2f1", "comment": "Malware payload", "value": "6a2258cdaa4167066e65c54fb6211b569f3e7bbd8cdb395b556738d751c122df48a14aa09516dd5af1669c1eceb490a0", "object_relation": "sha3-384", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979876, "uuid": "9d9c9c6d-8f56-49d2-89a9-805807e3a931", "value": "T1AD74808D9DC942C9C47AF3808B360AD9A3AFD59B12163777B4AEF2702D16D65BF32401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979876, "uuid": "7b14c724-39ae-40cf-9af7-15f32a779ed5", "value": "3072:3Tn7XZZr/4QbHZui+k1w3VcOUWah1KuF5/b/FvBX25l9Qqsj+caU4RsYVfQ5N4/b:z9Mj7Vn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666979876, "uuid": "5cdfae8a-75bf-48eb-8c1a-405522a7f575", "value": 364743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666979876, "uuid": "856e7880-fc3a-447a-bdb1-d66946772378", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666979876, "uuid": "e0c9fb52-f91b-4ad2-a62f-82d00e4232d7", "value": "r6AN35Ns.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5680a2e6-56fd-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666988159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988159, "uuid": "fc92c570-a802-47d1-8013-d9bb7d65017e", "comment": "Malware payload (GCleaner)", "value": "cb0352bc0766ac6a91ce42191bb2d6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988159, "uuid": "fe8e64fe-f2d9-4eb5-878a-a49a4affe7ba", "comment": "Malware payload (GCleaner)", "value": "f18171a9ebbf7d2fe08a4c5b11443e5cb56aa8c0e573db02acee32b59ba006ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988159, "uuid": "403d8357-bcfe-4594-80ad-2077c295a232", "comment": "Malware payload (GCleaner)", "value": "8f9ed27f08b345dcf96d74b67327e224bde17772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988159, "uuid": "6cf0349c-d89b-4519-8eda-48bdf504e785", "comment": "Malware payload (GCleaner)", "value": "d50b087bee340070cfeda663f50896c15f6a0c2b8a8428b0069cc9d7cda97fae4cb21c10b55aecdc5ea396a3a069af9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988159, "uuid": "414ba2e1-7c6b-410a-b28a-e58a1457b421", "value": "T1CCC53304AF558872C02999F0397FEA7065E7371160B8745E9AFC80EC6EBBBC57439398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988159, "uuid": "f8db9488-afe3-4ff6-9965-59257905384c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988159, "uuid": "aca7b6a4-c50d-4843-9f45-c1a205d5cf8e", "value": "49152:Z2Oiy/jQqob0dsLq2wDRvABtoEiZFJy6lw7n/lSb2Vo4TLE3+Kr5wqVDA5hq:MOiso8Gq2g9AMEiZFJbk/Q+4HtVkDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988159, "uuid": "70a9dc7b-0f76-485a-a706-eba4ee6950ac", "value": 2587012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988159, "uuid": "5d0a5f29-0a4d-4918-8759-71ca860325fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988159, "uuid": "852bd5db-bb23-4ffe-8ee0-17feab362bc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5397d42d-5689-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1666938333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938333, "uuid": "f5fb598d-bde8-463c-9e58-bf8f78a84321", "comment": "Malware payload (Amadey)", "value": "b52001490f0e9e0a56233a781e6205b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938333, "uuid": "55d161dc-a352-4a9b-9b2f-0ac9ef1688d0", "comment": "Malware payload (Amadey)", "value": "f34834f430809c8ec23c41bafa584d0ea3a04b9a6889c7e706cd8c51a560f874", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938333, "uuid": "bc2e2f22-f9d3-4b4e-8397-34d280849613", "comment": "Malware payload (Amadey)", "value": "565cadaf0f888931e7adc5434235785bfc483d57", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938333, "uuid": "6b8e6d4d-efe7-4724-b8cc-edcd538eddde", "comment": "Malware payload (Amadey)", "value": "b0707f9944b082eacf9c6875bce2958c2dda1c7d2f30939f7ff7a4643a2333db0c51548aafcde94da69c7c5133564f2b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938333, "uuid": "0283fddb-065c-4229-a470-75823f1ead98", "value": "T1C064D032BA92C473C4451130882ADFE069BEEC3116554A8377A43BAEBE763C1B57635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938333, "uuid": "8f8cbf66-239a-42eb-aa78-d9ff5c068b75", "value": "7b61acf6f32731558508831ea4bb0cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938333, "uuid": "92e25301-a447-4d73-a99f-9f8a0ded6897", "value": "6144:vEHjiLoAgpjjQMkn0b+j4WLxTJka/QPst:vEH2cnp/+jNNd4Pst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938333, "uuid": "b5719329-245a-47a4-979b-a1fe647bdc1b", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938333, "uuid": "8a314195-608c-4ed6-be78-2e94ba62a9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938333, "uuid": "20153317-b442-448f-8e18-1fc4682fcbe3", "value": "b52001490f0e9e0a56233a781e6205b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74016f9-5693-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666942902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942902, "uuid": "6cc73364-a130-4da4-ba94-df695b31e387", "comment": "Malware payload (AsyncRAT)", "value": "6542d95ca8eddb2950d1b7c2c8594a61", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942902, "uuid": "ca2e6781-a693-4a54-b015-9a7bce1fcfe7", "comment": "Malware payload (AsyncRAT)", "value": "f39e259b9b6cecf2e81e59e1bf903bc5ac1cdbcbea95edd7a704184c0b2380f2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942902, "uuid": "59cfe52b-a193-4187-b34f-4534ec6a7c6d", "comment": "Malware payload (AsyncRAT)", "value": "3555d255258361593bdba941cd779d91ba933f92", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666942902, "uuid": "04b5a2f4-d25a-4bb7-92de-46760856fd20", "comment": "Malware payload (AsyncRAT)", "value": "7c8f40a53116efb60bd96f455d9dbd76c1be148e466d8cf1051724dd6d472a088722949c19f0a1bbd5ab0dd861e6df84", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942902, "uuid": "9edf9a29-b515-4673-b73b-2a30a6eb6bd9", "value": "T1E2425B7D732B0089931320FBE6B72F4B9224CD41EFE69180725447C23E8CF959951AEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942902, "uuid": "eaedd1bc-d745-46e6-adf0-8c6f080fc40c", "value": "192:pYdYgb9PHzgKlYrK1+WDBm8FDm8y7z3hjmIEE0z09Nr5jEaXHiii1HzTz:pYygeKarc+WVmaalxiNKrB13EHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666942902, "uuid": "c3753cf4-0b2e-4216-b5f9-0e1902ae2986", "value": 12085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666942902, "uuid": "c83003fe-0be2-41bc-ad9a-bf81abd9b47f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666942902, "uuid": "9a1a72b8-1156-40b7-9cbd-4b7eb3a190e2", "value": "gorilla55.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e5f1e0-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994512, "uuid": "00b0342b-6621-422e-b4df-9a4b2ec7fa4b", "comment": "Malware payload (Meterpreter)", "value": "2416d6cfb74b5277d570aa7ce4702bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994512, "uuid": "7151c9ec-426b-4794-92d2-937171ea9ae1", "comment": "Malware payload (Meterpreter)", "value": "f6247ed809d0122f769d27d2a31ab68c33772469df576db2689accb98cfa08f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994512, "uuid": "6343a6ad-2ffa-49e7-957c-a77de688444b", "comment": "Malware payload (Meterpreter)", "value": "80d501a15f871aaadd26b740892d68a7691c1af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994512, "uuid": "614c195e-6515-42f1-82d7-d59736832a41", "comment": "Malware payload (Meterpreter)", "value": "048fcee89a84d67d030b901c795f405c591ab3b38ba228c5337ce977c6e0682b9da4deb48fb0ec527fc046475ca377e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994512, "uuid": "a9e685f1-34c0-4767-ae39-c235e3056c94", "value": "T19973BF82D9C4047AC262123D27723AB4AEB5F1FB7615C1DA768CC9F4DBD18A0D16A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994512, "uuid": "d6dc792b-5275-47ac-b372-3a88ff64bee9", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994512, "uuid": "2a971234-e0ca-48fa-a417-fa6bb5ec6507", "value": "1536:IDxH/Ih2B9ZH+/cPDcZBEHe3xelwzFrl8S4Mb+KR0Nc8QsJq39:oxfIh2vdpwEHgVree0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994512, "uuid": "9c6ad731-dee3-422f-b668-5ca22e7578ee", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994512, "uuid": "7b7f8540-6168-4260-bc0d-37e3ad4b5a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994512, "uuid": "25ab677b-2b41-4eea-b13d-1e3d3e2b5f7b", "value": "yaya.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862747cd-56c5-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666964187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964187, "uuid": "0797b126-dfb3-4090-866e-9d4bc0994134", "comment": "Malware payload (RemcosRAT)", "value": "f7afc6233a1a8e0607449a7552748722", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964187, "uuid": "2efe09dd-6de7-425a-8737-d213ca17679f", "comment": "Malware payload (RemcosRAT)", "value": "fa167d133cb53da59f334ef6b12b264ef4e716a595084b6f922c4e447ea3def0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964187, "uuid": "58d2afce-a406-49b6-b1d2-b188eeb82a3e", "comment": "Malware payload (RemcosRAT)", "value": "2c448ddfddb4b1c0481698d5181b6295633e1777", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666964187, "uuid": "f1530fa8-762d-4aa3-80c8-90fc08600063", "comment": "Malware payload (RemcosRAT)", "value": "951ae6178434ba225f4c8faabfe82e75df28ea00ae5037acaf380c9766c570972793188aee04f17b86e24be4effb8d49", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964187, "uuid": "4811cf90-3da2-4c75-999b-5ecabbd32b12", "value": "T194F423C5C62956CEF62A39DBEB8A2C9F97762645F48C2D0ECC53541C820BBCC72A1785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964187, "uuid": "547ea431-5fe8-4804-be00-fccd2f9de112", "value": "12288:38TesV8h7Hsh1mYDQlH4Fg4c6E3/pJ+QBC81JdzBffAHmZ76WW+y6ATWDmDjiYj:3OEzsh1msQlH74YpMiC81rJbbATb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666964187, "uuid": "2539a7e7-8d09-4c0d-8992-4dab1fc7f375", "value": 760195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666964187, "uuid": "3d67a567-cdbc-4c06-9dbb-9dde6d8fd745", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666964187, "uuid": "f1bea03f-862d-4e70-878c-256a5a6088c7", "value": "Fully Singed Aggrement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b4b26a-5694-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666943173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943173, "uuid": "63fde875-637b-4d4b-9643-89cd4e90c368", "comment": "Malware payload", "value": "70f18597b95adbac28a8f149357312e9", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943173, "uuid": "f40739d0-98d8-49c3-b2f2-25ac2a37e7d5", "comment": "Malware payload", "value": "fa5a08ee2fd79521779237b398bbb67d0f779be3d21bb2976c4bb598f1a641e4", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943173, "uuid": "f8f34a9d-ae9b-44b7-8bad-7f6105fcc6a2", "comment": "Malware payload", "value": "cb98bab8ab312bd3523d47589a3e32aa14e9f628", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666943173, "uuid": "75549b6b-b5ab-4d68-aaaa-799c901c0d97", "comment": "Malware payload", "value": "bc6fced6772426a235f9ba7afbb1eb4690caf6ad8b8b0d74761849c7c70a5b3748d01b2f1fba1ebe39d12d85f7423723", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943173, "uuid": "ca1ec518-b42e-4bac-a17b-daa58cfa0284", "value": "T113516D9C38308886630C515559032302D276B4F1FFB226733BAD1A85EEDBF666BC01BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943173, "uuid": "b10e963b-0985-48d2-b563-7b8ec7767a3e", "value": "48:ZSlDDzXypVe6cuYSTx68TSrAR3qNGszoiP/ld2qSgDLrfPX99MNXtFEXJ+vm76mp:ZS9/bJS1FIyqwSBdHJHLX7oXkHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666943173, "uuid": "ae77b5d7-d81e-416e-8176-af8a303a0341", "value": 2885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666943173, "uuid": "e0e54657-8990-4bbb-adbb-ffbc88a176a2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666943173, "uuid": "3dcde1be-dd5e-484c-aca0-095d8f87c4da", "value": "Due Payments 23102022.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d0791d-56cb-11ed-9266-42010a9c0072", "comment": "Malware payload (PureCrypter)", "timestamp": 1666966735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966735, "uuid": "00254341-3fb5-469c-884f-d6931de6d1d0", "comment": "Malware payload (PureCrypter)", "value": "f04ddcdf2a8d4d222cd0ee50d2c0b0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966735, "uuid": "328a04c1-74ba-454d-91cf-c9c23accac41", "comment": "Malware payload (PureCrypter)", "value": "fb115350950c9683b5a35aaeae3cf4fb46fa1274e91ccec8eca4f381267c546b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966735, "uuid": "744fa8b9-cedd-4889-9334-76eed83c1222", "comment": "Malware payload (PureCrypter)", "value": "7760e4e65bd35737f33be596ba6b6d3a71714f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666966735, "uuid": "6bc8ac0d-27a2-48f3-b8b6-ff94872259a0", "comment": "Malware payload (PureCrypter)", "value": "db56193dff673417d8bf7504acdccfa393bd4fb75932bb4f16319c26ddbbe88d2c978b0f58ba3aa99937236a7a564f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966735, "uuid": "e25e421a-3e2d-45c8-994a-366373aa1c3c", "value": "T16804CA3C55296E8CF7A494BCB6758CFF27956D2F80BBB8F3D01CE4970AA93E15502260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966735, "uuid": "05444892-8dec-4255-8a48-6ff09f1fda7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966735, "uuid": "6ef9641e-3a70-4ac2-beb6-2584b6788204", "value": "768:3gBshcZrezLi5RXQH1C+m72VVoiEq0M79vVIpP6YaZhz3BnG0UC:QBshchePYX+8qVKiEKEehz3Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666966735, "uuid": "f4d4d2b2-f09c-4370-a65a-64751dd54a3f", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666966735, "uuid": "ed3b7c70-8fcd-4c27-a519-8650d1c49336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666966735, "uuid": "7db38abf-6bc7-4525-9062-c64a2dc0094b", "value": "Pago adelantado de la factura 230254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02914cdf-5699-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666945069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945069, "uuid": "1ecd03ce-fd35-4c74-960d-f69cafcdf43f", "comment": "Malware payload (Formbook)", "value": "ca3f9d838a7e53b679ef645dcb2eb15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945069, "uuid": "b2da989e-2b18-47ab-97d2-0ed45bcae9b4", "comment": "Malware payload (Formbook)", "value": "fb31038cbb2b0d3e01fb7f461a30ff7210a6f2062bd7d373afe739a701714108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945069, "uuid": "bcbb3337-516c-4678-9940-a0bbd7662f88", "comment": "Malware payload (Formbook)", "value": "bd5e7aec31fb0ed9eacbd8b4cc01ba753895b721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666945069, "uuid": "569f6397-3ff2-4def-a3b3-059f5ec1b6b7", "comment": "Malware payload (Formbook)", "value": "23a80e5bdb68ece24f09278cec143e485fd394d481edbd4d69926508e87a4dd8d0acf287da24433da4f827356be1c137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945069, "uuid": "b64dc468-8604-46e9-8646-6053d4fc612a", "value": "T1E4C42322A2679727CE6B43F02C974D54D3B56C06A9E2E5626DE773CE2972F000215EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945069, "uuid": "9f54063c-1ea0-4cdd-b74e-13ec19021bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945069, "uuid": "5188a0a0-4dec-4eeb-80f5-145a90aeef33", "value": "12288:mh702iNn2iNRN0C2CkZ+bGF13DfdlY7uYPShloJLj+:31B1yMkZIO1zfzY7TWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666945069, "uuid": "027dc864-5698-4110-99e6-270b70f4f1ca", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666945069, "uuid": "3e16b5a1-ef66-49de-97b5-b065a87df10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666945069, "uuid": "9ec33e2a-2b83-43bf-8c5e-bbc39a3ef966", "value": "euro order.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a33d5e-568a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666938932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938932, "uuid": "4c4e22c0-612d-43f2-a0b3-365eca12c9d3", "comment": "Malware payload (ArkeiStealer)", "value": "fb3efbe61287cf1804bb259a06b313cf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938932, "uuid": "b24c37e9-4dd5-4b70-83e9-507435a1b991", "comment": "Malware payload (ArkeiStealer)", "value": "fbe0ac69a936e372768529fcb8f8ee15e6dfb6527c06e7f3093a213c85a2f31b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938932, "uuid": "f1cd1d6d-a37d-4949-967c-3a7d4a998c2b", "comment": "Malware payload (ArkeiStealer)", "value": "42071a9f02ba45982068eb211d7cc23aa37ac500", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666938932, "uuid": "b1b52da1-f00e-4ffd-84ae-eaca32b36de9", "comment": "Malware payload (ArkeiStealer)", "value": "c1051b4d5290279cde10b6610ee0c19602cf2fb3e4c3494fc012d96c6e15b978889799b0a96bc420c3d516b0f5591c9f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938932, "uuid": "8335e46b-48d6-41ad-a618-1c20929adc8e", "value": "T1A644AEE17A81C87DC0451130482DDFE13ABEAC3119758E5737A43B6EAA713D1A6EE21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938932, "uuid": "c2ea4295-5517-4554-87fc-83675a30da13", "value": "a86e9b24927f8caf6c45f2593a2300fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938932, "uuid": "b94e69e6-cc92-43dc-9338-e1329f2ff558", "value": "3072:gEXOsqKqx/w8wX15Siv16N3NUuF4WruK2HDnBUIPH8RnRM/h31:TLq+DA9SuWWKHDBtPH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666938932, "uuid": "79a7f1ab-0d2b-418a-a1e6-e37cfb36375e", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666938932, "uuid": "a93da9d2-db70-440b-baa3-19dbd8ecccb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666938932, "uuid": "f286d735-12b4-4879-9710-90764d2d1fda", "value": "fb3efbe61287cf1804bb259a06b313cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff66d10-5659-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666917630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917630, "uuid": "020de2fd-9f20-40d9-8390-30d0b88a67c3", "comment": "Malware payload", "value": "8b496f405ee467b379e2e7fb4e3656b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917630, "uuid": "2ebe2714-6d4c-4b52-b404-8cc8aa326f48", "comment": "Malware payload", "value": "fc19c713c053dbd982fdcdc7b5fca0cfd354b6a1be210e29e250fd19ef58f9c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917630, "uuid": "d7030340-85db-416f-b2ff-2ab622b1cf91", "comment": "Malware payload", "value": "d6ddff12f847cff78738c19467be27a22c89afdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666917630, "uuid": "e004a2f2-d3be-49ce-a60a-0be09992ca06", "comment": "Malware payload", "value": "e1baa4d18cd26c99920b9094712993f43ebaf10f5fbbc4cf3441e62c4639af69a2b0fcd214bc584360086b8b42f9c843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917630, "uuid": "3ce6dd58-04d4-4b0c-aa6e-e8462cd37a57", "value": "T14776331233EBC9B6FBA4007209B0DF8696A8CB5489A1AC1313A89D2D537D3DF25355B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917630, "uuid": "e4a56880-ee94-4d92-b85c-00805cd076da", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917630, "uuid": "e0047d76-d12b-4944-ac78-f2eb03afba5a", "value": "196608:91OKF8OXFVFjzWiQk3qMdUTN6pV21b6uinwsGG0O95gz:3OKGOXF3/WiQk5eYVybttsWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666917630, "uuid": "49d7432a-ad0d-43e8-8035-6f04fc59c793", "value": 7598922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666917630, "uuid": "52101ca4-8d68-4ab0-8396-95fff2bc1aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666917630, "uuid": "9b559dc2-7742-418b-bdd9-2276aac2ff13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82dc17d-568d-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666940300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940300, "uuid": "6b8cdeea-2065-4db9-90ef-a3cc0eae85a3", "comment": "Malware payload (Formbook)", "value": "871b1fbbac9841518a2539727b81e410", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940300, "uuid": "7ce7d800-204e-4ce3-a45e-95d1a6b3239e", "comment": "Malware payload (Formbook)", "value": "fc6ac240d5a3a01a632cc91e5adbc9e1f0c78b0788f551adc828103157512b1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940300, "uuid": "a4200af9-5ae5-45b7-bd12-b07cfde1ccba", "comment": "Malware payload (Formbook)", "value": "771b7f1f47f887bc6f9f06135505f6e844f730d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666940300, "uuid": "b9971879-68ab-412f-9662-2419fbc646e9", "comment": "Malware payload (Formbook)", "value": "ab374b248c56c9466a465a8e16051b32ebae2ec09882a18db6665974fa9603d8dfb4ceee6365622ca6e2d7597717c4e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940300, "uuid": "510e88d8-08fd-4c2a-8347-e3be24c835e9", "value": "T1DF12D90093D44272DBB602BB3C774786CB76A7A76C478EE9748C511E7F2254197233E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940300, "uuid": "60dc591c-058a-44ed-8370-2937d196ecd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940300, "uuid": "17c10bc4-866c-460b-a51f-6e41f66d612d", "value": "96:7Wju+LniGNeLvJBq+SLmhlC9bNcDpwOo63WNtW1jYcFoNVcz1W4oKYMsLYUa:7wniGNeLvJYDLOHb18stYcFmVc03KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666940300, "uuid": "461fd993-9857-4714-aee9-d45dff0bdc33", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666940300, "uuid": "ae6d1230-cf6e-465f-8cf3-abed691d86aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666940300, "uuid": "f0983253-076f-4c32-b883-9c3b3b55b8b6", "value": "871b1fbbac9841518a2539727b81e410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47619db-567d-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666933422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933422, "uuid": "2d321d69-be36-4f7a-b19c-d1f681d2c0a6", "comment": "Malware payload (CoinMiner)", "value": "4ebc92ec935a33b183b036a28f0472e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933422, "uuid": "078eb9c3-1e99-42df-871e-0769423dd353", "comment": "Malware payload (CoinMiner)", "value": "fcb09eab7f82875bc55f976ff650e1c1a0ebe5bb71b4d6c9d6e1c6f37ec7b00d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933422, "uuid": "c53f11cd-6035-4f2b-b381-5a68e4919989", "comment": "Malware payload (CoinMiner)", "value": "a54c7e7046259ee6e500a00169f98340c5db1715", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666933422, "uuid": "b9791d7c-9a67-466d-b794-e171ffa978d8", "comment": "Malware payload (CoinMiner)", "value": "90c71a0c29beb70fe09e5366d0c6d061c64b8f4d1c3d31c062419203ab237816dfbc429bf847ea07cc5dfa18d2cb1e15", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933422, "uuid": "4d75328b-c6fd-4608-be46-c3ccafa808aa", "value": "T1D844CFF1B591D8BDC4852230842ACFA46A7EFC311825458737A43B5EAE71391A5FE32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933422, "uuid": "239bd5ae-6fd3-4d57-ab44-80f8eaf428fb", "value": "5152ddfb3332deb6fb4acc619da01e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933422, "uuid": "70fa9c87-18d9-4a5d-adc2-10db032195cb", "value": "6144:tMeHYLA7iUo7uOr4W4gPEDlqilqC0FK2j:tMeHYE+U0uy4ZgPED0ilqCV2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666933422, "uuid": "931e8937-b45b-465d-a237-7ae37ead70e5", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666933422, "uuid": "35741ec8-24b9-479a-ac7c-8f839f8a9bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666933422, "uuid": "b550d182-a50a-4c48-ad9a-e47cff63f841", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396fecd5-570c-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1666994553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994553, "uuid": "e4e05368-0519-4110-ab36-126927afc703", "comment": "Malware payload (Meterpreter)", "value": "e07965f2bf26b320383323f54e9f1977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994553, "uuid": "fb6aed9e-f1de-4f71-9d44-32ae89d3f463", "comment": "Malware payload (Meterpreter)", "value": "fcc78040ac014704f182f8ebe45b16e62415fe91fe342e83b30fec92e2ee8157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994553, "uuid": "9323ae6b-4c7d-4d54-af55-2cbac32b5b49", "comment": "Malware payload (Meterpreter)", "value": "638d3821a1eef776aa0e5f3cecc398cb1ac83dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666994553, "uuid": "41558d51-f4f1-414c-9e4f-3dd7964274d1", "comment": "Malware payload (Meterpreter)", "value": "de7245de99c5a1c5bab70cea42755ddc6bf51fdfc3cc67fa5d2e1adf057a9dccfc85da45e3e94427ed6697e169c8d29d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994553, "uuid": "f9682176-8f7c-4d2c-8af1-ebf9cdb9910e", "value": "T1C673AF42E9C00425D166127D23753AB6A9B5F5F63711C2DAB98CCDE9DBC0DF0623A3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994553, "uuid": "32026f4c-ed6f-4c6a-835d-677ace0fb174", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994553, "uuid": "6c6f998d-15c7-4bbe-beac-ee70238a91cd", "value": "1536:IXK1sPrbdt3BoyUCBeqjXJp1MnZ+7c1+ZAMb+KR0Nc8QsJq39:R1sPr/3WyUNiXJQZ5xe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666994553, "uuid": "78e51b01-b835-4d24-aa68-e300071095c1", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666994553, "uuid": "03a3452f-02fa-47b3-9e40-4650ab92691f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666994553, "uuid": "84b7a636-4694-446b-808a-2b73306863ae", "value": "maxi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7817f9-56fd-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666988090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "3cf9b6a9-bf7e-4669-b60c-9985984327ae", "comment": "Malware payload", "value": "604e101541598cf05a6b371b41f2b701", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "9715ab81-0f9e-4a8b-9e13-d2db4134d07b", "comment": "Malware payload", "value": "fe6cbbff3742044cf7604cd87556db780c6a69ec02a5acc0484673015f3ce115", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "ab51b83f-cda4-4b42-a808-fea1d8be946d", "comment": "Malware payload", "value": "a5b40c6aadfa27a60ad3a405f60877e835dab886", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666988090, "uuid": "57c00981-7d1e-4cc6-b0bd-4be86eb9167a", "comment": "Malware payload", "value": "81852e0e71352cca9efff52e461ad803ec8f80483c6aec28b137eafdc32d28bd8b53e58b7f21f04844f7db0451671154", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "9c6efc3d-df94-43e8-884c-cdfa3c403b85", "value": "T11975F065FE1AD4D6E4D477B5DCE31E587736C48E9708032387A8987AACD37189C8E883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "768fda10-b27d-4687-82c5-0f8851fcb503", "value": "24576:6XyV82+tsnuLQlPWswPBfEQ5owsVA2ehxFxwH+SNm2BwoX:hGtsnuQPWNVEY+VA2sxF/SbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666988090, "uuid": "f00e055a-8048-420b-bab0-04b54c394f9d", "value": 1639740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666988090, "uuid": "3a1d0e02-1474-4f2d-9ed2-a8f966c36f65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666988090, "uuid": "f4e9561a-c188-41e6-82fc-a8225236024e", "value": "VISUALIZACAO-DADOS9918959-07.2022.8.26.1605.3IZ5PNVLA7ZDFOQ2A697Q1ZBCGTSSR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1b582b-56a7-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666951343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951343, "uuid": "99b2b9be-2a18-4d03-83b7-80a21770ef16", "comment": "Malware payload (RedLineStealer)", "value": "1ca77db8bf323aaff2d807ae0883b15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951343, "uuid": "4bc479cb-8994-4114-a0fe-2e0e1b5b2f62", "comment": "Malware payload (RedLineStealer)", "value": "ff3f4e86a9e5650e067e2513908eddaf7be20d68aeb24ec8714fcab91a35a747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951343, "uuid": "3962b2ec-f7cf-44b7-a43a-72a345e78011", "comment": "Malware payload (RedLineStealer)", "value": "70a53a07fb17aeb4e558a44037d18eea6b611c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666951343, "uuid": "c805b92f-cdbb-4296-9dc5-0869b6632b4c", "comment": "Malware payload (RedLineStealer)", "value": "34430ef0096da5b989340a4e745a36c59d918f151509cdf49291fa80385cf438b07b24d6ff25e81678da2dcfe30c93d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951343, "uuid": "a8cad1b5-2d5d-4f07-a1ad-6ca2ce4c13dd", "value": "T18484F1313691C832C0825234442ACFE52EBFB87515764A5737E83AAE9F753D119BA32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951343, "uuid": "925207bc-ffba-481b-81f8-68fd4508d8db", "value": "0ba783a390ae174dbc5807c6f3d204ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951343, "uuid": "0a80056d-42a8-41c9-910a-1e48ce6107e0", "value": "6144:cC5HALwRVoqPrNGHS8uEbDKfBG99BHjgfkkRkpP7S13d0pOmGTp:cC5HA0PoWpGy8uTKHHMMZpPO134OmEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666951343, "uuid": "13d88d9a-7865-4bc0-aa68-485850293b4a", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666951343, "uuid": "7ff91334-0af7-4331-8bca-58330f5c78b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666951343, "uuid": "8e2305f4-6a19-402b-ad3c-de561850588a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ceb6875-570e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666995471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995471, "uuid": "87f1a8e3-29d0-468e-9bb3-e95cbce3173f", "comment": "Malware payload", "value": "f18e70cad17771781b755ba55846ec36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995471, "uuid": "a2163a07-1222-4db6-9d3f-e5f5206da7e8", "comment": "Malware payload", "value": "ffdf5023253f85c17296dbb3a31d959b54b67c6db569b4b0f3a69eeeca76e112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995471, "uuid": "6aac66d5-2a8f-424f-b58f-43c041685d63", "comment": "Malware payload", "value": "749ecb4b9a1f775003b9037f6ebee88df8cd2c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666995471, "uuid": "4cd53c6f-4bae-413e-997b-3a5711282daa", "comment": "Malware payload", "value": "2e72d1786562efffc450d107e585c912c846eb48872c8f4ecc45ab4302fba00fdfca07382c0033c07a36f048906dd75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995471, "uuid": "00bef034-aa46-491c-8d09-6691233a4850", "value": "T1AF15125AF623E9B8DA6D037928344C022F79D9127DCDD66C698237AE0837A03565FCC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995471, "uuid": "65c8462a-6490-442a-beba-b23a0634e178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995471, "uuid": "a52f8d9c-06f7-4036-961f-ab44148e56c8", "value": "12288:9Wh702iNp6Rdy4vnVNGEu9zLmqzjCFGwwExvOCmIh5/C8WQGJu9TRrDV530:11SdFVBCzjCFfJBrr/COKu9tnV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666995471, "uuid": "0227331b-4944-41f8-8d0b-cca149758f3c", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666995471, "uuid": "6fdd5b59-4c73-4c9f-9d7b-c9febbd3d83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666995471, "uuid": "d1267146-88b7-4cd4-a380-fd9b21b2aab3", "value": "BATCH MCC220601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }