{ "Event": { "published": true, "date": "2021-03-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-16", "timestamp": 1615939382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "370bdbac-9b5c-4d4d-bbeb-1763e166a588", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede48f2b-8616-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615871860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871860, "uuid": "323a1c2e-9095-463e-9131-b045c2b8f941", "comment": "Malware payload (Dridex)", "value": "50e5aeeeb79ff81c35c7d8d12348fa3a", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871860, "uuid": "9e4ba955-563d-4524-8997-ba4e89e4b082", "comment": "Malware payload (Dridex)", "value": "00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871860, "uuid": "62e7ff19-b57c-4dee-963b-e2076a6cd6b4", "comment": "Malware payload (Dridex)", "value": "ef838c9efd93217ce427d7975e61271b704abadd", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871860, "uuid": "6c80007c-e4ae-4c19-99d9-ae6f6bc140c3", "comment": "Malware payload (Dridex)", "value": "8b575e0a299344d8f1d46ddffe8999af542eca3416fbdc83768675b55b7d80b0eb2fb4873db9f1512fe96278314d5cfd", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871860, "uuid": "2ad5ce00-46ce-4857-b818-523fbd435f76", "value": "0915DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871860, "uuid": "b42d7c1e-3412-4f59-abbd-9a02930b9e9c", "value": "8ce5cf6636b690adc707814c2493aa70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871860, "uuid": "1fd13c83-6944-4652-bf5b-cec54c87a2b9", "value": "24576:FD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+FmzP:FD/SBiAOOjtW3o+MbLSkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615871860, "uuid": "897fca76-e7b5-4761-b2ea-e9aec7bd9862", "value": 880640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615871860, "uuid": "edb7c4c0-7255-4e5e-b07f-61145b700426", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871860, "uuid": "6cf47496-4125-46f3-8471-59274edf5bd2", "value": "00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e67d81-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615922391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922391, "uuid": "8f82b9af-5ddf-4f9d-9dc6-eb99e9fbe1cb", "comment": "Malware payload (RaccoonStealer)", "value": "5f5eea5e71c81700e0b2610712596b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922391, "uuid": "58ce62d9-7828-4522-ab37-e99091d2222f", "comment": "Malware payload (RaccoonStealer)", "value": "012d5c894ccd2bf291fef8f312c37efdcaae7375c2d65bfa8b9d55f43e4c072a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922391, "uuid": "eef84640-bc25-4b41-af10-8d1910b8a104", "comment": "Malware payload (RaccoonStealer)", "value": "c2342f1df9fc0050f733b461778f3d57ee111cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922391, "uuid": "1acc7927-94e9-474b-abb4-459e60dd4c3f", "comment": "Malware payload (RaccoonStealer)", "value": "e3facfcb842cc45a68341e81d54cc190098a458c84eb3ad0cdb70ee8d48676c51ead0987a17bd68845d060087ce954a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922391, "uuid": "74079cb6-8acc-4f10-89bc-42eacf866f23", "value": "6BA4F11032B6C437E1412232453AC3B5157AFCB15F6682C77B94AB68AE766D2CB3A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922391, "uuid": "5d10aa40-9c03-4dcc-94b6-c8366c4ca58a", "value": "0db5122541c535013699ed54854d9680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922391, "uuid": "b9dbc903-4ed0-48ed-84d1-5c869667e0fe", "value": "6144:Q/URHvZZncGgElHp6h+Y2YxFP1vSeFGZjyDSpg2ScM5ofYFIXiGjJR75:KgvlpWh+Ybl0FZ2mgxv5wCIXxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922391, "uuid": "c108f2e6-ecba-4831-ab22-b55bdf8bb06b", "value": 451072, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922391, "uuid": "22549742-2aba-4f50-ba46-6176c98a2bef", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922391, "uuid": "3c616c55-b7b9-477c-8dc5-1da274098d5e", "value": "5f5eea5e71c81700e0b2610712596b7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d79a13-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890209, "uuid": "692ab49b-febf-44a1-882c-1d0a98aa8437", "comment": "Malware payload (Formbook)", "value": "e0642f3998ebe6b49061724efd5a39c5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890209, "uuid": "362ac01a-a565-41fb-bdfa-acb61d87fe91", "comment": "Malware payload (Formbook)", "value": "01b8fb6a497c2aa6fdf11b28dd0bdcf1d027862d0de1088f8d3f310eceb721a9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890209, "uuid": "c060e141-85f9-4dad-a19c-9a82c059a994", "comment": "Malware payload (Formbook)", "value": "8ea06f77749f00bcc2b1184b9cf3ef97e35de3f5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890209, "uuid": "01bac917-413c-4c45-a98d-b4a6f1c27c8e", "comment": "Malware payload (Formbook)", "value": "7b50c9fe93f035250c77ad979aa53934f6202e3e24c07e0c23d80b9d8c6d18a08f4964ce87b22d4d41cdc80ac1ecf85f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890209, "uuid": "094c1979-6f8f-4ae5-bf79-129c0cbdb1ef", "value": "F905230BE65351DC4E2FC9673FE6D4AB002A9B8CCEE511A035036E2FA86D4525784FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890209, "uuid": "cca7e71e-47a2-4a1d-b1a7-35430a7a7dc9", "value": "24576:6xRQygAvzroBGXgBEidxkpNmW1i5E1R563vyXvuD:6NgLm63dxKmEb1RAmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890209, "uuid": "bb8e3cdb-fb3b-47b2-ae6f-cd28465acb23", "value": 801133, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890209, "uuid": "45ffafcd-fd8a-414f-8a3b-9bf9cb59c4a8", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890209, "uuid": "2bf54185-02fe-45c5-a059-041a666c0610", "value": "RDAW-180-47D.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ccf882-8686-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615919844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919844, "uuid": "d98418f8-43a6-4c1d-82b2-c6b94b4c4b87", "comment": "Malware payload (Dridex)", "value": "eadf301cc79d53a2f8b8b309d3894110", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919844, "uuid": "8170a31a-d2c3-48f3-a2a1-943f97d53445", "comment": "Malware payload (Dridex)", "value": "02cb5ad492c23a915b0232c37ef51028c183bc430973e9c630b7496b50fa200b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919844, "uuid": "43a035f7-1685-473f-9bb7-57855df834c8", "comment": "Malware payload (Dridex)", "value": "6ae211b1ad217cfc575c20963c105cc47ee9bb5f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919844, "uuid": "9e3e9a1c-33b3-4d49-b105-d64674478c29", "comment": "Malware payload (Dridex)", "value": "dbec0f460834253b1fe4330e58a4c93f74721273cb828c90ffdfb78148b36d704e202e43a6789200dd881baab5913b66", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919844, "uuid": "c8936651-efa4-47e9-b06b-499fd89d1147", "value": "C014BE2DD736EA9BF7F3DEF21420272A59676D61117B918D6AC224BF82BF90D006C14C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919844, "uuid": "6a71825e-0169-4a85-974a-3cf611245491", "value": "f51e8df6bd6c2af7857cce5930a68887", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919844, "uuid": "294a7286-f5fd-416c-970f-2a6c7468e575", "value": "3072:6f/CNh6hxzkBkRCnNo0zLv71FGYH9bTBoXRVBGLlgQPx:6f6ixID1FGYdvBoXBGLmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615919844, "uuid": "3e83ec6d-9cbf-40bf-a320-afec353d84a0", "value": 204800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615919844, "uuid": "08d9e0fe-ea13-452f-9bf1-d1679e85cf7e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919844, "uuid": "2478800d-d466-4c79-8293-625366d700c9", "value": "02cb5ad492c23a915b0232c37ef51028c183bc430973e9c630b7496b50fa200b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a4cff5-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615890100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890100, "uuid": "6787115e-2147-4a9e-aaa8-87199dc8e957", "comment": "Malware payload (SnakeKeylogger)", "value": "0e0a846d8287a3cd99782f49d20419fe", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890100, "uuid": "36b98244-32f0-41d2-bd54-752616c1db00", "comment": "Malware payload (SnakeKeylogger)", "value": "02cd534cf863894a7f2fc488ba077a5e95d31bdddea93de4019c7a9159ac1375", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890100, "uuid": "634e1c56-f4ff-493e-a8f3-8423623eaeef", "comment": "Malware payload (SnakeKeylogger)", "value": "f7d38903e776109509596f5ee7b27c8457f02a31", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890100, "uuid": "21a834f7-5066-401b-8df4-64117729a029", "comment": "Malware payload (SnakeKeylogger)", "value": "7f80267f16e91c31e4183ae51428c29144d3b861f72d48f740cfb77db86f428a2ce3b95c6c87eac51a03a8fffee2abf8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890100, "uuid": "3e3890f3-5982-47e8-b15c-b733ea3b4443", "value": "D3457C02F244AEB4F02B37B2447A833052FC6D4E8225D67D3E46765A45B63C215F7EBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890100, "uuid": "b4f786ac-554e-4276-b078-790b19678691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890100, "uuid": "9c193a84-4492-4bc2-bc24-3a21b65601f2", "value": "12288:sUggzKJu6n63GROqsvjRZgTPEonocf+iuGbRmjsSBJo5PNwH9Gq/Io5FLB1CSiyJ:sv63GROqiQnN+JGNqywdGeI0FLTCd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890100, "uuid": "a65c7840-1874-42ef-8a53-fb85f057da3d", "value": 1276416, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890100, "uuid": "eebd1868-0f6a-4a9c-89c6-cb70d51f9358", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890100, "uuid": "8ab4026f-9a00-45be-96dd-c014b2913efc", "value": "DHL_9073782912,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e026b1b-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918031, "uuid": "b03b3411-c8fe-4d2a-a79a-485f562e7b2f", "comment": "Malware payload", "value": "86f41dcb199a2e3a4480f18659073dba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918031, "uuid": "778fa962-dce0-4b3c-be3c-cda19b98bb92", "comment": "Malware payload", "value": "039602d199c8d5b283215ccc07934b8bc21ec2d9706baf7e33a504c12e29249c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918031, "uuid": "790b4a08-e130-422b-b60c-fb4617caaf38", "comment": "Malware payload", "value": "1e580d0aa011cb155807be3b88db0dd5ad241378", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918031, "uuid": "f2f09eeb-4c2a-4e92-a22c-3f041818e263", "comment": "Malware payload", "value": "f75dd35d9004890ea9bf562514f99f0cbeb6661d4a113cc4f6081a24a00e342231a7fac8f7f2b61458981529ed415119", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918031, "uuid": "936ccd4a-7434-4b86-ae7d-b074ca8f0e89", "value": "E7F37DA8E990CDD4CBCFC5D94A1D7A952023FAB9C6C36C964438F3F50B9267F4A16C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918031, "uuid": "95c79102-ecfb-4686-8264-b48d7ff32ec6", "value": "3072:Dv6qtQZts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8eL:Dv1QZts6vVGt/2l8nxpKJTJznhdDT+83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918031, "uuid": "f9fd80c6-954f-45eb-9b7b-05da2eb56dbe", "value": 167356, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918031, "uuid": "044264d7-aa1d-4a9b-b535-eb04dfb33ef7", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918031, "uuid": "b632d864-560f-4441-9bb5-3ff79a6593d1", "value": "2021 15 03 weekly Report.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e12a14-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615893863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893863, "uuid": "73d77f40-b93a-4197-805c-aaf571382177", "comment": "Malware payload (SnakeKeylogger)", "value": "dfcae653358a2e44073b06b4e32bae4c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893863, "uuid": "57853428-b386-4066-8b48-574c882d4662", "comment": "Malware payload (SnakeKeylogger)", "value": "04a0f9efe9c9cb9e0e26a94e8e7d7fd274e9fb9a068d350080246c098699dbe5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893863, "uuid": "3e2bf82e-b41b-4924-957f-5394f3989f97", "comment": "Malware payload (SnakeKeylogger)", "value": "017616fc9033c9ebd2e7718097ee25b048c2567c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893863, "uuid": "f4730ce5-34b8-4f73-8fb1-a6cf111d5035", "comment": "Malware payload (SnakeKeylogger)", "value": "d5403d4a839e1fc2acaa5dc7807b7269f3ffc20e872a31c674dc7b36ff7ec60713fcfe10697f5910772440d73aafd387", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893863, "uuid": "dbc10d64-c03a-4ce3-be3e-169eda6525fc", "value": "8E75941326F4FE14D27D7231DD37540986ECA1769338B468BD4A33868A6FA404F636EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893863, "uuid": "91530474-7b86-4070-b6f6-01c19b9f20c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893863, "uuid": "b1aff1ec-5efd-4b7b-b3e4-dcf9e4dbca35", "value": "24576:NxyBDA5exPYPStIVQ08otWEubyLXSb0fQZ4h4KBAKq:NgA5+yStsdREwprb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893863, "uuid": "e819aff9-14b4-4d08-9cbf-891a13315f11", "value": 1580032, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893863, "uuid": "a22a092e-5fe3-439b-acec-159a5ac0fda2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893863, "uuid": "4e686a54-aa38-4a7c-b4ff-941039270d34", "value": "Purchase order for attached items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c077b8-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615918098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918098, "uuid": "5f2a92b8-10d6-404a-8db4-3594eb4adac2", "comment": "Malware payload (Formbook)", "value": "52519faa91e5b515b0f04c8e320959b2", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918098, "uuid": "31d6158b-be24-4686-9810-fb3779679325", "comment": "Malware payload (Formbook)", "value": "04cdf60fe178b14b9adaadd5196d7ff10bcf40674ef46d4624f5ce50c21abbbe", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918098, "uuid": "dd6f4ead-3177-4575-a535-978ae7836092", "comment": "Malware payload (Formbook)", "value": "d1d857261c7038e8c5eba767e8b1d9343d692849", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918098, "uuid": "a42867a9-a0ec-47c3-8d89-1ce63357ab71", "comment": "Malware payload (Formbook)", "value": "d43b1d9af2a1d373d64bfc6e0024e5552687b15a727f7c9fe7a94c4b7241633e91ca32268982afeb2303efabeadc9bbf", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918098, "uuid": "c981cbf2-7c0a-452a-8323-de02b89f3d22", "value": "9EB4234372C54B63F1934E30C2697F5656A4CD69CA1BF10F9168FB5E4A38FC84BCAA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918098, "uuid": "789f67bc-038d-4ad8-9866-3f2e72f655bf", "value": "12288:/SmNz7jWRAbh2GaQSncH5nAC3l4egIzpB1qau1Oj:/f7jWyV2GG214egMDuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918098, "uuid": "f5ec3710-fd3d-42f0-a4e7-fe6c29065df8", "value": 516608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918098, "uuid": "c39ac820-7d83-40f9-9ad4-70e013b0e14f", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918098, "uuid": "8589ae3c-7611-48d3-a300-06d96cfd39db", "value": "co\u00cc pia de pagamento.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13414d1c-8622-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876647, "uuid": "264090af-6d37-48cd-a448-f1d95757a777", "comment": "Malware payload (Formbook)", "value": "98864c7012f43312b6b205c06f804a4d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876647, "uuid": "7524e237-267f-4c63-baec-61ea6eecf70c", "comment": "Malware payload (Formbook)", "value": "04e5b3fccfe7a2bce70605e5a7009117d717a1fbae3e38cbd4e1de64d790d0a0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876647, "uuid": "a8e9924e-3c07-4082-9e31-58e072e236c1", "comment": "Malware payload (Formbook)", "value": "10f690b3420298a16ddebb9e41067b29bd7bffc2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876647, "uuid": "f9e08282-0517-492a-8092-77fb1862fdea", "comment": "Malware payload (Formbook)", "value": "6c431f1a5d994b477b05230a7aa4cbeb24df44f1c84d301104424bd3e6fdacd1ff77c046c9dc9abbe4f3c42a9368d4f4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876647, "uuid": "f05aaa23-e2ff-460f-ab25-d9bfa881a142", "value": "FCB533B208851B2AE59FFBF9818EC86C5038DD250B1998F6331D7EB13239BB677E1145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876647, "uuid": "9d042e85-20dc-4077-87af-71913f1b569c", "value": "49152:vE1y8F/9winrFF9MDdq69uJOi6mWeKPNp5WkQaS8sMST6wu/mOi:v2h7AT9pi9Wrz5WkQqsMS27i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876647, "uuid": "c6891715-8127-4503-a837-464a8e3e3c10", "value": 2457600, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876647, "uuid": "6e002c87-35ee-4dcd-9bd1-0f93326be2dc", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876647, "uuid": "6101b4d4-298e-446e-9d09-5ba7156e4462", "value": "New Ord.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f235c240-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615922548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922548, "uuid": "cc7baf48-affc-4c5e-87cf-487ee1aba087", "comment": "Malware payload (Quakbot)", "value": "5bf7de25953fe78582260d73961ebb6d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922548, "uuid": "f8568b47-1306-42b2-895b-9c2f6f60a108", "comment": "Malware payload (Quakbot)", "value": "051426b74a1d78359c45aaadb8d283ea8e7535620049c4732ce5b70cf16a233e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922548, "uuid": "ab577841-8256-4e0e-af8c-e89073610582", "comment": "Malware payload (Quakbot)", "value": "df735e8e0b20ed76d5ded7e6431907ddfedc9613", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922548, "uuid": "f4749339-e625-4fe1-9e6c-aa873e6dce9e", "comment": "Malware payload (Quakbot)", "value": "7a1773930352a9d362f0cad014ae3610ff7ec2556ab8b66317cd1a2d804addac2d516279f17107e7559843666e135bf3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922548, "uuid": "98ca6851-9c93-4961-b8b1-0c1454d88511", "value": "3625A032F6E18437D5732A3DDE1B43A5982ABF413D38A8873BE41D4C4F3964179262A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922548, "uuid": "8958a851-37d9-4066-a29b-c87703db5ffe", "value": "04cb057c538d2320bd902abdfd49280f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922548, "uuid": "0e9aed38-d768-432b-912c-5df5d2b8ff74", "value": "24576:j2Pr19Y4JpqPcKwlhgaJmixA9mFbbLIk:j6tJpq7KJmyNIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922548, "uuid": "7241f69a-2009-4610-80f9-2928a6df9868", "value": 1045992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922548, "uuid": "a5d13d7f-2bd9-4486-ba4a-d896dbd3a9fd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922548, "uuid": "49a8c6cf-2d84-4f09-a2a1-6d38aa789029", "value": "5bf7de25953fe78582260d73961ebb6d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb01dc2-86a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615934194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934194, "uuid": "7e115224-8ee9-4a43-b211-2edd02b8f8c6", "comment": "Malware payload", "value": "5714c0df3ee0690df05c3cb0fa9b1439", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934194, "uuid": "4a9e3e89-c196-419c-aef5-f43aebb50ff8", "comment": "Malware payload", "value": "0533345eabfe77b6223db0e07d8de4d2ddf9b66bb8ddd62d87f0b1ae53503e6b", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934194, "uuid": "1f98f66b-3f3b-4c8a-9a35-c524b420a713", "comment": "Malware payload", "value": "ba63bb0054d742f781515f9f5dc6a8cd71a46b03", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934194, "uuid": "034e531a-2598-466b-9b3f-b20bac69e7bd", "comment": "Malware payload", "value": "5793549d8ec08c5df1f2a78cd559fb125183b44429aaeb5de3802b66f7c3c9cdf77d5f156cae5171b3d6da080c06e60b", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615934194, "uuid": "38b08edd-1493-46ae-9211-d873f086e261", "value": "0F83E18D96ADB10DF33344FDA424638AF78C30F51910A54DE5B2320F57B7ECA3A5A25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615934194, "uuid": "ce845fc4-5452-4d37-9fb6-0640d6305765", "value": "1536:n6PxV1Ag+4xoxZZGAeWOiY0pWhlMVGoIahaDHTU6hryF70/WGHIvp:nSxVeg+4hRibWh2sTU2yF70/W2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615934194, "uuid": "9f30cdfb-36ca-4008-9d8a-bde7d65f520c", "value": 81836, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615934194, "uuid": "f7bb424c-9208-420f-aa6f-1f6adcc73388", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615934194, "uuid": "45a3949f-b948-4fed-9337-a7526a9324fb", "value": "subscription_1615921758.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba920f26-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922025, "uuid": "87fdb912-5c02-409a-b090-7c1c518c031a", "comment": "Malware payload (AgentTesla)", "value": "1ce94be86cbff69ee30de1b9a4b82621", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922025, "uuid": "5b972df3-cff9-44d6-b134-da88538a8916", "comment": "Malware payload (AgentTesla)", "value": "06e0915f51d8623be912b10a59ee9f601874a0710116be2c749880339535ec56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922025, "uuid": "03cdf363-c91a-4fd0-a8bb-685146f6e548", "comment": "Malware payload (AgentTesla)", "value": "068deced43cb6817de7607a467375025c50df486", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922025, "uuid": "6dab03b3-5921-4192-886e-be7a4f713807", "comment": "Malware payload (AgentTesla)", "value": "eba41ea638cc3c5f64a56512280cc19b3f9dd8edc3ebf632160788f19013c0e1cea47993b944274cb469dc4485eaf19a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922025, "uuid": "fbcd1876-2684-4149-afb0-62e8b2df62e5", "value": "4674236AD6F68877E25746B429B7E6D1FF3D810821B3CF9397A13FB50D1019A428A703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922025, "uuid": "9b66c0f7-9e32-4c94-9526-12cf688a30fc", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922025, "uuid": "d6c70353-bcaf-43ae-ae1e-d5bc98f05a1a", "value": "6144:qTqjFTFOhcU4hcf2oQs/BxNKaWx+GCuzyCHRYq85pg49mz+:GKqL4Y2oH/BLKaA+GVHRYq85p2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922025, "uuid": "94571851-099a-41bd-8ff0-c983ed3e00d9", "value": 351441, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922025, "uuid": "240b2cab-6b42-4fdb-b41b-104ab32bddc1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922025, "uuid": "8f1a7eb1-01fa-41bc-997c-fdd768620c99", "value": "1ce94be86cbff69ee30de1b9a4b82621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaea6d2a-86b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615938749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938749, "uuid": "730c3f6d-b15e-4b11-882e-d98c3207d0b3", "comment": "Malware payload", "value": "7f776490eecbbc135416f17ce56e3936", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938749, "uuid": "d62b9ff9-c4bb-4f32-aa54-45a660a844b9", "comment": "Malware payload", "value": "07ac813802ee5aca4be94372bf75957c86845a877e2a80c7e674f87822199ea4", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938749, "uuid": "42ea2e6c-7844-4996-b3e5-79e51821dbe4", "comment": "Malware payload", "value": "0f668805fe0df18dc699715c843108ed4be828fd", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938749, "uuid": "99c1515c-773e-486b-af9c-85af29cdff07", "comment": "Malware payload", "value": "8bce614453971befc3d79f689a5ad97582e0b17672206517510d6adb0028c5128ecdf644ad2beccf5072e617c1d2d34d", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938749, "uuid": "e0b6ec72-140e-4216-b302-3bf4890f1e2d", "value": "58019E37F5E7D6114429C89FEC7E9F89E87001430F6955D1D0D084E78D4184A577C85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938749, "uuid": "a71f1c3c-b35a-4a1f-aaf6-83e1ef838b16", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZvgelhyc8brdvkPCEhXAmZJN:1IecuEZgNpYcYrdMPGoJvgelYcYrdMPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615938749, "uuid": "ed2d0c4e-a834-4051-a003-9daf3a415088", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615938749, "uuid": "3d1ed97a-4ed9-432d-b6f5-9bc4bcc5339b", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938749, "uuid": "64069811-1a40-42cf-92c0-9998193e5c08", "value": "detect2.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030117f4-861b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615873613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873613, "uuid": "f1bd7bb8-841d-41f1-bcf1-add28575bc99", "comment": "Malware payload", "value": "b9331085a13ece7ef497f93dcd2741d6", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873613, "uuid": "4d862fc8-9454-4f50-b2c8-2ff00f4a40f5", "comment": "Malware payload", "value": "07f7f5ac05c7d09206105d3827cdf09e69575f74a0337824ffb0c7fa19dbac0a", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873613, "uuid": "5e7d75d3-c8a6-4a5d-898b-f1e483848e43", "comment": "Malware payload", "value": "c8a844989501bf3e47266d4d5a5e083856bb0feb", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873613, "uuid": "2175d196-483a-46f2-88ef-10a72d4568e5", "comment": "Malware payload", "value": "91619f1a8af79f835b2dc4f79429eeeebe7b6b35872c9483d4f5cca3ccfb3120d0a14e1c9e4267c81e8df9d98a586181", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873613, "uuid": "02a5073f-5e77-4eee-b8a7-da6bd8d3501c", "value": "0863BE5EE624A439C372753DA30568E2194C20A7D583B61F16A47E087AEE2C35BDF27C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873613, "uuid": "d3382d5d-0e57-4846-a05f-4ed828eba383", "value": "1536:yItpepoK1z12mM0f6tmgH4AwU3gMWPf4URAMNqhZQ+K:yIkoeJTf6twPhZcQ+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615873613, "uuid": "096f5881-f35f-4aab-a6f8-50c8e8a9e844", "value": 69605, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615873613, "uuid": "4f802d20-b711-4580-a8d9-40346b139260", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873613, "uuid": "6a2fc0f1-18fc-453c-b042-c9ea807b820b", "value": "notif_2227.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e09c58b-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615893872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893872, "uuid": "7d25ed05-d439-4823-a7d1-e31136a611b4", "comment": "Malware payload (AgentTesla)", "value": "2579a681fd92fe8966d47a94ddc2964e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893872, "uuid": "2c015fd6-d0e3-4ca3-aaf0-a3977ccfb8c1", "comment": "Malware payload (AgentTesla)", "value": "0806da535a036ebb01724249ac4a14b6fd746f825ca744a759c20c0c287e028a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893872, "uuid": "3c5d6195-c79d-4928-9b0a-434d7fcdb1af", "comment": "Malware payload (AgentTesla)", "value": "889a3d069b9b8e00fd0fd3723deb906cd00b1de9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893872, "uuid": "5d69a436-0bf3-4e84-9fe9-4486a1f151a5", "comment": "Malware payload (AgentTesla)", "value": "75d36376bfebe7a2501707115342bc96fb2a6bc1ff10abf16e7a6168985e9d0596418ab087392330a28dcccea77e5b30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893872, "uuid": "df7f115c-e8e0-45dc-ada5-a491bd2122f5", "value": "AA45D42157C55DE7D27901B08225A41D96F8CAF3D23CCDA4BECE31972BA6A0507F3A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893872, "uuid": "d416b703-3b5e-4e62-973c-3b859bd12c8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893872, "uuid": "491096e9-84dd-4ad7-af3e-1c3a28ae8c03", "value": "24576:lkueth25pXR9MJ/Q9ztEPKTOnMWxfsXJbs7+2:V5B8J/QZeKSn7oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893872, "uuid": "d780cf23-cdaa-480d-a211-cc48c1b9ba8e", "value": 1207296, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893872, "uuid": "60f3ab21-e5f3-471b-a2e6-0b814a6923de", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893872, "uuid": "4185dc38-2f99-46a9-ae27-787a6b0e149b", "value": "QRN-CLJC-06738263842_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a17401-865d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615902073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902073, "uuid": "d87d9279-0528-47eb-88a9-1422d067671e", "comment": "Malware payload (Dridex)", "value": "25003af5ebe44b291c63a8dde0b65850", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902073, "uuid": "16c7a676-7355-4fcb-bdc3-a039ab8f9ce5", "comment": "Malware payload (Dridex)", "value": "0839cfa5201ef80fced13580da146cfe0c46d113d0a80135c8487d43f25aeb01", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902073, "uuid": "e4c787d2-b280-41c8-a4d5-1099727aa04b", "comment": "Malware payload (Dridex)", "value": "3cb173910db4a7d6d5d8d3d46cb55f009d640780", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902073, "uuid": "216276d9-a1d0-4c70-8434-c5c5eded2071", "comment": "Malware payload (Dridex)", "value": "682ebb1a03c979f05835a17fa3ea98d59b7c232f9008326d3dd43e28e96af389c2ddca8b53968d6238ed65615c30d804", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902073, "uuid": "3fc0e477-1a21-473c-9a56-e5582c07f887", "value": "7314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902073, "uuid": "77f1eb07-8f1d-43f8-9842-92513ab9d1ee", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902073, "uuid": "828427e0-a897-4bc0-b5a3-d95172c262ec", "value": "3072:x1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ji78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902073, "uuid": "e3480d82-9a8c-43de-bbc3-f4a601afc830", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902073, "uuid": "09bce15f-ef42-43ed-a4f4-d84227fbf37c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902073, "uuid": "8ab334a0-855f-49a1-9b58-74fda3c232bc", "value": "0839cfa5201ef80fced13580da146cfe0c46d113d0a80135c8487d43f25aeb01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ae56d0-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615893903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893903, "uuid": "c726b578-e27b-474a-8edf-11529e6d88f5", "comment": "Malware payload (AgentTesla)", "value": "e028ee00a459708098fdec4ce7c603f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893903, "uuid": "bdfbe6bd-fa9e-4bd3-9e65-c3be24a7f970", "comment": "Malware payload (AgentTesla)", "value": "08478b7204b635bd04478b96f192d8f47a0ebb4f1a1f0e8033e7ffaf26205ccd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893903, "uuid": "afef89de-582c-4e88-bd31-0f138176d2da", "comment": "Malware payload (AgentTesla)", "value": "721b93c82c9d499ead613c2d654ed90bd386aa5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893903, "uuid": "2370de8f-3d51-4cdb-9c1f-67d01898148d", "comment": "Malware payload (AgentTesla)", "value": "70acf7407b634ebf7f12fdcd072cf5ae3113afb775046da080ea3b99c3532c120bc75112bc36b384a585dab5e6fa020b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893903, "uuid": "4c8f550f-5061-46ae-bb06-3bf141b3866b", "value": "C5F36CA8E9D1CDD4CBCFC9D94A1D3A952023FAB9C6C36C964438F3F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893903, "uuid": "30e57810-5dad-4252-9219-d7591073336f", "value": "3072:cv6qodZts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8eW:cvwdZts6vVGt/2l8nxpKJTJznhdDT+8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893903, "uuid": "95edbd80-8f4b-43f3-98f8-5682de1c0431", "value": 167392, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893903, "uuid": "36e2c515-e440-4986-86d9-8cef6599019d", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893903, "uuid": "e5383d8e-5376-4a85-bf83-ba4a6583e3ce", "value": "INV-8746438954.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae833203-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615918139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918139, "uuid": "eb45f9f8-48d4-4cc6-a703-66b467bba50d", "comment": "Malware payload (AgentTesla)", "value": "a0c0ea05d74f6d60afcb15df5e85b7e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918139, "uuid": "c6afb9a8-10aa-42f5-9708-59e226815035", "comment": "Malware payload (AgentTesla)", "value": "096c51921844c8be9f54c2097be6435db1211fdd83d818bb04138a75bf6af434", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918139, "uuid": "07636117-4f64-46d3-befe-61acb5a8da9b", "comment": "Malware payload (AgentTesla)", "value": "a7d8c72148615dee3322a37ea6c4ad10c514e9f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918139, "uuid": "29c9994e-4341-4bd7-b258-b95c6e4f792c", "comment": "Malware payload (AgentTesla)", "value": "d7e090244d328c1d151a81751e4b1e66202d7c129438786a98c8e85c481737cd07d6866a7bdb4d65d4ece8ea760d238f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918139, "uuid": "8b2060f1-c2f2-44c6-b8ea-33d52e48a72c", "value": "AFA533F3B8D31F2ED23AE0F6C59FA27D6066CD237E808E40550E772165725319AB2A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918139, "uuid": "1614ac4a-7a5d-4617-9a2e-d8327f5945cc", "value": "49152:k7emgcnsq+RgMf3CvOE1Cpa5pU+wJcDiVqsPK5ZnNSxlLsD:k7eofMf3CmE1KVrxfsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918139, "uuid": "6d566eab-df20-4b99-be0e-0880174ae415", "value": 2107904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918139, "uuid": "1c7b6380-9987-45b2-9c99-7939d89a0bba", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918139, "uuid": "9aabd15f-5a2a-4d0f-b60e-413680d8414b", "value": "Amended PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5b7a11-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890975, "uuid": "42640bc6-a411-42bf-b9b8-ae249b53ff98", "comment": "Malware payload (Formbook)", "value": "fb68de8e93b31a66d1408ebefbb4b06f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890975, "uuid": "d016df5e-f798-4987-bb8a-b2d37ec970b0", "comment": "Malware payload (Formbook)", "value": "0b986f01a6797ebe5cc923fabfbbab16790fc5dbeccc8e7f393cc695bf4b45a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890975, "uuid": "6ebddd8e-8883-4689-a421-2136f3b02d73", "comment": "Malware payload (Formbook)", "value": "9bd239e5a867fe0b110fa731426ee0a02a2ccd08", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890975, "uuid": "ba91bacd-c438-4356-b4b5-e384840177ca", "comment": "Malware payload (Formbook)", "value": "a9482bf57950a080a191657c92e4999a352202f8362ff8954191b659cc054c546fdaaa75772a6d11b9ead63d959086b5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890975, "uuid": "8e58ae53-99cd-4c2a-af12-6e34ef878bcc", "value": "54B423BF0DDED74403B73B8E7846039D928FC2962399B12081396D9974A3F45827ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890975, "uuid": "e9cdceb0-db47-4cbb-85f2-2077ee67e16c", "value": "12288:S0/2zcuXvUe59oIWjSM1jbP+hIRjgeaGaLLgzXOsfLh+kv:S42IE6SM1jTcIRjg6YLgzebm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890975, "uuid": "e718afcc-5534-4534-be2c-dda3ad683bf3", "value": 527383, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890975, "uuid": "c93c9062-d2f4-44f8-84ee-37ee3ac53f42", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890975, "uuid": "f0dc8f80-6f7e-4cc4-8390-4b679fb45c40", "value": "New PO 100955.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8641189d-862e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615881994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881994, "uuid": "fffd5b0b-2cca-4bd7-beba-2df2df271c89", "comment": "Malware payload", "value": "445cf3ad389002cfcb54e07aa3113e2c", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881994, "uuid": "25e5effe-5af3-4ded-8383-a27a0c3a5def", "comment": "Malware payload", "value": "0bcfb0dbe6dda4d624a42608aadb0c060d4216686c968212e9d191fc881a2fc7", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881994, "uuid": "e38d6a25-bfea-4dd6-9d46-0af902885cf2", "comment": "Malware payload", "value": "e619a29897a41983bb8eb5521f314d172c7840f6", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881994, "uuid": "95b2a5c0-9402-470e-a1e8-46649d45485c", "comment": "Malware payload", "value": "76ddcc98fdc1f35ca77cd09ec39ee896ff69e21679fae4f90974de98ad26883bbe630c5d898a0719301b084415e0c6cf", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615881994, "uuid": "8a2116d7-0234-4cb6-abcf-2439c01b8929", "value": "9363E04EC27064B6C27A343DD31D94D20E4C616A9885F51D32E9BE04796BAD36BCF2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615881994, "uuid": "29799bb7-3584-4470-ac8b-86cd75eebda6", "value": "1536:2j5/nYpobwRMU0SoBijQolCTXyotXN7lDBZKGhmHPGFICT:+8oMmYoB/qCTFXdlDBZKGhIjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615881994, "uuid": "af7ecdfd-8a71-492d-8116-04f23f8dba35", "value": 70899, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615881994, "uuid": "6ab7b60c-2f4a-4469-9836-a35594c8f4d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615881994, "uuid": "593af68f-4788-4d49-bcee-5fd6d89df56d", "value": "dettagli_2188.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b001f49-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615893974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893974, "uuid": "1664fea9-5a65-4f46-b1ec-70ef362a17e7", "comment": "Malware payload (SnakeKeylogger)", "value": "549e187c006553e16fbd71e5cedf9b53", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893974, "uuid": "996a8a0e-c768-491b-ae91-9fe8c41e666b", "comment": "Malware payload (SnakeKeylogger)", "value": "0cdeb28072da8d297cf2df08b52a82f1a8e32071619d9c4cb092ac5bab673b99", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893974, "uuid": "d92c7bb0-87a6-494c-bb92-bb2467f90607", "comment": "Malware payload (SnakeKeylogger)", "value": "61afcdfd0768c42dcf913a3193e868b0d766fc65", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893974, "uuid": "0287d33f-b4a0-4833-8b70-b9e4502fcce7", "comment": "Malware payload (SnakeKeylogger)", "value": "3990807ed3bff9c08a7563739acb5e1abe3139703d30944fdee66857cc2a5fbf2e1fd6a0d3bb883d9fa161f7c776a081", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893974, "uuid": "47133494-6fe5-4f8b-9945-4879be62f1e1", "value": "A8A5931326F4FE14D27D7231DD37540986ECA1769338B468BD4E33868A6FA404F636AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893974, "uuid": "e221f2b1-c2a6-40e2-b329-c87de204d287", "value": "24576:+xyBDA5exPYPStIVQ08otWEubyLXSb0fQZ4h4KBAKq:+gA5+yStsdREwprb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893974, "uuid": "9499d735-f352-4b2f-b9bd-45e4842ebd7a", "value": 2162688, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893974, "uuid": "3665bb6e-6bf6-421f-b450-9583cb0e4b87", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893974, "uuid": "4712b982-c575-4537-8c90-ae3874d337a6", "value": "Purchase order for attached items.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60dcd90-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615884624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884624, "uuid": "68a38350-bf18-47de-b7a8-b5bba5e1e61d", "comment": "Malware payload (AgentTesla)", "value": "03db92f51cb961f5660096117a01f25a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884624, "uuid": "c2087dcb-4789-4f31-853a-93ff53ed6b58", "comment": "Malware payload (AgentTesla)", "value": "0d257370b86f60128f76f3607196e5187c627a3b6862b1e57ef5e4c974e77fba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884624, "uuid": "f51feab9-8474-4fc5-964f-dafd6dac5589", "comment": "Malware payload (AgentTesla)", "value": "9758932bfdbb5baaff37d42508cf9ad2390da0e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884624, "uuid": "a1667eef-3bee-4cea-9b62-f504b5befef6", "comment": "Malware payload (AgentTesla)", "value": "feb9ca2184d8096944138555350b0576c53f6d3a16e4ce7d346b726f460d12508999d9cdd75e272e506f69390cb770f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884624, "uuid": "bb63478e-5da7-4fed-8a46-a52a047119d1", "value": "50834BCEE94D88EBF02DF072C1E258621231977F15098B6745C946EBE916B6338C46EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884624, "uuid": "7fadeffb-8fd0-4ec2-89e6-9d1424a046a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884624, "uuid": "18c407e1-0b06-4e3b-a037-71cd74fc6022", "value": "1536:fySblkff1dOMBa0RobLPDL1ne63hS4NUZXlApDs3Byf6c8:fyk+H19xIDLFxtO3oSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884624, "uuid": "1f9be1f1-dfa9-4f90-9728-4da31def9dab", "value": 86528, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884624, "uuid": "7763f35a-a0e9-4cd5-8bd4-4ceb70b20c80", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884624, "uuid": "9bc93481-4858-46f2-90d4-e95eeba5e869", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.19789.1124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cbb564-85f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615857540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857540, "uuid": "96e71dc2-1232-4cea-bbd6-8f6db27fd86f", "comment": "Malware payload (Dridex)", "value": "daa5b36ee6a8b62ee53fdf0d0f9b0dae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857540, "uuid": "fe8b01d4-907a-4751-a505-021588996db3", "comment": "Malware payload (Dridex)", "value": "0d2c82c088fb9d3770bdba0d93276b1cc038d2cece6a72187d98184ac2c9e521", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857540, "uuid": "53e7fab9-f8c4-4fc9-840f-826a6d0418de", "comment": "Malware payload (Dridex)", "value": "977267ae19b06a8c03b28738f67efe62ec9550ed", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857540, "uuid": "293ea1f5-5b9a-4bd3-97c1-68f03b501040", "comment": "Malware payload (Dridex)", "value": "3ae57c17701b267c0cd1f631e616e1b53f54c0421431bebf4487d3d0cfb2912e51f0b5ea587d1f62c8865b380364d09a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857540, "uuid": "c251b9b5-af7a-4cc0-8324-0f567d8de218", "value": "B814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857540, "uuid": "2f749308-5a03-4872-879c-f7e6dd663de7", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857540, "uuid": "7d890c7b-c56a-4c67-9af3-2f6923cc71de", "value": "3072:71i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:5i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615857540, "uuid": "f8e0f1c6-3196-4af4-981f-efef428bb934", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615857540, "uuid": "9d5bd10b-c17f-4a53-9265-c4ed3f833af3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857540, "uuid": "f2c5639d-04e6-4fae-9931-cb3a073bac6d", "value": "0d2c82c088fb9d3770bdba0d93276b1cc038d2cece6a72187d98184ac2c9e521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e31392c-866e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615909388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615909388, "uuid": "c9abbf8b-aeed-46a3-8fcd-f5afb38d8eb6", "comment": "Malware payload (Dridex)", "value": "ed64d75995b5b1b79dd2cd1b55a86662", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615909388, "uuid": "fb6e66c1-4450-477a-8d18-7d92ed5c2ce5", "comment": "Malware payload (Dridex)", "value": "0dc5a851f4dcc9387854f6e856cc1e95ca1568fd9cc463506e1e84c6327c69ec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615909388, "uuid": "8d3f6fc0-76ac-4e51-bf32-79b71d6e4d93", "comment": "Malware payload (Dridex)", "value": "9573e40f1b7fddb7f55e24d0fefa5f4dab660d62", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615909388, "uuid": "fc6e638b-7fcd-4aec-9953-cef74e808862", "comment": "Malware payload (Dridex)", "value": "9e061c157fdb4d947bb69c61332f3b632426d7ba66518d7b8ec7898ff306e3a96784188cccc64ff5cb0e4061f9eadea0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615909388, "uuid": "6b88ba5f-210a-4910-b408-834f6062ed10", "value": "C414AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615909388, "uuid": "6de190ec-568a-4f64-9a4a-2fafb9e0dffe", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615909388, "uuid": "4153af18-7a17-430f-b596-49f4c7514dd2", "value": "3072:w1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615909388, "uuid": "9acb4a2a-85bb-47eb-9f13-ea2ee2dead34", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615909388, "uuid": "7c124c11-0836-437d-9ae9-bc5b54c7647a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615909388, "uuid": "b08e9c6e-638b-4f2b-a00b-8cfb6a7b58bd", "value": "0dc5a851f4dcc9387854f6e856cc1e95ca1568fd9cc463506e1e84c6327c69ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67911dc7-8661-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615903847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903847, "uuid": "fb3e019d-64ab-42f7-be54-2821a3b8b2cd", "comment": "Malware payload", "value": "666a92b2b444f1bab8d78954b9937a0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903847, "uuid": "36a0476c-c15f-4c07-b085-59220015c55d", "comment": "Malware payload", "value": "0e571b50f3341e1130907ecdd104f56c00a4579730032a6bffdec18868dffc79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903847, "uuid": "2da08b7e-fbea-4e75-b9c2-a67d1b8af13f", "comment": "Malware payload", "value": "93ba6e833a1d75eb92f80aa349d3fca8681d0cc2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903847, "uuid": "45455b75-09f1-4a77-afdd-24df98309d65", "comment": "Malware payload", "value": "869fc03f6d79b8ca451cf8d2f098e5e100c7c12fc018244e47b1063b49c363b9b41ad12395adfb9f870cfa796ac934d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903847, "uuid": "3fc9ee7e-c604-421f-87c4-7994b054559d", "value": "53F423D3D830439EA376DBF0A260A775356341026731034FF0687B6BEF78896D1696AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903847, "uuid": "1ec0f845-da5b-42b9-bf51-c4b712984b01", "value": "12288:BxcqIu9LH4Vohb7GpLiYtj6gXGUFm8pp0APSazkfYjXltZtLa0ByZ6pUGqIZpT9r:BBVLYVWGpGYJ6Ex08zvDPXb/QZ6BZpF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615903847, "uuid": "2fae8d03-6aa9-4fd3-b40e-680ad4d74e31", "value": 749913, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615903847, "uuid": "488d158c-eeec-4d88-ba71-0f38ddb1721f", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903847, "uuid": "2aff805f-85d3-4ec7-8946-35b27be067c3", "value": "yeni sipari\u015f pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a814ddb6-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867448, "uuid": "b88ba76e-8097-452a-9f0b-1268092f87d8", "comment": "Malware payload", "value": "2ba2c010f97c49190ff59eafa0f6feb9", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867448, "uuid": "cba642dd-85f8-467b-a72d-72d804c680fb", "comment": "Malware payload", "value": "0eefd5851768f828c70fd54ef74126458b80dd9f6d80a525fe82e378ae3a7c33", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867448, "uuid": "e80250cf-9e29-4a23-83af-0f11ef20cf58", "comment": "Malware payload", "value": "0642852fb201a55f584bc43e812d8c176b568fd5", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867448, "uuid": "a9ed5e6f-c202-4c37-b0d0-b56c5dd7b4d0", "comment": "Malware payload", "value": "fa06db74f42ca476b1b77df009979f7f109d2edf612f9c8d9e51577957015e56ebfb38d5e1e0d81c5bcc6897b59ab32f", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867448, "uuid": "667c5e5c-5dd7-4ed8-aece-a774eaf4cb98", "value": "7A5302E4795603CFCF133824992BB88F82016E8B1A65D9A7404C1D5D61B47DACE68B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867448, "uuid": "46bd2b84-3d47-4fbd-88f1-8d732895b182", "value": "1536:UxXIGBrLKo0marm9NLzLF16RHchrj3GYW5jVfLx:OYGlLKUarm9hF3hq5jVfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867448, "uuid": "ea8e75fa-9735-4f6c-bf46-b7252fcafcc6", "value": 64193, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867448, "uuid": "b8e8ca7c-4821-483f-bdd4-0edfc4a77b95", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867448, "uuid": "1238547a-b083-4ca9-9921-32b605d7320b", "value": "modalita_2856.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b6260a-85f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615858233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615858233, "uuid": "fcbbb8c4-6c0c-4354-85b2-a264f8a15f02", "comment": "Malware payload", "value": "0d17ee92baa9a09b516485834c5609ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615858233, "uuid": "5f2d38b1-5023-4f58-9c76-cca114bd583a", "comment": "Malware payload", "value": "0f6efa61fbf5e237abbbf6e3c352939a79bb787171c7aa99537700b2ab8e4ea5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615858233, "uuid": "31f55dce-559f-4004-a071-ff77457c3963", "comment": "Malware payload", "value": "48bb1d15cc2a214a99ebcd053f03dc28f3a730b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615858233, "uuid": "c9549b0b-5574-495f-840e-bb352e8853c5", "comment": "Malware payload", "value": "68f2de3215c946585d1934bc6981fda19982085a8d1ca127d4d59914eeb6437ebee9861bfc3c9258bb9865356de4f119", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615858233, "uuid": "57f9095b-0b49-4d6c-b451-de1d2f179cb2", "value": "D33512661688DA61E4BE87381871150417F5EE16E322FB8F7DE630DC0D72BD246ABB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615858233, "uuid": "29e0e738-93d9-499e-b387-55eb428da8b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615858233, "uuid": "86163626-fd48-4a6b-a0ee-58418242c538", "value": "24576:O258vb8yE289asYmnNSlpgt22dDE96wdnFXMX6tvsnhFf:h7199aFmM62+DSDF2nhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615858233, "uuid": "1431e5ae-c89f-46d1-a345-b8e83b058111", "value": 1135616, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615858233, "uuid": "1cac822b-3fe0-427f-a3dd-460b99c21619", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615858233, "uuid": "5ce4d0e4-5844-4c51-a692-eaa35294d08d", "value": "SMK_90638172405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975cf842-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1615918530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918530, "uuid": "cf4e95ef-f489-4011-a3a5-f7ed617464ca", "comment": "Malware payload (ArkeiStealer)", "value": "9f680e93d2050f97fc2cbc7d40c3eb5f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918530, "uuid": "818e399a-ffd0-465d-92b9-cb572863ae56", "comment": "Malware payload (ArkeiStealer)", "value": "1042014cc54a997f36926622c2b1bc3d9e3904598776e53d1fedc5bcf3528de1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918530, "uuid": "e04c5bd3-7537-48ef-93f7-689365f301c2", "comment": "Malware payload (ArkeiStealer)", "value": "a9dac5feb7dca9a1140daa695f2fc7528fbe13a0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918530, "uuid": "d2a724e8-5799-4edf-bc0d-6479e1fa031f", "comment": "Malware payload (ArkeiStealer)", "value": "f722ba103faeb3b9eed3f287e24c3cbfccb7add0ff148f1837ae93b6cdeae39e57d7fab10e69b0dec4e6c417e0d1e71e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918530, "uuid": "e9673528-8837-4eb0-933a-25e3b48735a2", "value": "E8E4E020F7A0C035F4F3057545B686B4A938BD715B3884CBA3C07A5B5A782EAEE71B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918530, "uuid": "52d00be8-742b-4073-9e07-043c6e9cd2a3", "value": "729cfbd9792913a5ac829cfac110b85c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918530, "uuid": "75e9e519-8b95-4b2b-8691-09c314e20131", "value": "12288:Gy+qorWF4+Xn76QXXaWBJ8otmBedyodCDcGJ+BgA8uhGVfmXPJo2zaCCUyJb1MMV:GyyWi86QaWTFI0AFDcGJGuMBRaJJMMMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918530, "uuid": "d4d3f600-2dce-4888-a330-49c5edfa81d3", "value": 657408, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918530, "uuid": "e8020802-42ba-4e75-a26b-28de14626aca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918530, "uuid": "b01f346a-687b-40d0-99ce-cfad9a04ccac", "value": "9f680e93d2050f97fc2cbc7d40c3eb5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be90fed5-869d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615929763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615929763, "uuid": "da68fdf3-56a5-44b9-8b2b-84b932a64be2", "comment": "Malware payload", "value": "b012d29ca6cbb9050eea371b6c2144ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615929763, "uuid": "c2a24812-f14a-4035-8476-761770d60266", "comment": "Malware payload", "value": "10e67edeba7e5ce6cfcc1d19f607cc5060b1a82becdc39a33109ef03a8dc8a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615929763, "uuid": "71b095d8-2bd6-4f17-a80e-004d363f2fbe", "comment": "Malware payload", "value": "90dc2b3b6cc7d64825a88a757a3b9e415f1ccdc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615929763, "uuid": "c6703dc3-11d2-438d-ac5f-4e6314cc751a", "comment": "Malware payload", "value": "031bba1f6c085be94c571165d32a1ab221250690d85fb9adb0eed7f675be2e45d8fb121fff8089fc5cd19fe60ea84ebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615929763, "uuid": "8168f4a4-7a25-4a81-a5e8-b286dcbe85a0", "value": "0DD2D011F157AB86D2BA0CF21CDE74990420AB0F2881B8D7BA7533324953F64636DBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615929763, "uuid": "c9426cad-1598-4409-81ac-bd77b7e4d026", "value": "768:0d78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMjdnbcuyD7Uryqx:K7RLHY+5tVbKH16KMpnouy8mqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615929763, "uuid": "c3608520-5afc-4595-a2f1-226ff10c6155", "value": 29624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615929763, "uuid": "2a052f75-39b6-4443-82c6-412cd87009d8", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615929763, "uuid": "b7405ba0-c2dc-4868-9c2c-2b29f1a99c96", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac9395d-867f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615916710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916710, "uuid": "ec23f796-59c6-4b16-a78b-e33fe406a36b", "comment": "Malware payload (RaccoonStealer)", "value": "8a6705f4e9e95c27fc3cec4bbe894dd3", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916710, "uuid": "d025db93-0eae-498d-aa7d-f5dca236ff6c", "comment": "Malware payload (RaccoonStealer)", "value": "10fb27aeb699fab2c1e2c4be638674d6fc421553ed87373d3d8483e8bdc29047", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916710, "uuid": "0e6e0aa9-81c6-42f3-9e66-54c426e43513", "comment": "Malware payload (RaccoonStealer)", "value": "67fd350d7bbec9870ad2ef825b2a47d0d83ca519", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916710, "uuid": "83367597-7d8c-4de2-bc00-0b6e6aa954b7", "comment": "Malware payload (RaccoonStealer)", "value": "ea797712399770174f9cb62b417c0d22cdab26b583c5cef74c500bee82ff2a52f051497eda722a3bc1ef3ae3400c21f0", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916710, "uuid": "2794d8bf-74db-4517-be3b-af7cb1429f8d", "value": "D9B4E01072D0C173D05274B585E9C7F49E7AB4725B666ACBBBC40EBD5F24BC0AA3132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916710, "uuid": "e2bbb9eb-380e-4caa-a9cc-2d5711532eb7", "value": "9b427574c93cbfa13fbdfd4a9927f632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916710, "uuid": "e2e9fc8f-276e-40a8-89d5-11bf627ecc4b", "value": "12288:PmB3LImjPIxFOjwngzsiNVQDbvQXbtyoHf2TiVYJ/FqdPH:PQLPqowggiNKDcxyoVi/8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615916710, "uuid": "49ecd15f-dbaf-4f35-b5b2-6866779e7bfe", "value": 527872, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615916710, "uuid": "fdc642d9-7c8e-4bfc-a584-9c695f52398f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916710, "uuid": "5b2ba8ac-e208-46e6-be6c-b12c57cebf6d", "value": "SecuriteInfo.com.W32.AIDetect.malware1.26466.22952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56882363-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615890074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890074, "uuid": "e742dc0e-dc96-4e7b-8d52-0a8627ca184e", "comment": "Malware payload (Gozi)", "value": "3bf99dcc390b95f58aacb51ba6c7d6ba", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890074, "uuid": "17110034-d511-4c55-b191-bd6c707fc493", "comment": "Malware payload (Gozi)", "value": "128674ced35bebfc9dd171633b6570b3c127d89af1ed01f86db8dfc6999450b0", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890074, "uuid": "a8847d42-573a-4179-a87e-fc14a2f81c85", "comment": "Malware payload (Gozi)", "value": "e2723623b20c621cd224b7696b6a80c46159b3e4", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890074, "uuid": "59d30420-90f7-491f-9de1-702b1903c662", "comment": "Malware payload (Gozi)", "value": "e1db9ca38b2be895fc193d0c2b132b72aaa09407648724dfccf542abb069bdde9dd5ca07e51fb1e3b2f08c8575609e7e", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890074, "uuid": "e854e394-d276-47ae-939b-1b9e434bbd96", "value": "06A4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890074, "uuid": "88dcf2c4-a2e8-47bc-b7cc-8a60f52cf385", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890074, "uuid": "fc686057-7dee-4d18-9817-6ca8c649db99", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZo0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEvCNdbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890074, "uuid": "4d7295a4-c8f6-4a9d-89d8-6fac2985f043", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890074, "uuid": "1ec028ea-b280-4587-8dca-e534381071dd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890074, "uuid": "44177bb7-ee01-4a83-98ca-f22a268645d6", "value": "6050865975077.rar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c078915-867f-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1615916712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916712, "uuid": "20b0882a-4c67-40b5-881a-373ef46faae0", "comment": "Malware payload (DanaBot)", "value": "68836f4363edf6dcf0203db3dcf5a6b2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916712, "uuid": "7a5c357b-c322-4d04-92ef-33dc854012f8", "comment": "Malware payload (DanaBot)", "value": "12aa781dbb20df22ed7d20b94a0c30d93ff44a875cee7c028cdccfa3eab9e57d", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916712, "uuid": "22432390-2f2a-4257-a858-a60f19ce6aad", "comment": "Malware payload (DanaBot)", "value": "f6ca169da771ab61d86ab43a3a3f76e9442944a2", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916712, "uuid": "73dd75cf-8592-4797-b66b-0e3a0b8081ab", "comment": "Malware payload (DanaBot)", "value": "327acbc70f710726152880e53819ff55140e19887b3b092361ce915d8f5cd65f6b2f5b750461c28b1614999b87c78e56", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916712, "uuid": "4763ddb1-aa36-414d-a11a-e1013de6959b", "value": "F5563381F0DAC3B7FB4187B24961C5234E747A6A427B8BDBB771776998722E00B19343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916712, "uuid": "ff77a0ff-5f66-4185-a24c-3afc406328e7", "value": "c9265d4610349b7ef3c0d24d29857cc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916712, "uuid": "d535affc-fb8c-4784-bdfa-3532b95c3357", "value": "98304:DGafthQ+CdjZv8VS7GGbWokX01iW3IfbZ/tbuUPQeaTNe6fRBmG0ZCHaLW7d7cj:yqqH8qSourW3IfBtHPQtTXBmdZCHGWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615916712, "uuid": "5c348d8b-5f8f-4e50-b026-c3d8e4b76be9", "value": 6150144, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615916712, "uuid": "f6e78dd0-4263-425b-a652-0430fd632bc0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916712, "uuid": "2127edfa-a7ba-45ee-8267-d081bb5c68fa", "value": "SecuriteInfo.com.Variant.Ulise.188141.29924.19379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ed7672-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922529, "uuid": "9bc04980-a4f8-4fbc-a121-dbb9e3e833ab", "comment": "Malware payload (AgentTesla)", "value": "f51bde692301062e32b59eb71505e141", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922529, "uuid": "ac79a85a-23f6-45b0-8b0e-b8dda5f0ea07", "comment": "Malware payload (AgentTesla)", "value": "12ba7ec686abc93ded62d6cf7df6907b348988897505efde9a4447b49ee92e74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922529, "uuid": "24697333-1f96-4d94-8e35-2444398ea727", "comment": "Malware payload (AgentTesla)", "value": "a4f70da62bb0b97a86aa39393b3844a8cf21bf16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922529, "uuid": "a5921668-9df3-4d83-86df-3c1ce3378c3d", "comment": "Malware payload (AgentTesla)", "value": "f81ae830b0cf1b921af1f1aaee621556dd52c7430f7e5b81f940f9525bfb1df6b697512aab034c32c6bb3eb2aef8d716", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922529, "uuid": "1d928ecd-bce8-45e4-b0d9-22d7408a8d4a", "value": "3305D0243EFE6019F0B3EF769EE475D6D9BFFA223702D45E1490138A4623A81DD9053A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922529, "uuid": "e7950eef-fb72-45e7-b7f6-b5828b6d84b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922529, "uuid": "498135a1-0392-4e85-a923-e86f9d15e85b", "value": "12288:LkLfEhboZe7Cecmqh0oQoEVQbqUnmZbln7wfWGOo/AVKdSNGEOVs4iLO:nhbyACBmk0oeVRlnEfW84QUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922529, "uuid": "9938a82e-52e5-42da-a4e7-2388b989b98e", "value": 809472, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922529, "uuid": "6a608e9d-47c7-4454-ac4e-3ad88bbbbb4e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922529, "uuid": "36cac806-570f-4dfd-b689-b0166f6f055f", "value": "f51bde692301062e32b59eb71505e141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1f40cf-8622-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615876909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876909, "uuid": "478ccccf-5aa3-45de-a7f5-f1e4626df618", "comment": "Malware payload", "value": "2b484732645be215cdd1e6df3e0b3658", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876909, "uuid": "5a241101-afde-496c-9e07-b4aa22072545", "comment": "Malware payload", "value": "146a181a98bd1db7904f2856847fd4b204fd0ee71e75e60552ad9c4baab02e38", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876909, "uuid": "579bb1c0-e621-487c-9b8a-e541f4fd8d59", "comment": "Malware payload", "value": "662c0e933c46bd7d5890d2d2242822d5cfb97085", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876909, "uuid": "b387ff61-1343-48d0-be81-7c4c0bba9182", "comment": "Malware payload", "value": "b02e8253a6e3601814fc08c46043e280ffd5041dab2e251a582b043faaed24910adc19e60d94e2db0cf367b21825998a", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876909, "uuid": "d31d2e79-4f10-4847-9e01-e6c375de86bc", "value": "F3939F0EA664A47AC375B43C93056CD1594C209BD982B12E16E47E482EFE1C36BDF5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876909, "uuid": "67c6d382-bd0b-4ed3-a024-3bf546369dde", "value": "1536:0lHOvZHED/cLUq3vV0f6tmgH4AZO8Eh8dhe58skJDcLy/8K/FR+jqEZQ+T8:/sBq/Of6tZO8k8dMJK9R+j5Q+T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876909, "uuid": "2bd0643b-4209-4478-ba6b-06be65598863", "value": 90624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876909, "uuid": "d88ea198-ca35-4ca4-9982-08469c70487e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876909, "uuid": "52157c52-a65b-4f2e-9e65-a5eb46964693", "value": "notif_2859.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c34bb9-8636-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615885313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885313, "uuid": "ec077134-df5a-4e29-a1fb-08bcd39876a3", "comment": "Malware payload", "value": "7f6e2a37e0a86f31c4e7fef8e3467ee6", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885313, "uuid": "4108d977-f842-4d02-acec-d3e64d6e40ea", "comment": "Malware payload", "value": "149e5cdf1caed21860a8b0ea4b43796ff835063520c4242fbf1b0fae5a801bc3", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885313, "uuid": "aaef3892-544f-4a47-b99f-55f6a6b0496a", "comment": "Malware payload", "value": "b7ae3b60a29c7f88310eb91383bb96a83f720c57", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885313, "uuid": "fb7fa088-9f7e-4990-acaf-b53f10f1a814", "comment": "Malware payload", "value": "8499bf9d2b05aad8d85f3be4ec68366415cd458b5af7b239bd485691e90c77619470f035aa52f8690b2c24419e0e2467", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885313, "uuid": "e23e7498-4548-4227-b8f9-a2a46b4ba702", "value": "4763E11D91205413C2B6E63B9B0929D62E0A252FD981B11F26B8FB042B7F1C75BDF1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885313, "uuid": "c998ee53-ae5b-47ed-8af5-fd0c84b2f788", "value": "1536:j8cgRLpgnnW7opaR0f6tmgH4AwU3gobvq0ZQ+3:wcMLOnWmf6twEvtQ+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615885313, "uuid": "9f176507-5a53-45f2-86a6-c5cc5fd1d07e", "value": 66876, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615885313, "uuid": "f4d2791b-5eef-4a18-9269-377bc0fa9c53", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885313, "uuid": "dd3fed56-e6a6-4603-9a21-e5f9b859b7ff", "value": "notif_1945.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614b646f-860f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615868617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868617, "uuid": "0f6f29b9-96b3-4981-a75b-3c31b2527f8d", "comment": "Malware payload (Dridex)", "value": "66883f8dead7a698233d70d9f1056b79", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868617, "uuid": "1521cb05-02a7-47ff-821b-73ad9d12e790", "comment": "Malware payload (Dridex)", "value": "1530f6c2b14f9d6b3d8bab9c5894c37fb44abe8fddc7923eb8b49be1bbc5175a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868617, "uuid": "ca263def-3193-4668-97e9-65f742ae804b", "comment": "Malware payload (Dridex)", "value": "7724a1afe069c71239a5a658942a0c5d78e36601", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868617, "uuid": "d9a25641-2cc2-4758-a80e-a766a2e9e1fd", "comment": "Malware payload (Dridex)", "value": "4fff0a7c4a692602c619bd1080ff924f6dbe91b61a601eadfc8b19d4fa24be00f87c586b31bc294506b96a56f38d22af", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868617, "uuid": "37f9462a-71ff-4ded-b511-73019b9c7379", "value": "CE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868617, "uuid": "7d974cb6-2180-451b-814d-aa117bd404ca", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868617, "uuid": "c28a6c8d-b7a6-42b6-bd36-43f923f84e6a", "value": "3072:H1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Vi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615868617, "uuid": "100a21a0-c65d-4501-8643-54eb257226b0", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615868617, "uuid": "8dbba564-a60f-411a-88c5-8ce882192af0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868617, "uuid": "3e70aae7-c210-442a-92e7-d2070051b1cd", "value": "1530f6c2b14f9d6b3d8bab9c5894c37fb44abe8fddc7923eb8b49be1bbc5175a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e900e97-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615923669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923669, "uuid": "106485af-cd55-417e-b631-595d1ac4d6cd", "comment": "Malware payload (Loki)", "value": "304b0b3842a34c03d723c0537c72a612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923669, "uuid": "effeb430-a474-4922-bef5-10d7bd282998", "comment": "Malware payload (Loki)", "value": "15ad32c1764affc4623170f6f766d26141fafac3485ba52d1067e341abc24b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923669, "uuid": "aed09cc7-9e40-44f6-a25e-a5dc839e2e49", "comment": "Malware payload (Loki)", "value": "46cba354fc03f9a9bfe7576383def776691a90a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923669, "uuid": "487f722a-4bd2-4453-99eb-47af20ff4ff3", "comment": "Malware payload (Loki)", "value": "19e47237db73eb5cc787222d997be52e67f8798c50be436ddea8dbcfe25dc9d8f6558c35b04d17f4219b3bfb1ef6471d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923669, "uuid": "05111d7d-d66f-416d-b167-7cb9f7efec09", "value": "2F45F75227846E28E27A43704436641ED6F5E2BBD73CC4BCBE9E368B1F66B414173623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923669, "uuid": "8fd6c9d3-f826-4d9b-88c2-a2067407cd5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923669, "uuid": "06f1d533-0f24-4ad3-b751-6b2894eca7cd", "value": "24576:L8y2yByE59lDlBrOoGqh9X6hy0ThilsAm:L8yoE5hBaolt8y0TklsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923669, "uuid": "d06a6007-6fc7-4f2a-8d39-13b51be4b89d", "value": 1195008, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923669, "uuid": "687313c7-abcb-4803-9133-5a87e0169e4f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923669, "uuid": "58d34e6f-d79e-43f9-b1b9-231f58710ac6", "value": "304b0b3842a34c03d723c0537c72a612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dde730-86a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615931632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615931632, "uuid": "45b3ca26-03b6-460b-b79c-338886e65cac", "comment": "Malware payload", "value": "0f398a3925eaa48847582fe8b60974b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615931632, "uuid": "8eaf3495-7748-4aed-85b9-c42abd65eb1a", "comment": "Malware payload", "value": "15d629f1ec8a6ad58b13dc5e4b9a1b893b82389acce53f6bbaece76a98a0e07f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615931632, "uuid": "555b2381-903d-4119-b21c-4c832269e4c4", "comment": "Malware payload", "value": "79d8373c73579abfeb9b6b17032f9ee5e8a84613", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615931632, "uuid": "8a9685fb-b4e7-4e47-85ae-bc7c1baa7453", "comment": "Malware payload", "value": "0207c7a9bf01cb588a1c110e34ffe682e4302d038b55e0b01d7242463fae16671a9d6cd6db796ab329a9f1a11b35efe2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615931632, "uuid": "e28c3637-92c9-4274-aadb-40eed4c78713", "value": "2914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615931632, "uuid": "253417d4-eb1a-4ae5-91fa-a4b4f66c8bc7", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615931632, "uuid": "29605682-96fb-441f-96bc-0edac9d85e48", "value": "3072:Q1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Mi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615931632, "uuid": "59125b95-ea3c-4630-8230-932b1efdcd25", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615931632, "uuid": "dd23ad9e-0c18-4c7a-a30b-c0f186b5fcee", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615931632, "uuid": "ea4a9cb7-460d-4a6f-bf98-e8f523587263", "value": "15d629f1ec8a6ad58b13dc5e4b9a1b893b82389acce53f6bbaece76a98a0e07f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551d18a5-86aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615935169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935169, "uuid": "0d5cce0b-62e0-4aa1-8e3d-e210bba0e72b", "comment": "Malware payload", "value": "abdf498691f2b028bae0fa4276edc04b", "object_relation": "md5", "Tag": [ { "name": "Clop", "colour": "#CCD9BB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935169, "uuid": "fd48bfe8-25d1-45d9-96d2-7e0c565c7f09", "comment": "Malware payload", "value": "15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649", "object_relation": "sha256", "Tag": [ { "name": "Clop", "colour": "#CCD9BB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935169, "uuid": "24c6c3c9-1f8b-41c9-8ac9-85ed0787fd29", "comment": "Malware payload", "value": "fb81951ebcd5cb111633bf4b6f78a18c522f37b9", "object_relation": "sha1", "Tag": [ { "name": "Clop", "colour": "#CCD9BB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935169, "uuid": "353ee683-aedc-4db0-af97-1df671c1f9a8", "comment": "Malware payload", "value": "777e0c370389ca15755f2f7a285f72d874352f4f2eaf36aecd77ab920d4291dc3911709b0bd49b31af6a740fa726ab1d", "object_relation": "sha3-384", "Tag": [ { "name": "Clop", "colour": "#CCD9BB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935169, "uuid": "951f16be-c4c7-420c-9415-84cc3a367f9b", "value": "6734D658F6F0F6B2F85105FE2A60DB7984266D305E7C00A27ED3676E9C204F19C79A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935169, "uuid": "aac72c27-02d0-4164-b7d6-8132d01f8a8a", "value": "50c2be0c7d9189886914438170ef3af7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935169, "uuid": "3ccc1327-8de0-4990-9813-e83cbd8597ab", "value": "3072:sJMMvli3RbBMCa9juwoxEEaEBhuVkywCl+zvrpAHm+CQZFKKKImBNCsSfoNyYs21:siyli31NaR2xBr19WsSgNyu9HGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615935169, "uuid": "45e71bfc-73e9-45d7-9519-f5b59045a998", "value": 231424, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615935169, "uuid": "30593e30-cf9d-4ef3-8bba-8ffa500e4663", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935169, "uuid": "3031482d-d967-4b6f-bbb5-ed90305bcca1", "value": "15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1858df82-8646-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615892117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892117, "uuid": "af13cffa-b6e3-46ab-be96-931461b2b4f9", "comment": "Malware payload (Formbook)", "value": "e4647cc71d27837d5cb8a9a0b0707dab", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892117, "uuid": "5d29d9ce-3873-478b-a458-c6d386b5d9d0", "comment": "Malware payload (Formbook)", "value": "161464a54fb29e8c1f46bd11a514f26c10edccc258af5a38a1e6ae10db859ac7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892117, "uuid": "79c38854-11b6-4e32-ab00-b02e4b2f02a3", "comment": "Malware payload (Formbook)", "value": "ede99aef7adfd735631449f576085371efb393a3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892117, "uuid": "84102e2b-8a4b-4eab-8155-e11d0cc4671c", "comment": "Malware payload (Formbook)", "value": "549059e130800b7a1a29b245e5317f46a3c1c7cc350faf5263e97f256b7d9fad145049b2c1d78f98b75b1b3dc3bda1c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892117, "uuid": "573e203c-99d9-4a4b-9f69-6dbfc670d652", "value": "37A401223688D456E3C672B40F5EDA76A375AD9CAD11416323F43F6F3BFC013462A266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892117, "uuid": "28aebc0f-3c92-4549-a194-f1572976e924", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892117, "uuid": "583d09eb-25fa-41a2-8f79-146efa4617ed", "value": "6144:QTqjFhWfTXx1ETE+woZQ7zjUs+RhLxj2mbxAH/ryuuy:IKW7B1cE6kjUTRhFS0Mr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615892117, "uuid": "24811c13-7275-4d55-bc3b-b52884dc1261", "value": 460430, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615892117, "uuid": "a98a42fc-7f84-42fd-a690-9db196e4826c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892117, "uuid": "5f2d377b-0d85-499f-9ee5-efafb518c755", "value": "SecuriteInfo.com.W32.AIDetect.malware1.4968.10712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba31734-864e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615895774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895774, "uuid": "26b7e673-fc57-4b5e-ad99-d78c90aa33ef", "comment": "Malware payload (Formbook)", "value": "ed38ba72c5f741c3364c7a21d19a8625", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895774, "uuid": "89759ad8-8493-4b77-80b5-d3d5520eb412", "comment": "Malware payload (Formbook)", "value": "161cc9966bcb4457ca9f12429a13875d56f036853526bb6ba758470ca18b98fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895774, "uuid": "27c75ebc-cc68-44b1-9336-85820d6db25d", "comment": "Malware payload (Formbook)", "value": "4b88f8fcb3eb392f1c0fdde359e7e7add3019aec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895774, "uuid": "6409d82a-9283-4bb6-b003-6c8c38549aed", "comment": "Malware payload (Formbook)", "value": "70e01b37e5d2438cfd1bc99aabacc75b10926000a6abf706eb222db2b6d980ae1b18097654f18c8bb117ffb4cc27ada6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895774, "uuid": "7709529a-92e4-4111-a20c-aa11ca2f672b", "value": "6FC423282C2E02C236B84FD5CCF069A04C73B31E77837626A65DE641665D9EC7F0B5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895774, "uuid": "8e2a827d-668d-4e2e-a907-516a05aa0ad4", "value": "12288:vDrcVQTcA5bJar4nXA1zELDRfKf1zrhnSVgwgBh1GmwNqm:v/VcA5bJG4XAh+VgV1GYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615895774, "uuid": "9de84b21-b4d2-435d-9ab9-11ed54fe7b9c", "value": 552643, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615895774, "uuid": "062bce25-4308-4e21-b53a-1c42cca52825", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895774, "uuid": "1a5b51d0-a616-4c14-845c-ac084e0b0286", "value": "PAYMENT UPDATE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac3ee14-8679-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615914080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914080, "uuid": "93ca738d-6bb9-42df-956a-309f2413b7ad", "comment": "Malware payload (TrickBot)", "value": "a4dc92b904b2b4b31960bf84614dad78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914080, "uuid": "22152847-e02b-4afe-beee-14426ff51a38", "comment": "Malware payload (TrickBot)", "value": "162bfebce722e1d9d4a4b67762b58c2129d5f76db40d101f2a4ab1438a795bc5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914080, "uuid": "cb621b70-be03-4d6c-9253-fab7600c3942", "comment": "Malware payload (TrickBot)", "value": "9aba2ef9a890f1b2cd2be1257074002224459c6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914080, "uuid": "c886e775-f7e3-4dd6-88ac-ee1c78ea2a88", "comment": "Malware payload (TrickBot)", "value": "e5d57099e6ecde5e2e666f5bf2651f3e9d1882f111d92c49de4d8d52b0c140904e22858f3eaa93eaa7b4edc40bae68f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914080, "uuid": "503bdfca-cca6-4d8b-8f32-164ff4ad2582", "value": "F49422555A25C060E4B30BB40EF5E784CC7EEA042B16591BF71EBD08CE36AF0959E3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914080, "uuid": "2cbee85d-5902-49e7-ab65-11cf2d26e55e", "value": "73631ea08f5960294eeacc1cc3c8d03a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914080, "uuid": "d8ad43ac-7df9-4f69-9ca0-2a7da9d5b073", "value": "12288:ZBQ+hBancZ5k5F1cPIesC4z77VGLkujjV6Mm:ZBhracZKC4QLkujjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615914080, "uuid": "a044cef0-4819-4264-b3a9-bd53da0cf61e", "value": 443392, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615914080, "uuid": "a18f8fda-7a34-412a-a7c5-bdad6e07f33f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914080, "uuid": "d2028a67-726c-4652-b11a-5ba76f8b9d96", "value": "7.water", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7048f5-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890136, "uuid": "358fca38-e9b5-47af-bb53-58bdcba94700", "comment": "Malware payload (Formbook)", "value": "df9342d980b708938947ba664f29af6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890136, "uuid": "2dc3df3a-c9c9-4fd4-a9e5-7f8e2000f2b3", "comment": "Malware payload (Formbook)", "value": "17bb7657e5e89ebadc0d65b4dbb539c2ce5a9b3ea834db2da17ce427d5ef0670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890136, "uuid": "0f4b69c2-1710-47f9-9e58-d43b6b6878e3", "comment": "Malware payload (Formbook)", "value": "402009530de6759a7674bcebf670afb56f47f27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890136, "uuid": "f70686f8-1438-4392-b95f-5f779531fbbe", "comment": "Malware payload (Formbook)", "value": "fe59ec1534c111120f3cdff93b6168d774ad8b863253db4381cc657fa6a34517f494d1e62b9e9d25c358a67033befdbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890136, "uuid": "e0a406cf-1d1d-428b-9b27-3431331fcbab", "value": "D965D61126B56E2CE27943F354F56009D6F4AAB7933CC5BDBE7E328A0B76A410173722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890136, "uuid": "6d5b4421-bcfe-4275-9625-362b10cf195d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890136, "uuid": "247768f2-8fad-4d8d-bdf5-9079f969afcc", "value": "12288:1rgXOtIh0RToVG7CB7kqcFWyB/805p8hdMw5yJUJiSGLGcE9gdxOd/cwnr1l+lej:1EyBU052ZWL7JdOcyh+sPSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890136, "uuid": "34a1efd3-24ce-4d1f-8b64-114628a87d20", "value": 1548800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890136, "uuid": "96542be0-c351-4abd-8138-b014a7e67ee7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890136, "uuid": "a8982b6f-51c9-495e-a3d7-7d370463c5d2", "value": "Fujitsu Solutions - products list.excel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84d0fa0-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867475, "uuid": "a3cfd9aa-b6d4-49c3-b0c0-2f7d16d76329", "comment": "Malware payload", "value": "5d9b2037e7a7c0f0a12a344cc7418a2a", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867475, "uuid": "a0d00d10-82ea-4d9a-b982-28442be8b0ab", "comment": "Malware payload", "value": "17d6e5840bdf7fd9a447c70388afd98dfe95a6e4818954010fa1b9917f2d2a8e", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867475, "uuid": "5f4c133d-cd89-4a40-984a-82d70988be5c", "comment": "Malware payload", "value": "2e207c0a5b051817cbb6c3670f9b4ee300b0278b", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867475, "uuid": "ade4eea9-85b4-4771-a003-0edde3f41f4c", "comment": "Malware payload", "value": "5814bad5581e15513e0c1f366f9d1fff8d564f141718ab2f0d431001b2b1ff79e8df3b20fafb39676890e751f7bfeb9b", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867475, "uuid": "da11d311-dbf9-45e6-b98b-1481d8e2241d", "value": "A963BF4DA71435B9C33DB938475A5CE7494A3092A443B11E39E4BE09BAEA1C33BDE17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867475, "uuid": "60370a4f-7a28-4589-9c06-8a616dc81d78", "value": "1536:6arEGejxxclOPKCohYUpZZbQjRNe4rXi/8jW:6arz8xxsOWpZZwRoEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867475, "uuid": "d45bcbf5-345e-446a-a76b-1f6cd772264f", "value": 70148, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867475, "uuid": "53084eeb-fa48-4dff-8d63-62bb202763d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867475, "uuid": "f9078d55-2bbf-4fcd-b372-1c6950c07dd9", "value": "attiv_2417.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01981d92-8636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615885207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885207, "uuid": "31b9913f-db68-4561-928a-47ca2b5f4703", "comment": "Malware payload (Formbook)", "value": "0ff7ba695ea725b1c413c1519c28e487", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885207, "uuid": "15fd69c8-9c5d-488f-891b-e8816162a92f", "comment": "Malware payload (Formbook)", "value": "17ebdcf24d8df79094c29ae2a35b1697a257711eeedd4b58e51844b9b3732f83", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885207, "uuid": "4cd86930-17a4-4e05-b794-2d42ae3a171d", "comment": "Malware payload (Formbook)", "value": "3e6e5ea8516c4d1c064b9e86498ef14070f3e681", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885207, "uuid": "d4f708e4-384f-4e52-9853-d4a3d7659a89", "comment": "Malware payload (Formbook)", "value": "25414c98f013957fd4b87f3c52d64c3ae0581b1ad4a06f97e7d61ec5917e6f999618230a60ad07bc3807c30bca596c7f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885207, "uuid": "ff0c85f2-e03d-457e-a08f-240ff0d39983", "value": "35C4231C41FA2DBC62975593E1535FFD44D8B9B93A6F2E62E33A2A024FA1705CD8E042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885207, "uuid": "98042e6c-504a-4bda-912d-4e582897d799", "value": "12288:PyjBEffw1lfpq8jcD38lGRn1OETMxns2Y8hzFfStik1PrjbjYaBK:PyFEHwo803r16sZ8hzF6iwzpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615885207, "uuid": "0c47d9b4-83ca-4bb1-9b02-cf1047316c5c", "value": 584862, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615885207, "uuid": "48160587-648c-49b0-b3ca-60534871f4a4", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885207, "uuid": "4394f6ff-ae65-4fa4-8739-ccc24a58f439", "value": "Shipping Doc_Original BL, Invoice & Packing List.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52848e4-865c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615901937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901937, "uuid": "b7661487-34a5-45c2-9042-313327743d8b", "comment": "Malware payload (AgentTesla)", "value": "95b6e4fb43e1c9d223fe3404b1f5538f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901937, "uuid": "d3724d05-fbb1-4417-87ea-d8167f174d94", "comment": "Malware payload (AgentTesla)", "value": "1857e9e122dd752766c9092043606a957e4e9d56d3ea043b63053054285c1cb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901937, "uuid": "2124f40d-1993-4137-aee6-45b376dfbeb6", "comment": "Malware payload (AgentTesla)", "value": "68a585dacf8caee21c74db9e857648a38cec415a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901937, "uuid": "e9007b7d-8c58-4df0-8a29-cb0bf7a42e71", "comment": "Malware payload (AgentTesla)", "value": "c1e3184c138127618b7a1fd872c76993205bedea3766852a5c0dbf6855edc7e7901758c6c9b830e6269a5420d6ee90aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901937, "uuid": "e013e03e-6c16-4420-b051-381e687ba30f", "value": "20358C21E6A4AB70F03D73755432133083FDAD069626E6BD7D8831DA09B5AC582F7E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901937, "uuid": "f228f500-dbb1-418e-bd52-f6aef20f935f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901937, "uuid": "8e74618b-3600-4acd-a175-83e5ce387026", "value": "12288:he21eeyKmM6jz6oAqmp11rUA3SpcsGdb6dbyo6Mc5LHnQsgaOl3jd3G41:hemiM6jz6oAzjUYgcSqLwsmlzd3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615901937, "uuid": "16f06f5a-f664-47cb-8d32-1942defeb2c7", "value": 1072128, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615901937, "uuid": "001eaee8-642f-4173-9518-4b5ed1737737", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901937, "uuid": "df713a7c-ff21-4b9c-8ffa-3478f3f7a211", "value": "t0Rr36jZfd7CPSq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd95b81e-85ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615853740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853740, "uuid": "8f001d9a-0598-4f90-9d9d-1927d712e5e8", "comment": "Malware payload (Dridex)", "value": "fc48d82689ed18b7b89d4841c47375ca", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853740, "uuid": "6b92e109-5b97-4a80-980d-e07f524fedbf", "comment": "Malware payload (Dridex)", "value": "19cbdd6c23dbd6cabc92081a644521e9157a84d59e665e695d613f6569fe657d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853740, "uuid": "c786ddc5-637c-4c7b-a70b-f883891ef220", "comment": "Malware payload (Dridex)", "value": "459d260a20e93d57c4aef472d6b954d22c43c794", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853740, "uuid": "e15a3592-af51-48ff-86fb-be9e83649f41", "comment": "Malware payload (Dridex)", "value": "85b04a4522fa962edef9913d3fbdf25f58df2cc725a3a0929f9a09ab713ab86c7b7e41f540c1af0e2bd01c37f67bbbb2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853740, "uuid": "f2aa576f-650d-4e27-ba49-7db5dc60dfa6", "value": "2014BEDCD376F186FFD3CEF09519935656232D42861FE0A9A9C6A83F82BF90C045618E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853740, "uuid": "f7269965-a67e-4378-89da-4da663ab4860", "value": "554e238e1840919675ea2a74968f15ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853740, "uuid": "8ae49fd7-921f-4f9a-b835-257b1344e5a3", "value": "3072:NTcr3VWYFcXTNZEjmL18zM7cXzAMsT7bXsObx7UpYN4IO6KMZJpSx:NTMFWYYTNKjmLyg7ozALzXsONUhIl/Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615853740, "uuid": "2eb9853d-e0fe-41b5-877c-ca97a1bffeeb", "value": 196608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615853740, "uuid": "ca7e87a0-7573-47bc-8552-61bf81c08ed8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853740, "uuid": "54503c31-d1ba-4860-bb62-210babe8725c", "value": "19cbdd6c23dbd6cabc92081a644521e9157a84d59e665e695d613f6569fe657d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7b93dd-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615922083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922083, "uuid": "0c5a1801-b48c-49a1-97ec-5edeffd310fe", "comment": "Malware payload (Formbook)", "value": "f58c5379be474fc6f64828161083361d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922083, "uuid": "1f041b04-3fba-45ce-898e-ac9292d7824b", "comment": "Malware payload (Formbook)", "value": "1b1837b1504714c306a023b8488d15e81b939b6394ff511fb619fa38f264622a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922083, "uuid": "8121d801-2a6e-42bd-9805-4ad217db517d", "comment": "Malware payload (Formbook)", "value": "44a78609033c3e57f4358e3729917c7c41786717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922083, "uuid": "cfe7d67a-c01b-4111-8658-f3023d3c7fbb", "comment": "Malware payload (Formbook)", "value": "eaa06472475547d0677d1e0dfa61ea4662c2c8d5bab012898dafbca886b4e6788987df7b2575a7037550ce5cd2072810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922083, "uuid": "78361ba8-0980-465c-aeff-cbc32688ab4e", "value": "C8241236F6E1B4EBF663A6B1593A6B79F6B5C50111624B038FC82E6E2FD2447039C503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922083, "uuid": "1940d59c-6779-4983-a6e6-9fc5c369e8c8", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922083, "uuid": "a25605b3-6ebb-4898-8f75-a15b0d60b5d9", "value": "6144:KTqjFfdV0UoAWLrYS+rcBwL0aY06mRrEwyYMa:mGRoQS+JL0Y6mEva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922083, "uuid": "de859c7c-7c7f-4297-a39b-f83faa374b1f", "value": 216088, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922083, "uuid": "a8a595d1-e793-4bdd-96ec-25bcb2950f14", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922083, "uuid": "ada1e8a9-0544-4936-9d6d-9db415994813", "value": "f58c5379be474fc6f64828161083361d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8aea36-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615922511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922511, "uuid": "a93ce7d9-ec45-4650-b52a-c4a383ec6a98", "comment": "Malware payload (RemcosRAT)", "value": "a1127592f60b591ab5a36184253b6692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922511, "uuid": "154791f4-9e76-4d9b-840b-bda942ffbe7e", "comment": "Malware payload (RemcosRAT)", "value": "1b2e5587a5c7c8b8894207790718cc7f29d6e8ed3e1a30eea8a79b5516a6f5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922511, "uuid": "b858edfe-49f4-4f06-9e80-dcab9e3a5f4f", "comment": "Malware payload (RemcosRAT)", "value": "4d0ccbcb5513a928f33f7e0aa3ff10eebf38861e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922511, "uuid": "876a6b90-4d7e-474a-bb24-5b8556076737", "comment": "Malware payload (RemcosRAT)", "value": "546a9b3a1598dd6dd67c48c3f1a39f2978ac373bda11bbc0e6e0cff20429602a7a6806887a9a8de649bb785ce9d6f67f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922511, "uuid": "3037b884-878a-4fc8-8cd2-afc371b85962", "value": "3DE34A03B2015CBCD5493570011EEAB63662ECB185909F6375A8FE2BE8BD1D12EE5F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922511, "uuid": "921a3991-e909-461c-8ca6-2c26391d59f8", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922511, "uuid": "071c5347-4fd6-4731-ae00-0de319002a1f", "value": "3072:UzXSW6fdM81H1nYa55yWQgrBt18ca8Hh1uPHODVvQ:M6VDxYuQgrBt18ca8Hh1uPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922511, "uuid": "d52cfba4-23eb-4e7b-9d24-8a21fecac280", "value": 151552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922511, "uuid": "f9756fe7-c721-4dcb-b13a-4dc80e04dd25", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922511, "uuid": "9aaa9591-18e1-42c0-855b-619755c86eb3", "value": "a1127592f60b591ab5a36184253b6692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270f93ef-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615923495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923495, "uuid": "e430a29a-f59a-45b2-be95-87a12e110a5f", "comment": "Malware payload (Formbook)", "value": "93cfec5cf154db98118e0feecc88ed82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923495, "uuid": "474124ed-4f6d-4c5a-a8c1-2f6c9f2a7d50", "comment": "Malware payload (Formbook)", "value": "1b46fa95d686b11522fb3e6cc14e75eace625fd54416aa41be9dc4be51e90568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923495, "uuid": "70fd115c-8d36-4752-a2e3-8420d734de60", "comment": "Malware payload (Formbook)", "value": "3e41153f5616557df29a2409a2f75e1b530ad148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923495, "uuid": "13b01df6-d111-4b15-a1f4-e8dade34fb8d", "comment": "Malware payload (Formbook)", "value": "49f5e92d5997ea49b26d0b950101e4d0ede88240680fb46c0c7e7516d50e5cf3df635d3e2413866b0cec3ca078c0de0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923495, "uuid": "13dcd301-aad7-4b99-b0f3-ecade95ba47f", "value": "5D256A22E694AB70F03D73760432133043FDAD0A9626E6BD7D8971DA49B56C185F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923495, "uuid": "a2ab61f7-2183-485e-bcae-1e5932aed051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923495, "uuid": "1b91606b-b78d-4b9e-b423-2162025d69a7", "value": "12288:r/ouKPw/yTCB6ZATm9QorGqvYV2GN+16ji/+Ph1:Aw/yTCEZumrrTjG1C+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923495, "uuid": "8ba7ed4d-16d1-4201-887d-c98c9c67dc8a", "value": 1046528, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923495, "uuid": "b334eac7-881a-4c48-919a-b0cab5eabcce", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923495, "uuid": "d3025401-3898-4b22-bb3a-a2ee8f35937c", "value": "93cfec5cf154db98118e0feecc88ed82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea80588-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615891618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891618, "uuid": "67e42fab-1f94-4512-8197-5c018e8931ba", "comment": "Malware payload (Formbook)", "value": "5aaf57c6b1f4621fbb4427f72913ec2a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891618, "uuid": "64389193-a335-432f-b6f4-9f8edf1da9cb", "comment": "Malware payload (Formbook)", "value": "1b56dc4089c0421e6664f6c12c30d9181875c295420541e49ad815d2f05f48ce", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891618, "uuid": "96683f8b-a83f-45c9-a64c-ef022ec4f977", "comment": "Malware payload (Formbook)", "value": "fd0fa017a06461b8a7aa3546cd43f12f354838e0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891618, "uuid": "55377cf8-de3c-4d8b-9437-20701c968973", "comment": "Malware payload (Formbook)", "value": "48ba347c0ef49363c620a40ce287084d55acbe4ca4b3fc5ef6b5986accac857b5a92370b1b7ec0cbcee9df0f9222f960", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891618, "uuid": "f46a8078-fbab-4055-b146-79d0e3956d37", "value": "BCC423EC503C3E0758DF1230CFD9E40F28586DE91D170F5B562ABEA2912A95BBE7212D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891618, "uuid": "52c3c32d-95e7-4b93-8328-a64ad81270f5", "value": "12288:vFgquRvKdSBphamjlqRihGEVFIZScTBMGP9ZIVL:vXu5iGHpwiVIZd2GPyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891618, "uuid": "ea9ee058-45e9-4158-9690-8e9dd1f96132", "value": 555644, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891618, "uuid": "c868f985-cf13-4830-a759-556ae20c7ce6", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891618, "uuid": "40c15ec8-4a03-4f5c-a280-1ea7d190d0b4", "value": "Shipping Doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5b496c-865c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615901761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901761, "uuid": "91db23d3-7edb-4dfa-a5e0-eadd7584c627", "comment": "Malware payload (AgentTesla)", "value": "1765e64a7f4e0354e4f62f4e523ef227", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901761, "uuid": "9b903937-9623-490a-9ccd-fc51cf8a65c9", "comment": "Malware payload (AgentTesla)", "value": "1be6dc89ef7b01bdc6563c86c36e84b7560d85bab73d7186e2f223550461c5c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901761, "uuid": "7b07b04a-78e0-4ee1-ac2c-acc6b446bd67", "comment": "Malware payload (AgentTesla)", "value": "c29a573a960c3c971d31d669dfdd4734a6653c90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901761, "uuid": "ff43b57a-5c5c-42d2-ab2b-77ca3c666b92", "comment": "Malware payload (AgentTesla)", "value": "ae5b5dfe1083ad6b1e4aacb5c1026ee3c1312b5aa432c3dd32cfd8f910ce3517a0d1d5375a0bf91b77108481e63daf23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901761, "uuid": "544c09a4-6c1b-4adf-8dd6-309053e9ac29", "value": "A015027622886A56D0BD87382574640403F4EC06E316EB5EBEE835ED2A71FC1877BB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901761, "uuid": "ce93762f-998e-40a4-96b8-a179a518d585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901761, "uuid": "8cf841d1-a362-46a9-a448-4c5f06be0f86", "value": "24576:jhcz3KwTHIwSH8afnCRSX73dj/7aRR9sG7g3KNn:wZIwxafnESpjaRLtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615901761, "uuid": "c9baced2-8fc8-40be-a1cc-4e83d1a94467", "value": 932352, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615901761, "uuid": "38aa77a0-b4e1-4f1e-bebc-e054440a8a03", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901761, "uuid": "29f165bf-efc7-427d-b657-bf114525d097", "value": "Order_BC012356PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795e39e4-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615906883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906883, "uuid": "bba9043f-8b34-48ae-8c80-f08177470145", "comment": "Malware payload (Loki)", "value": "a8f40e6a34a0aa6996b8f6fb4a8bd091", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906883, "uuid": "caa18595-154d-4bc1-a92b-738ead335897", "comment": "Malware payload (Loki)", "value": "1c410cb97d93386cacb15d2f115b5b89402def93b2164a8269d2d8df9e42a19a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906883, "uuid": "763364aa-83ba-42a9-9343-f35c7f7b22f5", "comment": "Malware payload (Loki)", "value": "a0e7b0aad730ab1e2249cafbedaeeeb95ba0db27", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906883, "uuid": "3f860a56-a447-4f57-a0cf-72ef170c87cd", "comment": "Malware payload (Loki)", "value": "2eba9c070f305f851f36084a39efab8efbd8d70c097f5deb4daab26c6eefec52c23e0ed3f2cb0e273761ef57a7629abf", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906883, "uuid": "a558cdf5-fce6-480e-a68e-e2930721cbb3", "value": "79F3022131D2CDB7D9E2D3B24AB2D5BDF3BEC9082251960387A44F75AD619CB5B1E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906883, "uuid": "764504a2-1642-478e-aecb-ecee6e9a88b5", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906883, "uuid": "5bb8cc73-ad9b-42c8-ab37-09914ea4e409", "value": "3072:63jqjLX1DLPcFMflZBShpnP5QzfPJUwPwn/jGxN3KmwvAiz:6TqjFvfAkPJU5WN3vcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906883, "uuid": "acf50a44-c8a8-47eb-b34e-4c3d23b25d49", "value": 157535, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906883, "uuid": "7b90919d-3b46-4734-b5d4-9e52ef9431ca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906883, "uuid": "074861c1-65be-4877-8248-26805633c361", "value": "original invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf217744-8658-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615900155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900155, "uuid": "15bb69a4-528b-455d-b27c-646e9e7e8e7f", "comment": "Malware payload (SilentBuilder)", "value": "bcd6f978f83b1f6e0041767d01b0a774", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900155, "uuid": "77a948e8-fda0-481f-b875-02ed8c4efe3e", "comment": "Malware payload (SilentBuilder)", "value": "1d9ace126ddd51f337a0c34ea38bcbfa6e9512e71b221f2fa1575e7ce675f23b", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900155, "uuid": "bb4486f7-38e0-4826-8b2f-7e54ddcf1adc", "comment": "Malware payload (SilentBuilder)", "value": "b1e9bbe7f60ac9a120bc22e72c85e4b74abebb91", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900155, "uuid": "531e4fb0-e7d8-4b1a-8ec9-5783d73f91d1", "comment": "Malware payload (SilentBuilder)", "value": "313891f6dbb4210efe55c68a86703da16eab1e45f2e2c7448c747f3d59ce3fb6a3bdc1be4af357ef5277acfc8b98da4d", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900155, "uuid": "44f49cfd-7e79-42ee-b109-7bddfd92b5e1", "value": "7BF3FD07DEEB462FC5845B3A41B34A1A36D28D4847DB024B5BD9FB6A5F7EB452E00EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900155, "uuid": "b3965e89-ae85-468e-9492-5927d1b16d7a", "value": "1536:6LUd4TaBcvofLSVncq3nWG0xv3r3McJAN8QXs0sxRxi:6LUd4TaBcvojSmq3nPkvb3VA1Qx/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900155, "uuid": "a62e5b04-059c-4161-ae82-dc245d648898", "value": 168448, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900155, "uuid": "dff6ec6d-b468-4626-a65a-9d9ee2e07c78", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900155, "uuid": "45146852-123a-4ec4-954d-d05821cdbdc9", "value": "document-94616021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0ec385-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876529, "uuid": "c2420cbf-1339-4895-83fc-ac244b8a188c", "comment": "Malware payload (Formbook)", "value": "0dbe8e0fc1e17fe24b3a8cd76b1e9ea1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876529, "uuid": "29cb99b8-fb90-4884-977e-d77d0a9b00d4", "comment": "Malware payload (Formbook)", "value": "1f754500574c0df9009b8633c801f4d8be40f7d2bee60ef0d1d89d18abd7e482", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876529, "uuid": "0dfa3515-7108-4685-b543-782f760b6966", "comment": "Malware payload (Formbook)", "value": "ce7dc1273b9c6886f8f57c1c7123a821e183d4db", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876529, "uuid": "facc5648-28b6-4ba3-8ab3-2fe67f53d315", "comment": "Malware payload (Formbook)", "value": "fd009301ef8eca97125c3f05581e408b5b8eddd90a82b10f17c801cb04f4e02dde125344add553dce9a22f7a00474b45", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876529, "uuid": "148eaec4-64a0-4f17-ae43-6b2d8e7c1db0", "value": "3BC5239F4A810B05C49B8DF7D6DC921A80C9ED3611015CE52F6F336EE235EB4B26AE1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876529, "uuid": "7f9d8aeb-542f-4fa6-ae1e-650b7dc45734", "value": "49152:Sk4akKIwS3WhGjTyVHIJ5s2+xkHAxlM98DTQbEC34+tHV6YsXswgUdgu:SrDXydi5avM4cb3ttHV6Xs+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876529, "uuid": "67111737-0cbd-4ff7-8987-f481799e6c3d", "value": 2658816, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876529, "uuid": "3dfdcb42-5afc-48eb-92f4-7f729744cacd", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876529, "uuid": "6f168fcd-08fe-4e62-aa7d-f52c8cc0cd9c", "value": "Booking Confirmation Australia.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3949b629-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906776, "uuid": "bb3d5e5e-1652-4dfe-83e6-c32a46761c1f", "comment": "Malware payload (AgentTesla)", "value": "758487f34159e427317ab636d0c5ea17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906776, "uuid": "67550dd3-6230-4bdc-a180-ffb8e5981cde", "comment": "Malware payload (AgentTesla)", "value": "204cfeab127e58672571ff951e5869c2f2d255af55c6f310c14d353ccf7c8edc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906776, "uuid": "b318ed7c-2b4e-4115-ab4f-92c5f14d237b", "comment": "Malware payload (AgentTesla)", "value": "89bf0825ab2b72e2f5d8b6b96096c3b11bc3d8c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906776, "uuid": "a1391124-936f-4b5d-9701-b4f276a1fbaa", "comment": "Malware payload (AgentTesla)", "value": "e019f96d7034b4d119a33e4bd4e5b25c3992e974c5e30b58a4535daaa30b457104533bdf4bd9742eb024fd933837e294", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906776, "uuid": "6ec295af-8dcd-4ced-94ae-2469a1a8ca54", "value": "5005DF243AFA501CF173AFB55FE4B1869AAEF6633707D45E2491038B4B23E41DD9123A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906776, "uuid": "b208f524-5a4c-4420-8206-36813109e9ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906776, "uuid": "ec2015b5-c0ac-4f7d-96b9-c6fc18fad60a", "value": "12288:POVs4iLOhvEgFHI5XmFX5D2P42FbVV/WVeFcE1j5fqQ+vG0xmCVbn9:lgFo58w42preQFt1jZqteS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906776, "uuid": "e4178801-c274-47dc-b49e-3f6f7147012b", "value": 802816, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906776, "uuid": "d23c4fa8-1375-4b8a-abeb-fa124672b9bf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906776, "uuid": "b848d0cd-5165-4d7d-90c3-db3d1b33b0eb", "value": "IMG-20211503-OWA001-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ecbb50-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615891637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891637, "uuid": "4204e69c-d815-4434-82bd-2453e0ea65e7", "comment": "Malware payload (RemcosRAT)", "value": "f46570f8573752848e4b38e514b3342e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891637, "uuid": "34004657-6a89-43dd-a5c6-6d47b06ee4a3", "comment": "Malware payload (RemcosRAT)", "value": "20913ef76e86c0e3222ad67afaadaa44912595513a32d08345dba6ec3de019c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891637, "uuid": "1ec76912-fc4e-4a31-9463-0ebe436e27a4", "comment": "Malware payload (RemcosRAT)", "value": "e64cb36f84cfae5bc3df874062b56bbefc67abe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891637, "uuid": "75d31ee8-5f98-44e5-abfd-574fc009f6b9", "comment": "Malware payload (RemcosRAT)", "value": "619f4a748ace0c3a516511217965e18023d393c147b6766daac5a4a991bd8013d86eb2ff571734eafb9788c929427cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891637, "uuid": "74b39781-b5d6-44c6-9414-35e18db24f62", "value": "C645D0FC7500BC8FCC17AE3689561C28AA306976D30BD347E12715AE9E5EA97DE005F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891637, "uuid": "a5e9b97d-cc4d-4af8-a492-4f442a710692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891637, "uuid": "2dd20623-028b-4ab4-afb0-ce3af3700328", "value": "24576:wm1PlynMoIDiM3/m9YoHUZZTeF7jOhbVheOY:wcIMoIh3/m6oHcegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891637, "uuid": "e7b5094f-d757-4cba-b9bf-ac992c0162bf", "value": 1166336, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891637, "uuid": "312c663c-bd17-4c18-8330-dff8e059753c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891637, "uuid": "6f328729-8c93-4758-9d8b-811fce639de0", "value": "Doc_IMAGE-587HTY-9545-55401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e84d0e5-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615923105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923105, "uuid": "2ab8719f-0490-4ea5-808a-b11c3df0d014", "comment": "Malware payload", "value": "125994972bda7486ecb1f3ec5618baa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923105, "uuid": "8131ff2c-2c3c-42a1-8076-818200a3dbac", "comment": "Malware payload", "value": "22f8d1582e34c1754955d616542d3bf5e784d357ed58dd45e6bc3a5df9c82446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923105, "uuid": "25dd42bd-5aa9-4fe6-bb8e-179249722eaa", "comment": "Malware payload", "value": "721df4f87ffbafffe81ec616ff9e3e67ee4a0f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923105, "uuid": "5640c826-4337-4871-900a-ec18322d8c99", "comment": "Malware payload", "value": "60581416ce092a8e654bfc1d95b8a27bc6e95f78a1bb0769dc095c45a8a39ed0d5a00d9135d305f0dc8329244bfc6546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923105, "uuid": "f397f20d-1041-424c-a850-dfd9486d80f3", "value": "493523A1E6E641B7D2A337325C00772A2ABAE334572942C7A79009829E377D5CB3D247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923105, "uuid": "56861499-09c2-46e4-80bd-a1f640c67930", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923105, "uuid": "24694755-ca3d-4daa-b8af-0572b5e808a1", "value": "24576:N53uhFggNNxAHowXfsz/+mPfDN+Olz8Dr5IHPwd:N5+hF7NxIowo/h3VlzQr5Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923105, "uuid": "2205c7c8-8cc5-4d0c-8a9f-cd4ff88d11df", "value": 1155866, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923105, "uuid": "5578efdd-e3ee-49b4-b61a-3d8a7bce3760", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923105, "uuid": "81c15adb-17f7-4dff-8d9d-dbb017fb98fa", "value": "125994972bda7486ecb1f3ec5618baa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35170316-8640-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615889589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889589, "uuid": "1ca98f6a-8a6e-4f2e-b3f8-300637789470", "comment": "Malware payload", "value": "f67ec0b4c15fe78635c930b014d8089c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889589, "uuid": "b9ab8ecc-930f-4f66-8741-1db75e15e8ad", "comment": "Malware payload", "value": "23376c5a840fdce3a2ea990049d99de09ea3b93eebb25ec8e6b6c2ce459f86e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889589, "uuid": "f6e75627-61cb-4593-9692-37b4333978e5", "comment": "Malware payload", "value": "39d9846f4ad8e92354f1c7799856c55b03c2bf9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889589, "uuid": "f814429a-63ed-40bb-8f1e-dbfb180ecdb8", "comment": "Malware payload", "value": "c800424ebbcfaa44b4b5246eda66b87006459ec9fa6da255ef1c931fa21d5ad86071afdf618aa6cccdcc73482affe5ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889589, "uuid": "a2ea6c92-85d1-4b6b-bdec-33e7e9630117", "value": "17E433A5DF5DACC4CC9FAD1A7B653638C13C7300C525E12C61A261DE418AEBB39303B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889589, "uuid": "1d1575a4-c8f0-4e06-a5ab-2f485939635d", "value": "12288:EnyBNHRKdxnACcMZH8savrx+tEHrywGoK9FGeF8EerGq1MkY6iFdP/5Q:Eny7HRKvACcMZcsavNHryhoK9FxmEerd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889589, "uuid": "1069b2de-3d45-4bf4-ace6-e48280188999", "value": 721977, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889589, "uuid": "4ba0e1e4-1ab3-4d0a-8063-6bd8d99bef98", "value": "application/gzip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889589, "uuid": "b0285ccc-ec22-41e4-8843-095baaa7cc75", "value": "Purchase Order ASPG-2 GP 0069323.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb09985-8688-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615920631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920631, "uuid": "b97688cf-ebff-4d84-94f9-914284a8b420", "comment": "Malware payload (Dridex)", "value": "53c3fe081b59c5cc633badf30835a940", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920631, "uuid": "da654367-d4f6-4e6b-84b0-08517540eee0", "comment": "Malware payload (Dridex)", "value": "235b7ae0f5b6075b7c93099a600331ec7fed80f2f62d9739ae4ec4be71fce4e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920631, "uuid": "c7eb7525-6d9b-43f4-b5c1-9cddea211e8d", "comment": "Malware payload (Dridex)", "value": "63af98eb9ecf1f9a51aa978f6dee3c51cae6a71c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920631, "uuid": "5e3dbf68-0271-4484-84a3-301fe0715ba7", "comment": "Malware payload (Dridex)", "value": "084f33fc6f4d4919a234a70c207431fb9f127ba5140736e75f2262317f6a2b42ff89ba3a7c7651aaa0b2ba68407b5d75", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920631, "uuid": "5b861c56-0267-4807-a5e6-a3d49daa1cd6", "value": "4CB4392AF882C0E6D75952B48DE4FDFDC6843C98CDA084837FD71E0B766A613976113A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920631, "uuid": "5fd06bc8-4089-490a-b03e-61a464511f1b", "value": "3c45c2eae973252af425589125584d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920631, "uuid": "8017a32e-6ed9-4179-8fce-03143091cc8e", "value": "6144:m6bDGn5U0EV3GbQM/UOq+ZbFN5LFv1ZW7F37RWCFACc3Np/BhII3ZqrKV1aNGH80:72C06YQCpZlB8sCwEr5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615920631, "uuid": "836d43d6-3de7-445c-89d7-e961976cb7c2", "value": 507904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615920631, "uuid": "cf26ae8f-c41a-4324-adeb-9751f084ca3e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920631, "uuid": "4a31c7ef-44fe-45f8-b9e9-455619c03452", "value": "53c3fe081b59c5cc633badf30835a940.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cacdb83-862c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615880958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880958, "uuid": "6d8b375b-e92e-4af5-8c71-860b699a4fea", "comment": "Malware payload", "value": "4a109c106f7d42e7fd533c0714ae8c04", "object_relation": "md5", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880958, "uuid": "480ca211-4a67-4717-9fea-c17943e7c719", "comment": "Malware payload", "value": "241fdf248b6df01bb2a94e25d834787490d3b3a23e573941b7c3137c9c715cce", "object_relation": "sha256", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880958, "uuid": "5c0b1811-afd8-460e-80ed-90ac07acbef5", "comment": "Malware payload", "value": "8e8c68d92e58beb8aa7fcec438c1ddd078a9a5f4", "object_relation": "sha1", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880958, "uuid": "d12d9aa7-4caf-4b45-90b4-ad963403084e", "comment": "Malware payload", "value": "67d5e9ddafeffdfe6dcc385371e108f3a67080b6ef71ebfc3ee6aa9da27fb01f2299750ba3a20723449dd937c7dd1773", "object_relation": "sha3-384", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880958, "uuid": "f56416f1-8cb1-40d3-b84d-6c7d7d1c7a0e", "value": "6EE56D76B244613EC06B1A3B5537E658993BBB71AA1A8D5B17F40C8CCF395802B3E707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880958, "uuid": "efc362fa-dfe7-42e1-befb-ba9e32933ff0", "value": "a63954331cf666d195c7168eb21abcfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880958, "uuid": "d783a523-b0ce-4497-a8b1-d224e9d7e364", "value": "49152:1AvdT47OmSYjzqL2/nneAPIFYDrjKeTL11nH0:1AvV2n1PbR11U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615880958, "uuid": "2b8d9234-e155-4cf1-8284-44f0221a0c8a", "value": 3051608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615880958, "uuid": "3ba408c7-a80e-416f-9d9e-be76be25772f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880958, "uuid": "76760088-7a83-4eb8-b5c0-9a54cf6a8567", "value": "241fdf248b6df01bb2a94e25d834787490d3b3a23e573941b7c3137c9c715cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f75f9ae-86b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615937656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615937656, "uuid": "679cc65d-8ed6-4d50-9562-c54f5cf935e0", "comment": "Malware payload", "value": "5feb04f28b1b36c34c9cd6d877f4ef47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615937656, "uuid": "0f9a303f-f28a-49e6-8305-6aab6bb65d2f", "comment": "Malware payload", "value": "24d059aa3c299c202acf0903a9a32beb4f191ae88c4835be517f8649c288d039", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615937656, "uuid": "442cef09-cf2d-4fb0-9eb2-bff1b6ed6f0f", "comment": "Malware payload", "value": "aee1401f6fa5898ea42db65947590fbb5bd2332b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615937656, "uuid": "bd2311fd-d709-4b08-b2ac-0c0b126c5360", "comment": "Malware payload", "value": "47fc73e8e572a1efdb3fb102bb031204e4e149b648111b7114dc5a63f1d749f891168711d1e4268831975e304cea67f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615937656, "uuid": "28a797c6-65bb-49d0-86ae-af40af63dec8", "value": "44552669F25076BEF466BD7289741F30AA9C6C624207D22F70133198897D5C68EF3DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615937656, "uuid": "17ea142b-4ef8-4f4f-b14d-ba893188989e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615937656, "uuid": "7dea0fce-3c49-463a-bc5a-8bd56a793550", "value": "24576:9ZxaKHJBLU+62PjRO+/DM/GxYUfIaaI86:9OkTo+62PljM+xpfgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615937656, "uuid": "c13b2c9d-34c7-48d5-8cef-655a100442d2", "value": 1305088, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615937656, "uuid": "03eacae2-973f-46f9-87f7-411aeae3c484", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615937656, "uuid": "8c1f3ba1-1a51-49ce-b8e7-0d0aa24aa6fd", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.18723.18946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebedb88-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918032, "uuid": "425efdb6-cb75-4098-90bc-76250de0d7a8", "comment": "Malware payload", "value": "5e47038f8cdb1d651c514c81e3cdef00", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918032, "uuid": "0407ceec-5701-4191-a0cf-8e4ce74a3eb9", "comment": "Malware payload", "value": "25c91708366c53d607b7b0bec1beac89b4ee9b14a4431e5e5accda9c678ba42b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918032, "uuid": "c0061f27-2288-4f23-8235-d01b96442446", "comment": "Malware payload", "value": "1c1d459d0f96b513f48726ce2d61dfbd0b6f4bca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918032, "uuid": "2a9200ad-92ea-423e-9e55-3cc27e2a91fd", "comment": "Malware payload", "value": "bbc845103209e2ca46d4fbd8bcf0e02810ce0ffb3be081e8c30aa70cbbcf8e89ea257ec0b1d0f21ad132de816a9d9c31", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918032, "uuid": "fd5041e5-75d7-441b-8d12-f73b859d2b65", "value": "DCF35CE8E991CDE4C78FC5D9560E7A941023FA79CAC36C9A4438F3F50BD267F1A1A850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918032, "uuid": "99739d84-6f03-47c6-aa88-c305fcb18c37", "value": "3072:3v6qJs4NjDqil/lPgZuIMfeyVKU3O+M0m40SE6KKuc1oXKqnra1kWKCb4a:3vPNjDqivoMfe2938ZWwKO2jb4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918032, "uuid": "8fc577d0-c6e4-4483-b4aa-4edeb81eb6f1", "value": 168695, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918032, "uuid": "0dd2e587-9b3b-4065-adbe-cce4b4b29515", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918032, "uuid": "ea643593-0028-464c-bd8d-d03f586df093", "value": "Wsample-Sheet00921.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63e6b82-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615876464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876464, "uuid": "cc562137-1e75-44ab-b7c5-167c34d74ec6", "comment": "Malware payload (SnakeKeylogger)", "value": "b31cbc2ec92fa3929a07f6c14c7ac716", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876464, "uuid": "f732e76e-8e01-447a-b194-9538a282de10", "comment": "Malware payload (SnakeKeylogger)", "value": "25f36002e1f2c355d9d776e574cc82ae9e2f563595f116da4819cf0ee1f77a79", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876464, "uuid": "8bc796b2-b2c1-46f5-9183-3bd4ad37ef28", "comment": "Malware payload (SnakeKeylogger)", "value": "ae009ca4416c23cf0352d658610c850bc206ea16", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876464, "uuid": "3ef6b5b3-d032-44a3-8fe8-929e98c3e15e", "comment": "Malware payload (SnakeKeylogger)", "value": "a933bae8aa997b7e34a555f5b8677d8ba0848b6746010842356b298febec7231aca4d1d999270fe51d515ba592adc422", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876464, "uuid": "966cf149-e414-4c9a-8a2f-8c802d705a9f", "value": "EA0533513699F92CE15711ECC0E7A0F998A4905E96DCDC68F7EE109BE48E8BBC84148F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876464, "uuid": "c0aaec0d-8f58-45f3-b552-58e0b7ab7d58", "value": "24576:Rz/FReZVQESzR03qFa/wb98ptTnC3F7SVggid59kl:ZEVQESGS5GptTC1iiD9kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876464, "uuid": "b5f46a65-73a8-464c-be4e-4d8c3e04133d", "value": 843689, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876464, "uuid": "03652261-dc18-4d60-9960-5ca41a0bad10", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876464, "uuid": "af03bf68-6253-4a98-bf66-e8c071556a7e", "value": "MFT40FT.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea5ca6e-864b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615894571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894571, "uuid": "13082c43-0727-4db6-8105-e4d07f1e573e", "comment": "Malware payload (Dridex)", "value": "ad9f7e32a6be39b8c0e794a7b795da47", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894571, "uuid": "a39e6aaf-3285-4455-bf20-41c89dbb86a4", "comment": "Malware payload (Dridex)", "value": "26ad7700bad1abd369f2144ad8be4ff99362afa442909fdaf377cfd545cf055f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894571, "uuid": "968cdbf9-9510-43dd-bce4-d3d65e35f299", "comment": "Malware payload (Dridex)", "value": "ab08e2c2cd261be49ec11d0c60c73671e4220a9c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894571, "uuid": "4c842121-0ecb-4d83-9433-6a35d33d897f", "comment": "Malware payload (Dridex)", "value": "942cb76bff086435081d8c0149e0309424efb1090ce4af45bb24f7f9dba29aa69e93320ef0ad8858b2d738cd6803b0d2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894571, "uuid": "5cb38a94-3b33-4c5e-81a7-0c127d27db3a", "value": "1114AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894571, "uuid": "1de5b237-e153-4f5e-9a7d-3c7aaed12d89", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894571, "uuid": "0c1dccb4-aebf-4d39-b1a5-2ac667799aa2", "value": "3072:J1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ri78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894571, "uuid": "204b7806-dfac-4e41-bf6e-b98141ae2607", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894571, "uuid": "52edf780-2abe-45b4-8b6d-6a2aa76903ed", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894571, "uuid": "a020530d-a0e9-4c1a-8f81-9f9018b4762f", "value": "26ad7700bad1abd369f2144ad8be4ff99362afa442909fdaf377cfd545cf055f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e0c134-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615876162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876162, "uuid": "6fdd2cc3-a650-4998-88bd-75dae38c7971", "comment": "Malware payload (AgentTesla)", "value": "865627260cc07893d66162fd175dd8e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876162, "uuid": "c253a0b6-0a9a-4fb6-97a4-950edafd245e", "comment": "Malware payload (AgentTesla)", "value": "274045e9d4beb3254dbd11d48c8c63115f00b72ba93a17513898ba472d6d969f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876162, "uuid": "bf24e50f-1769-4885-9163-65c41bfe3a63", "comment": "Malware payload (AgentTesla)", "value": "211d070df90e7486497978eed1ea6652cd32d68b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876162, "uuid": "fc4c9422-6213-4d9f-a95f-8d7d79507753", "comment": "Malware payload (AgentTesla)", "value": "89af57dcbc41ded93ca088e825f99cf54e71739d96f7061225115073a5c4f7aa27837ead16fafb2cbb9e792ff6cd4728", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876162, "uuid": "58680302-5696-4eb5-954a-cf9e242178b4", "value": "E895F85127846E24E27A43B04C35A519D7FDBA7BD338C4BCBE9F328B0B66A414573623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876162, "uuid": "85c68ac8-2001-440d-955c-9bef33c3ab38", "value": "12288:XjGXOtIh0RToVGQCSb3JUyB/Zz3usl8hdMQ5yLUR5IJIKXFlqq8J3v5A3UYkCVXU:wUyBxusCDRTYU9cUiXdklf+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876162, "uuid": "b967f5c3-a0e2-4afe-8cbd-d39d0d32065b", "value": 1900544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876162, "uuid": "2ace4377-0c89-49b4-9eb6-e05e7ae515aa", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876162, "uuid": "5d0b9b34-cd8b-4d85-8010-d608ec61c3b2", "value": "MT103 Single Customer Credit Transfer Copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f1cd95-8659-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615900645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900645, "uuid": "99238bcd-11d7-41e5-8eef-9daf20c7b751", "comment": "Malware payload (AgentTesla)", "value": "382afa71e6610f8c951f5dac9aba8e60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900645, "uuid": "d88e770e-f3bd-4c01-8703-8bce91489ce2", "comment": "Malware payload (AgentTesla)", "value": "274bb5ebe00e54abcb11eab5afa80ad58e3756bf531e464308d6e3f2b5622775", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900645, "uuid": "0b36faf7-ec45-4551-8674-b7540d22e7af", "comment": "Malware payload (AgentTesla)", "value": "8165e60847e7a7eaef270bfa56c72ff8fc1a45e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900645, "uuid": "da7ea98a-0da1-4ed5-90cd-f30587839751", "comment": "Malware payload (AgentTesla)", "value": "d518caf75691956e9629a42a6eae58545f78cca89bb736ce809cc123f7da4ef00ade5a670239355831452bc5f007b703", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900645, "uuid": "915620ca-4b02-4c6e-a932-7569da301b86", "value": "42F4F07C32789E27C59DF4FD8483722E0B7485A7E920EB8B1C8D45ED1582BD869024FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900645, "uuid": "89ac7ef9-f634-451a-94a0-a749007ed451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900645, "uuid": "ac8c7969-db9d-4d60-84f6-0a940a8c41c1", "value": "12288:yg01CYsvyTUP9iOxCKiIU/gkHUySJctqvCeNl55HRU5v/Svq+y0FpL5WSDB7ehVa:jDP9tpKgoPrt4CeNf5yJSU0FpFWSsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900645, "uuid": "64caa401-0b60-4436-b413-01385a3c29c7", "value": 753152, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900645, "uuid": "d8a52152-8122-41ca-9472-eb621f055bb2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900645, "uuid": "e0137a18-9b3d-43ca-b5f3-77f8c3cdb1ee", "value": "PURCHASE ORDER PSB-17398902 PSB-18384789 PO PSB-18384789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767ba7ff-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615890128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890128, "uuid": "d1875bd9-3b11-4d88-8d46-ab625b4c9916", "comment": "Malware payload (Loki)", "value": "b3f3a1d734f5f087ef95b222db9b2cc9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890128, "uuid": "d0ca43a2-0f67-4d6f-b9ef-2fc95d0c10bf", "comment": "Malware payload (Loki)", "value": "27e426730819d8ada831a9678da3aece524b0a2d59925d8a4b3aa17328c2d6d2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890128, "uuid": "618632a4-d237-4481-9195-3b8db68bd103", "comment": "Malware payload (Loki)", "value": "fa3e3d1df3625b4d9ce11aeca038be8c4e3aff63", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890128, "uuid": "5642aaf7-22ff-4444-9a98-f039ed06dbd6", "comment": "Malware payload (Loki)", "value": "4b7e8a6ebaaab2548749a2ff23462fd17722ca4ea2dd4bc046a6f2aa1e1c02cdba3ee48b484136e1784cedeb1475fc1e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890128, "uuid": "d92f0b5c-1880-4688-823b-105a108ceadf", "value": "F2742365D58540DD4446B5470ACAC708C29BABB4CCB3F7A7E46B645F420BCCBD0BEBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890128, "uuid": "b990a22b-a337-4171-986c-1bb654ad4a78", "value": "6144:+rBEVdEGt4Y1X2bUo74jEZOyqdGFdaxMI1qKqb/nYM4GOIfVD5xzawbRbZ+atK:+rigGtzR2Qo8Q1OxSKYYuVDHzawFbZ+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890128, "uuid": "9205c536-d57f-457a-8fe5-c5bc4e438f45", "value": 363249, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890128, "uuid": "4771d234-215b-49d8-aa2b-3eb73ed5ddd7", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890128, "uuid": "00ab80a9-f408-4ca1-afa6-d9420fc503c6", "value": "purchase_order_PO014328.xz__.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e56e39-86a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615934076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934076, "uuid": "6f0d39ff-8baa-4f75-ba1c-39a6a76d32da", "comment": "Malware payload", "value": "fa6cb4d34a0d1ee5f9687e19850df6a6", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934076, "uuid": "44167107-03c8-4aec-810c-978d2be83e5f", "comment": "Malware payload", "value": "28091b3e472083c16c336ec155c68c13f521fc67ddd2bfef0fe785d59afdba4b", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934076, "uuid": "cbcd361e-0b34-443e-a291-0f212cb5941d", "comment": "Malware payload", "value": "fdb6aac47c861d332c6ab85f92dc25bba213afc4", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615934076, "uuid": "b155ebdb-aa8d-4e12-8de4-ef201b5e2b56", "comment": "Malware payload", "value": "8a8bc5f6590a0da102c79be3f764c60bc497b507edbf21c861e474835e53420e99fe213fee1c5b05fabbfe2c31cea150", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615934076, "uuid": "159492a8-2983-43ed-8953-f741e146f8b9", "value": "4786FCAE0DEF19A9F3B70DB01FA1385DDF51BB6C09D90E89637024A04B4724C1BD2E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615934076, "uuid": "2bfa211d-0b0c-40d0-a693-3694f3a90e0e", "value": "192:Ja7Fvm1r3hbXHt30CinMqmBWMTI93qwnMqmBWMTRXNhaT5+tcq8Z3sR4s6H5yr6T:Ja41rECinXARTIcwnXARTQtWe/nEmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615934076, "uuid": "eb8cf672-2752-424f-99a4-69abb8c72fa3", "value": 8388608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615934076, "uuid": "77a19869-4f29-4877-85b3-00bf0b77e14b", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615934076, "uuid": "0914c026-f86d-437d-a756-fe116aefe621", "value": "subscription_1615904939.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd03508-8690-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615924258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924258, "uuid": "953eec1b-0d95-4000-a2f1-0b4048ab9637", "comment": "Malware payload (Dridex)", "value": "d2622427eb49954dd107ac59bce6c48c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924258, "uuid": "593d5c0f-b075-4d79-a62b-249ba99c9c14", "comment": "Malware payload (Dridex)", "value": "280b09250c6933b54d0982b9f8566ee5b00951cd0fd42fe3cf094a1856294aa5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924258, "uuid": "348bbc9d-419c-4327-ad61-196b6497c8c1", "comment": "Malware payload (Dridex)", "value": "270a7f59ee4db1dd30d4453278e81a98b6018bb6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924258, "uuid": "44a556b3-e572-4fe9-b46c-98ea2bcee8d4", "comment": "Malware payload (Dridex)", "value": "2023b0f42f810792f3d740ae60dd2d802390f95d0a4990db96623309e7b65dfa109e99815bd0ec87615388354667fc7a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924258, "uuid": "97335be0-4928-4440-b12e-3ae3873f87b0", "value": "4914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924258, "uuid": "bde3d446-cf20-4f50-8b7a-c2eb2b725b5c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924258, "uuid": "6d4b8664-14ee-4738-a568-b78a223cce17", "value": "3072:i1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ai78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615924258, "uuid": "a158808a-a3cd-4e1f-b9f4-797fa6379b18", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615924258, "uuid": "c68d1d5c-9163-4e3e-bdb0-b0a6f4d85b52", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924258, "uuid": "0fa9e6b1-4743-4806-bde5-649abdf0cb80", "value": "280b09250c6933b54d0982b9f8566ee5b00951cd0fd42fe3cf094a1856294aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa84a31a-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1615890215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890215, "uuid": "8fd1881e-c5ea-43c9-b521-61299dd49f97", "comment": "Malware payload (AZORult)", "value": "6d0c74a7eada635462502117aee3dae3", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890215, "uuid": "d4f47319-aedb-452c-9406-ae24b64f1e36", "comment": "Malware payload (AZORult)", "value": "2999ccf7236ab58d325d1f216e88c2285301f67fa2a50d3c7c9f2606b18a60b8", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890215, "uuid": "520ae67d-c5b4-4db8-a475-ebbe7d3b550c", "comment": "Malware payload (AZORult)", "value": "e27bc1b7660c7780fd87c97b34e0b045f5bbc1c4", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890215, "uuid": "06265577-4439-4a03-8042-91516f2af312", "comment": "Malware payload (AZORult)", "value": "5a9cd8f800032fe1bf86d61402b894aa1c5080c36a0cc59704f99154b0d5ce611eb7bac494af1a16abc41575972cbf17", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890215, "uuid": "1562c28a-84f5-4b49-b7cc-2b96d95bab14", "value": "1B0533018645EE26B06911405BF66CE55D30AF7B0FFA2D6633CC4EF6FA20A84ACE7D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890215, "uuid": "86b35d74-3334-49ab-94c4-176fa08d865f", "value": "24576:5swpXu/JUByoac4bglKxt5x5w2Eqv6vgGvD8aChws:6o81ohlclw2Eqv61vD8aq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890215, "uuid": "2803c8db-8a7d-4020-98e0-32422020672b", "value": 829546, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890215, "uuid": "061e4cf5-61d0-4361-a53d-ac76574e9da7", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890215, "uuid": "df5b6466-b084-4b1e-bc5b-d7b829992ce7", "value": "S1 PROJECT RFQ FOR AIR COMPRESSOR EQUIPMENTS, MACHINES AND MATERIALS.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae03dd9-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1615918563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918563, "uuid": "fe7b2872-61b7-4d10-ac84-b5a1ba02d2b3", "comment": "Malware payload (Smoke Loader)", "value": "ad9202ed6c4f898434c1a7bae1f3394b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918563, "uuid": "6c96396b-bbe7-4afa-bab8-241080f6cadf", "comment": "Malware payload (Smoke Loader)", "value": "2a4bad1e2e460acb41d0a95be49bbceb51df47897e6ec01bd3c5ea106f889563", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918563, "uuid": "efb13533-eb83-439b-9f58-f7e120cdc423", "comment": "Malware payload (Smoke Loader)", "value": "7c4293ccfc64e544c8c1da2278aab62dc0d1ec57", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918563, "uuid": "ba199f29-9aa4-4603-a221-2ccae3f91dcf", "comment": "Malware payload (Smoke Loader)", "value": "565b785f89f7543131993d72cbc5dad901d62d647fbe6070f727f7d6fa6411da721fea548cb3ad4a1744cf3ea09d25c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918563, "uuid": "8929b3cf-1613-48b1-bb94-478724653ca4", "value": "E6547B21F7A1C038F4B305B656B686B8A9347D71173880CB72C07A5F9A746EAED31B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918563, "uuid": "4fa45844-7caf-4b0f-b191-776df02679eb", "value": "729cfbd9792913a5ac829cfac110b85c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918563, "uuid": "e03d68f8-2476-4c14-826b-dbb96570513d", "value": "6144:sqJeTNBJbjVT+Z7eXqSe6208srGfBA/gR3MMMMiMM+Oz:stTNzbj1a7eXq76WsrSBA/gBMMMMiMMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918563, "uuid": "10b38519-a523-4bd0-9e49-76556022541b", "value": 300032, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918563, "uuid": "7d622960-2cf0-4a31-a88c-bf2b005f0dad", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918563, "uuid": "9c833afb-be9e-4fc1-b423-ebcdbc27c405", "value": "ad9202ed6c4f898434c1a7bae1f3394b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c07e36-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615921966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921966, "uuid": "1fc0b066-b3c3-470d-b4ea-acc8e9da16cc", "comment": "Malware payload", "value": "a83efb6089d31e00e164fb3a26777c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921966, "uuid": "b810e78e-4535-48a3-a32b-5699ed0f8083", "comment": "Malware payload", "value": "2aaefddc0b873f35ca8ea83d5bf72e8864b2ee1efa65d96ade710fd6dcd5dc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921966, "uuid": "0162d028-60ed-45c4-b415-306f4a0c5377", "comment": "Malware payload", "value": "06c2a626aac7893e0c0bc0878c80065bd9b58569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921966, "uuid": "63314eaf-f726-4a61-8649-7393b906ad66", "comment": "Malware payload", "value": "8c861084c5bfd31a26ea22aa72eb75d547c90c6e06d2c42b44f7496a89cc58db41d1bba817f57cb14629a0b131558b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921966, "uuid": "71837d27-92e7-4bf8-a426-3fed4c73cb9b", "value": "27359D1123A86F1DF03FEB3955B4740587FBFA16E312E95DBD9542CF1622E40CA90B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921966, "uuid": "18080063-94a2-48f9-8df8-8abaac846e83", "value": "24576:4bS9O+GZy1s4xn3S0UmTyyIoSWVs//y9gRBZjkUWY58b0hAQ:4bSY+GZms4xn3S0UmTedj/y92ZoUfILQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921966, "uuid": "738a0bce-5656-4ad9-ad54-201609c20013", "value": 1149406, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921966, "uuid": "bab60172-dccf-4a97-8535-d14ad9f36966", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921966, "uuid": "a3914f80-b597-4569-a904-e3c41fba9c72", "value": "a83efb6089d31e00e164fb3a26777c65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7639a6be-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615923628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923628, "uuid": "1b2b39e7-bd3a-4c00-9e2b-f4715de3967a", "comment": "Malware payload (Loki)", "value": "80ec2c1485aa0a061665d5d08d70bda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923628, "uuid": "d3c83d5f-f849-4829-99f8-4efa8d5ea18b", "comment": "Malware payload (Loki)", "value": "2ae14d2874d1d5981effca3d214370367a27ee587436e879522a99b851697245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923628, "uuid": "dee09212-8f08-49d3-9049-8933606ebb05", "comment": "Malware payload (Loki)", "value": "7b762af3ec5dc043662ccd795f0a5207ee61d881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923628, "uuid": "c2ee5973-1bd0-48b6-8352-9e8c8b8853e3", "comment": "Malware payload (Loki)", "value": "1e9ee4917db5faba8cd708656d161549eb7b603f77eb0eef8edf9fc388f1961ac3caf2b46d4b4f5fc38c8b49f0747a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923628, "uuid": "0e74018f-cb4c-4afc-b72a-be6679af2402", "value": "DC55411316F5FE24E27D7270CC37501986ECA1729338B469BD5A33868A5FA414F632EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923628, "uuid": "25c92975-26dc-42c4-88a8-26d1c6e27c67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923628, "uuid": "0c9bbaa7-75f6-4d17-8c35-39da37b44fe6", "value": "12288:+PKXOtIh0RToVGUCnLMnyB/huvW8hdMr5ybUIe2JjXrs9n+O5QY:fnyBJuvyPWo1+pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923628, "uuid": "3c89a24c-1331-496d-9301-ef9a18686104", "value": 1358336, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923628, "uuid": "f02e7f41-04a2-462f-962c-8aec68522bcd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923628, "uuid": "7c189804-d8e6-4d73-b87c-dddfa9e8f3cb", "value": "80ec2c1485aa0a061665d5d08d70bda4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32fc6ee-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615922496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922496, "uuid": "1472df69-54f6-4dca-8b4e-0bd1dfd6f7f5", "comment": "Malware payload (RemcosRAT)", "value": "a23c197b57d3769b7e309856624c1593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922496, "uuid": "f5639d95-f880-40b2-9eb2-ea013900a66a", "comment": "Malware payload (RemcosRAT)", "value": "2c0375fd278faa919f0cde2ab6e20512c93f7991f62710b992935bd2e76773e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922496, "uuid": "9121090b-7cf4-4b83-b0a6-5efafa420c18", "comment": "Malware payload (RemcosRAT)", "value": "31ee0f91cc3901796679c2c9c9aa54ba39bb600f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922496, "uuid": "82a00735-754a-4f53-9e64-76011e7aa856", "comment": "Malware payload (RemcosRAT)", "value": "412fb5c2303a5bae58fa7d9888badf9be84ee9199e26e34a6fbd86ec08c5476655ffd67551e1aada49e695648e763aea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922496, "uuid": "56128b2f-636d-41d5-a719-a13b88a9008c", "value": "58E35B1332015CBCE4443970011BDA797666EC7282409FABB4E9BD1BD9BD5C22DF6F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922496, "uuid": "9acc207b-d29a-4de7-ae8b-cf6a879513e9", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922496, "uuid": "6c9685c6-7d33-4111-a57e-a655b4bbce7d", "value": "3072:uzT4zfF/hG9jtsj92UV17tNkOuByOZU55dHKGT4R:skzKjtsj4UV17tNkOuByOZU55dNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922496, "uuid": "8eb011e7-015b-4059-b2d4-bc831a36fc57", "value": 151552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922496, "uuid": "ea66ccd2-7de5-445b-84a9-7af9ee4f195f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922496, "uuid": "0a832f5f-4342-4002-b661-0b1bf1b67026", "value": "a23c197b57d3769b7e309856624c1593.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c73b076-85fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615861201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861201, "uuid": "f7cf5911-d870-484e-9fa3-6412722a3c2e", "comment": "Malware payload (Dridex)", "value": "1dd366b17b30c1caf8e8b958b5a1becf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861201, "uuid": "72573bf6-b438-4f0b-a423-851b62df391a", "comment": "Malware payload (Dridex)", "value": "2caca542def60e677837de19466eda0c4ce3dec632f196bfb0bb570ac5f4f7cf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861201, "uuid": "1fd32747-8c5c-40ce-8f66-b5dc2a899868", "comment": "Malware payload (Dridex)", "value": "a14adb90c7957e103760008ac7c3032bb8352f63", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861201, "uuid": "15eaa449-ce8d-482e-a793-3d7a4a70562c", "comment": "Malware payload (Dridex)", "value": "f699c15a4a90a56d93517142a015d33326e71f586f6a0de62cb71ff4e8e07dd0c84c455fe67250990e6c81e3654b9ddc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861201, "uuid": "5760eba4-f086-481a-b6c7-b64b9f5764f9", "value": "B314AE9DD729E464FAF3D9F104359A1210BB6C48492F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861201, "uuid": "878f31ea-20be-4f6f-a043-5ab720f98309", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861201, "uuid": "d0e49e74-8043-45f2-b508-6ad2541566df", "value": "3072:p1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615861201, "uuid": "4289101b-5c87-4e4e-960f-47fd26d50810", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615861201, "uuid": "58b91fb4-f095-465c-b2b4-32aa2db2eac7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861201, "uuid": "01e3a4d9-3dc5-4283-9466-cf5b1bfdfc7e", "value": "2caca542def60e677837de19466eda0c4ce3dec632f196bfb0bb570ac5f4f7cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7c2235-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890135, "uuid": "72a5d0b5-edd0-46c0-9a55-b39e5da8a759", "comment": "Malware payload (Formbook)", "value": "0c1251a141de08d95ddc89b8ef3e86cd", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890135, "uuid": "93c35471-bd74-4a91-ace4-24f9bb73fb9d", "comment": "Malware payload (Formbook)", "value": "2d18905943c2726125187f4fb812567fdd6b6855704da868bf1c3b295f9a530d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890135, "uuid": "70966544-d1d4-4286-8abe-6a6a12672b86", "comment": "Malware payload (Formbook)", "value": "f33c5a7bc3fe28f21ea43de422fdab9e04b8e0fa", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890135, "uuid": "1fb4e63c-8835-4b6f-b21e-3a7cfadad78b", "comment": "Malware payload (Formbook)", "value": "afdfcc8724e72021a1658f7bf6359f01ebe48cd223d599ad48d34df03b8e1206e640fbb703ab61df930100368fc06a0f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890135, "uuid": "9c4c76f6-e4de-454e-bf1e-e918355be38e", "value": "C1C4231F84150267D48860FBFFDCC5E1D5235BE8880BB6FC29A078897AAD3D999434DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890135, "uuid": "40efeb3e-6241-4c75-88d6-fc602717dd47", "value": "12288:D/3i+KcCLe8hAoDypVg3SCefP82pptW4JYtGZ:T3iMCLtAJpVSS5Xp/E4JYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890135, "uuid": "40a208b8-9ed6-4f3e-9270-669b0e58094f", "value": 549572, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890135, "uuid": "9a47c69b-14d7-412f-95a0-38c95169073a", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890135, "uuid": "e4ae3b93-297b-40ae-88d1-075c5ddabe56", "value": "Fujitsu Solutions - products list.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d52620-8614-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615870778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870778, "uuid": "e9e0c077-4a2a-48ba-8a12-2a2dd7bd71aa", "comment": "Malware payload (NanoCore)", "value": "75e169e39f36791ce29a6812793a7973", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870778, "uuid": "d216e4ea-403b-4fd6-8831-e0dcd4190d55", "comment": "Malware payload (NanoCore)", "value": "2df55ccbab067e73a2fa36685a48b14d0897f845b7ff25abd75f609fd0dbe415", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870778, "uuid": "32ddae7f-be2c-4aaa-9f25-ea18bf3980fe", "comment": "Malware payload (NanoCore)", "value": "b207a8080f4810b0f01963ec99af80871ef85adb", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870778, "uuid": "a4069b2e-e255-4389-ab34-6c398ead56a9", "comment": "Malware payload (NanoCore)", "value": "521455c5715a3990ce4552473d576762008821fea4dc71ce1befedec9d897616d256024a595a388295b720c18ccdbbc4", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870778, "uuid": "7293f7a5-34fd-4ecb-9075-c9fd31146ca7", "value": "7B759C4AFB54AF96D12D0F7AC417842C83F48157A3B7F35BBDD0A8E61824B1A4E0F496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870778, "uuid": "2d2c35de-f00b-4fb0-8149-0d096d0e9140", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870778, "uuid": "e247bc35-7686-4371-8e58-bf9194833513", "value": "24576:IBZnFp8Zs75Jdn8lWqeUayGz+uDRxAwuaWwyUyIYPyOVvxCZDTYN:IB98Zslf8GUzGzDRuwudfRPyICZDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615870778, "uuid": "177519a9-0791-4c9d-a811-bff36e1380fe", "value": 1595904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615870778, "uuid": "c8fef374-fb34-444d-b499-1dcc97936a24", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870778, "uuid": "ae289e5d-6918-4063-9060-75d74ac812e1", "value": "malwa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4cec70-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615918134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918134, "uuid": "da29d8b0-3fee-4743-b874-4c7fbdef081b", "comment": "Malware payload (AgentTesla)", "value": "da63c0f7db7c034b71c1d4d9e3388627", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918134, "uuid": "c5fb6101-0a78-463c-9fd2-2da47185c90c", "comment": "Malware payload (AgentTesla)", "value": "2e8f215d9dbdfd11835588ca62f75754b925748e0f7a8e604a8b44cc5fa7f338", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918134, "uuid": "2351ab62-b09a-4b54-b8ab-4e2f5e697491", "comment": "Malware payload (AgentTesla)", "value": "9867e8ec92596c62e19ba938f5a8e7c939306d47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918134, "uuid": "5eb03f6b-c789-4822-8833-aa75c3c332d0", "comment": "Malware payload (AgentTesla)", "value": "63a871025281726fc55e522494fc5666649fecf08372503812996064b79d59b5f555b34da0b05b261acb7d72835ae207", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918134, "uuid": "22625281-0bce-4130-88bd-53678646216f", "value": "A4B4234E3BE45FB3E0A356B91A85B453907DBC1D33C2D149F42230ECAC74362AD9E19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918134, "uuid": "425feb82-9d0f-4f6d-8b25-fb6fe52b96ef", "value": "12288:U1ugnbbbApDMxFJGcbN8NKwAmLoBvok1DUs7l:CuPGTx8A06vBUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918134, "uuid": "d617a1d5-13d8-4cff-85df-a95647a310a3", "value": 499200, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918134, "uuid": "6add032a-0e83-4886-9b3f-e9eb558aab09", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918134, "uuid": "062f59a4-553c-43e6-b0a3-17580bd90e71", "value": "Order 2550619.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41361ed7-865d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Qealler)", "timestamp": 1615902064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902064, "uuid": "95eae806-9890-4254-8324-8a43e1a647e0", "comment": "Malware payload (Qealler)", "value": "426ce0823c081d2f4b9c491d9c302e77", "object_relation": "md5", "Tag": [ { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902064, "uuid": "7afbd1e5-b897-48c8-81e9-ea71e6b6f69a", "comment": "Malware payload (Qealler)", "value": "2ee0099bdaba902f7164feb1bcbf9ef9d7d610252d1584dc66ab50d3bdd45772", "object_relation": "sha256", "Tag": [ { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902064, "uuid": "80096112-b134-499f-bf66-e9b563d0c585", "comment": "Malware payload (Qealler)", "value": "2ff9203616818c27cc1013c7ecc7bedddccf1777", "object_relation": "sha1", "Tag": [ { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902064, "uuid": "25fb197b-c315-49d0-938d-043b4464a7fe", "comment": "Malware payload (Qealler)", "value": "94cc7ba4375468e87ea1e224b33dc294101aee3fc27689eb6a1b06bb23cd214f2fa06b28c74700ec668205786c108271", "object_relation": "sha3-384", "Tag": [ { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902064, "uuid": "f3f06222-8d4f-42f8-81ea-b878ff138839", "value": "27C48D68398E905BFE73F6B3300BD136B40EB948B90764272E90068D4859DDC5FA5EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902064, "uuid": "7aace0cc-fc95-4344-acf6-37d31e05153d", "value": "12288:WWSvgIUh7EbT48g+EpV2Jmq1ZxTVyOxvmfZllbiB1rvREvUHjBypXT5jVcUGKYhB:Xq4bGrNKKTnCXk5RWK8Oau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902064, "uuid": "3deb4457-9a31-4818-9944-43b7f6004568", "value": 561611, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902064, "uuid": "18d882ed-e612-4b4e-b350-4cb20f8557f1", "value": "application/java-archive", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902064, "uuid": "1787b24d-38f9-421e-a12c-bf50a83dc7d9", "value": "Remittance_003051_202028364-POR.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337080cb-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906766, "uuid": "9690403a-95f1-4ecb-9194-9fcb63a0d777", "comment": "Malware payload (AgentTesla)", "value": "4c4218797dfd51248a356608849f9d42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906766, "uuid": "3c660285-235d-4e67-b131-6a107e464dac", "comment": "Malware payload (AgentTesla)", "value": "2f1f7ddd6a6d6f7e562d163dc3e8a7e6aa04b2fbf4ed879d8f58100d3fecdfa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906766, "uuid": "a564bbdc-ddbc-46c8-8d3c-c744e5f8493f", "comment": "Malware payload (AgentTesla)", "value": "a343152b8e1157fe25e9a03bd2f189428f86058e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906766, "uuid": "a0ed66a9-2c6a-4ec2-bb0c-1168a6215e1e", "comment": "Malware payload (AgentTesla)", "value": "ad51482b81f47c8bb28e280dab00a763f899e39e101f1cf51b2b1cb61572ca1b36ec8e89d6f6f9c945409fcfacb68dcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906766, "uuid": "8fe4942e-c89e-4d3b-9261-229af922849a", "value": "93758B22E694AB74F07D73354931133183FDAD429222DABD7E9872D909756C086F3EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906766, "uuid": "747a8690-1ada-4a03-95ba-2c8f79287947", "value": "12288:KIGa6QbNYGJ3tR+Kv5T7R2BgAqvNANQmzWKP03a0YZtzt3QE1:KIGaHBYGJ9wKv5PRaIFANzWKM3azQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906766, "uuid": "37ee7b56-2b82-4b2e-b03e-9791a742fc4a", "value": 1638400, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906766, "uuid": "fdfba1b9-505e-44f5-988b-fa82d44db5e8", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906766, "uuid": "cc863e1d-8686-47e5-840b-cf9a1720ae64", "value": "IMG_20210316_0001.PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239be1ce-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615893854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893854, "uuid": "95229d18-8fa8-40a3-b264-20daed2a7e02", "comment": "Malware payload (Loki)", "value": "a3e1a1e95124a14c1cda6e2653ce4ab0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893854, "uuid": "daa91b1f-a3ad-4478-a89b-1d7e373899af", "comment": "Malware payload (Loki)", "value": "3005d348dec402dc4d89094a2ea22c963dc981129cfa675926aaabfb3e160a7d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893854, "uuid": "b2cdf055-98f8-474c-b785-25c40f1084fd", "comment": "Malware payload (Loki)", "value": "08c86a438960da191a299e70363c0f7174440a5a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893854, "uuid": "e3d7cc23-0e6e-49ff-8c7f-f6d65c3da209", "comment": "Malware payload (Loki)", "value": "c67898bf26a9b15386d7e87633dd7011ec7076c6426a61cb6263017a53861e3e25e172bf1102971a9f559f3b15f5ad55", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893854, "uuid": "de50f1f1-8a7d-4af8-aac5-c9b93bf4747a", "value": "9355401316F4FE24D27D7270DC77500986ECA1729338B469BD4E33868A6FA404F676AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893854, "uuid": "99a4f95f-5b88-4aa6-ade8-a9f7c7370eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893854, "uuid": "14d0f0f1-3a9c-4fd9-9973-16918f034721", "value": "12288:2fviXOtIh0RToVGDC/ygsyB/su508hdM45y9MCJpOnetAaCuLu1c/rcFMIizUp:2msyBku5jgMCrOetAll2/OiQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893854, "uuid": "489bc046-9220-4e92-9aab-c74217e7e32d", "value": 1349120, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893854, "uuid": "471f8eb9-30b3-4c3c-8132-8eefc42da6df", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893854, "uuid": "32607927-28fa-4e71-83bd-13b22810a2a7", "value": "CORRECTED PROFORMA INVOICE#8349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c979b0ba-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615876094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876094, "uuid": "c51cee35-3b84-485a-bba7-5ece6ab8a512", "comment": "Malware payload", "value": "9bdc3104c189660f2e9e4b72307baea3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876094, "uuid": "2b202625-79ce-4dfe-a4a7-b36f764fc10e", "comment": "Malware payload", "value": "31774d7c01c8f9e15a2e4de37edd51c2eb82a537a81f0c23ce9edc3acd147c12", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876094, "uuid": "4ea4b08a-f73e-4a03-af58-7388ecb844d7", "comment": "Malware payload", "value": "07eaf4514068fafeb2044ff5f7345cba402d52d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876094, "uuid": "c080b9ba-fa2e-4e52-b0c4-13843e68cd45", "comment": "Malware payload", "value": "72de0d9e5a408be30fae572060b7c69a621e760395a11f361d85579b2bc55a4be1d293515627bee7240dee2b37001302", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876094, "uuid": "4fe83e83-4b18-4b73-8af4-d490999dd032", "value": "18938319F591D91FC3581A318C8EDEF6A1247D48AECA631B73A17B7E1E3BF249B01214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876094, "uuid": "2863337e-1a4e-49ff-9f0e-0985036aa003", "value": "768:HKO7ED2p/VgEL48vNGs40KuI6VVUutz6P9aHiy0+r4dLWdi1GIsl69:q8E+/VgELakG8z6P9Miy0+kdKl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876094, "uuid": "8571c78b-0fa9-46e9-8237-b378a926c135", "value": 94720, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876094, "uuid": "bccc3a40-86f4-4542-8527-8ec10dfbd991", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876094, "uuid": "54a2a2e9-f9d1-46eb-a598-a33b66fc8d1d", "value": "RFQ 8388292 (ORDER LIST, PICTURES & DRAWINGS).ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cbe46d-8606-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615864897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864897, "uuid": "8fa26b19-a33e-4718-97da-f95ee0381605", "comment": "Malware payload (Dridex)", "value": "6ca775dba89c7c81b92ca5384e68daa9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864897, "uuid": "f0dc3c1f-2dd7-4732-8c89-bb43ddf1fac0", "comment": "Malware payload (Dridex)", "value": "31c4f71fd0248b64f198161d933c892e2a60f837eda262a6eaca1ca2af465808", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864897, "uuid": "6d6ae535-ece0-47ca-97f0-5a011775dd7f", "comment": "Malware payload (Dridex)", "value": "5d32e827e8293fbe1f9eee4e7b4d1129f93451dd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864897, "uuid": "3b626c65-9dcf-475a-b262-34ebb8a86fe3", "comment": "Malware payload (Dridex)", "value": "01571c21adf4f66e42976a115fe9dd96c428e7e8c805425c9637d36be8cb4b9637bfcd3e890750f71b24a00b4365ee46", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864897, "uuid": "b7472fed-2366-4ee2-b528-aaa85e1a68ee", "value": "2E14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864897, "uuid": "a1c1dcf9-b5b6-4510-8d70-dd793ff26c34", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864897, "uuid": "84be3517-4303-4d35-afd4-2604ad80ef43", "value": "3072:p1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615864897, "uuid": "598abc99-a643-4adc-a4c9-65feb11df4b8", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615864897, "uuid": "35382e09-08d6-4b36-93b1-eb5ffcfa9994", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864897, "uuid": "5f3a469a-b163-425e-b638-596c92829a5e", "value": "31c4f71fd0248b64f198161d933c892e2a60f837eda262a6eaca1ca2af465808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2dd855-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615921623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921623, "uuid": "84903718-2b75-482a-a119-e168fe1c946c", "comment": "Malware payload (TrickBot)", "value": "4fc9c825d7f504f3db1608bc014a44e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon129", "colour": "#82ED7D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921623, "uuid": "75b93f2d-f928-4fd2-818b-60e4f6311df5", "comment": "Malware payload (TrickBot)", "value": "32682ea9ee36a960cf405dbcc69d9140e82c07494f66b234dd6eca1a72a4d398", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon129", "colour": "#82ED7D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921623, "uuid": "44901667-6536-42e8-9058-62341c1b2995", "comment": "Malware payload (TrickBot)", "value": "d572dd11bd04295c98ced1e8f104c15613919194", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon129", "colour": "#82ED7D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921623, "uuid": "ba5c2efe-a1ae-4079-a01c-79c98cd540e4", "comment": "Malware payload (TrickBot)", "value": "dbb96a6bc983f51f369a7401dd174c967f8daf0921377c7431017b454f4843309d0af514e2e8211a8fa78a0920f5c00d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon129", "colour": "#82ED7D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921623, "uuid": "a9f22c1f-3b9a-45e0-bd1c-bfcbc9c15ba2", "value": "9EE46C8EE062C0B1D07960B4AF165B35919DDAD13E2F898392E4FD4ADD237D1869F3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921623, "uuid": "f5eb0448-4975-4f63-8cad-82a1717dfad8", "value": "25a3bf96f64b55a69d3aaf04f6c99acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921623, "uuid": "98274af2-ace1-4f8e-9ab5-f17682bc8375", "value": "12288:G+QjOdLU2K5HmTbKbKKMFZys7tmwp1vWXZt+jztlhkLOMcZ6IlA:t/LUfU6Mjvp1oZt+XTMli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921623, "uuid": "df052141-16f3-40a9-a97e-7b88174bddde", "value": 675840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921623, "uuid": "f4dc50eb-78ac-4366-8eca-de676140806d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921623, "uuid": "6edd6d56-2276-4a20-bbf6-71fdb2dc238d", "value": "4fc9c825d7f504f3db1608bc014a44e4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f908335f-8613-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615870590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870590, "uuid": "a48ee868-f0bb-40bf-b0de-bd08ca5e98ae", "comment": "Malware payload", "value": "cf160267cbe5985b5ee83bcc7ab518b6", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870590, "uuid": "41413012-07ac-4cbb-bc36-6e7724f5996c", "comment": "Malware payload", "value": "34149ad3f313277fb264da374816b5bf25c02811c8c7a2ccd4efe339bdb2018d", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870590, "uuid": "c85af591-385e-46da-ab71-07251ec377e9", "comment": "Malware payload", "value": "9f4d129cd181358fad25ce565df5e7e6ccb551b7", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870590, "uuid": "c7ab0ad0-671d-4ed2-b4be-1b53c812a235", "comment": "Malware payload", "value": "282f5ec36c6f11249286ba103520f63150382a93263e789a9df0ac7d1d02da6e11521dfe4ff4ff6dac81da1c7b01b46e", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870590, "uuid": "d00bb847-9098-46aa-ac14-77e0bd49fd3a", "value": "B24302E3A3B48A3A666D2976B2C0DD2810DDC0CB36876DB44EED5D9C5752250B0E1FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870590, "uuid": "6b6c92ca-92b5-4d27-91db-ea2c3a02e227", "value": "1536:HKs6ilajbWebl+5A9tGUqeLw3mZUr4jLzd/xyGrUbeCvyqp:qRUYbJl8A9tGUNL1FLB5yMwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615870590, "uuid": "dea7a95e-335c-4afd-9859-b664214cd30a", "value": 58020, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615870590, "uuid": "987307a3-e80c-4445-bc4e-1154c8f601ae", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870590, "uuid": "9917f274-849c-4323-beac-f1f5e5e40a55", "value": "conto_2837.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e966873c-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615922533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922533, "uuid": "c5a90a3b-366d-4214-89c0-676887bbec1a", "comment": "Malware payload (GuLoader)", "value": "8d2ee34543afa9e564d264108c723b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922533, "uuid": "cdd68905-feb7-4db5-a3f1-8ea44c033a54", "comment": "Malware payload (GuLoader)", "value": "347e0a3158914fee15d4f43ab5f855e827f6af9487620c74dd7c9f34b625beff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922533, "uuid": "1e1632d2-6953-4577-aa60-b5f25384c2b0", "comment": "Malware payload (GuLoader)", "value": "63030c5aaaef95c4028d0c20386b04c685c6d866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922533, "uuid": "8023584e-ab2f-436f-a552-8efb6dd198ea", "comment": "Malware payload (GuLoader)", "value": "843e49b13fb58407d3c18991790e05b944e8defbaf5d613f5edaec3e4f88c958b45dbcc472908c67226e971ead10a8bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922533, "uuid": "a22ec8cf-5480-4b58-a1a5-d87d881f1323", "value": "51E36B43B2045C7CDA853671011EEAB53622ECB15050AF6771E87E2BE97D2C13EE6F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922533, "uuid": "5f3b60ab-cf9b-412a-8eb0-181d5f9f662e", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922533, "uuid": "d1011da9-4e5d-4f96-934a-e147edc74c32", "value": "3072:NOP9AfZYpI4YYWoxOzBYYuut5D+fdspxaL4rmP1:mKn4YtoxOzBYYuut5D+fdspxaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922533, "uuid": "9f1cef21-3ecf-410e-9491-95c5352f6104", "value": 151552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922533, "uuid": "e31e901b-ac1b-4236-bda6-b2c0b26ec52e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922533, "uuid": "6dc62a08-3d07-48fe-8d5a-0390301a287f", "value": "8d2ee34543afa9e564d264108c723b99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca0a8bf-862b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615880904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880904, "uuid": "b24aeb95-ce15-4774-bef4-32450c0fb615", "comment": "Malware payload", "value": "26fa2668bfba3e34e794ec3465d02bcc", "object_relation": "md5", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880904, "uuid": "7a0d32b0-ede9-481d-93b3-6cc961cd1ede", "comment": "Malware payload", "value": "351adf1c9809c0f91c4ef70dca23fef2fc9053ff7c6836a096c3e57fece0c389", "object_relation": "sha256", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880904, "uuid": "b5d0fe96-f757-405d-aa63-43c80fd2641c", "comment": "Malware payload", "value": "d8facf9622b07a454991695ca9dee0f1818963c7", "object_relation": "sha1", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880904, "uuid": "0e1928cf-51e3-43ae-adae-31a309e688e2", "comment": "Malware payload", "value": "494766783219f0fce6653953065930c6b26be45fc4641bd12ec141e96b8a7b1ebe3adf18c5bd8f61e3652ecd05b339cc", "object_relation": "sha3-384", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880904, "uuid": "79a5fb6e-b42e-4938-abe9-68d4d845561a", "value": "4A86E02AB244653EC0EB1A3A5937A7589D3FBB716A128D5B06F408CCCF395406B3F617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880904, "uuid": "36dab432-7326-4e09-8067-a47517677955", "value": "4a3178cc79f4ca3aff30afa6c9ea313c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880904, "uuid": "51a3a9e1-ad38-45f3-83ed-dd9a0a219f74", "value": "98304:81JdhQ2+rzBKjbr1fSv6tuAbHvWaZSEj26YaMe1CxwbWNO6CPC3tuBhvph:YLaIZfXuAbHOazca/SNp6LvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615880904, "uuid": "6160025f-7eea-4564-84ef-298b5a6607e2", "value": 7950752, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615880904, "uuid": "8e84fc5e-5172-4ebd-80b2-b0af516541c1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880904, "uuid": "4820a9a3-738b-4c8c-86e3-d087d3c87d01", "value": "351adf1c9809c0f91c4ef70dca23fef2fc9053ff7c6836a096c3e57fece0c389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e9fdb1-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906738, "uuid": "e3ce0151-7932-452f-8b59-2244d0b96fe0", "comment": "Malware payload (AgentTesla)", "value": "df62ba1bb3e2ae0d2dcac0bdc65e2c2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906738, "uuid": "de4f0f39-b6ea-41b7-9c95-81c2c783092c", "comment": "Malware payload (AgentTesla)", "value": "35ed71fdacf39efff768e4107a0ebe0a1d298ec53742e22236d918b80bafd272", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906738, "uuid": "10e646ea-990d-4300-911c-177c96490840", "comment": "Malware payload (AgentTesla)", "value": "d55e1d9a96dfa890384c1ea556212c6c01fceda9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906738, "uuid": "5450f1e5-c110-4a68-bdb9-36df12b4f1f3", "comment": "Malware payload (AgentTesla)", "value": "e63b872ce69643c2c0678e4ed7bf27894258106dc7f3f4aaa62f05f717fcab2dca1b206b0f1cfd3bbb4d9793c85692b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906738, "uuid": "7e374c99-dffd-4de6-9b79-d12b4b3eec72", "value": "B615D099E5584D53CD1CB7B810A31D2C8B777D6AE974E28E6C8A34F422F3AC324619C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906738, "uuid": "2f59b711-055b-4a5c-a40c-a1a01caf601d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906738, "uuid": "f041a521-1f95-433b-b0cb-8c74152749fb", "value": "12288:/v3esDFTAlTzmeEPSdtRZS3rm5KNJi0kAC1JeZikSHG60JbaJ/sGPs61x0/MlrlX:/vUE+t7seK3iFd1JeZEHSJuZ06trlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906738, "uuid": "11c06849-f7d7-4639-80b1-54e9865cd854", "value": 884736, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906738, "uuid": "10dfe46e-b3e4-4f8f-8753-036b1d0e2ad1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906738, "uuid": "0e8fe096-f44b-47a5-bc72-282bb1d3121e", "value": "DUBAI PPMC HCU217ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99a20f5-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615918614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918614, "uuid": "8ccd3a72-110a-4d3b-8d19-56af4cff81d3", "comment": "Malware payload (RedLineStealer)", "value": "ac2449dff42de275b914e70a40d221ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918614, "uuid": "ec11078d-3a66-4cc3-86b0-4a81f73eae4a", "comment": "Malware payload (RedLineStealer)", "value": "369e3c4b6730652146d275cd3db45eaa369c25fcaad3b11cdd3844878193768e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918614, "uuid": "5f5e011b-d2f0-4a7b-bae2-c111284d1ab3", "comment": "Malware payload (RedLineStealer)", "value": "d838b04648791d198a8c9a2438cdc84fbf231aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918614, "uuid": "de839270-678b-46fb-a658-499d20c1cfcd", "comment": "Malware payload (RedLineStealer)", "value": "2455290faa444de7fce36c0de0546e739897895307e2a18451560c19b0498286ea907596ad9c3350de39b39eeb6b98ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918614, "uuid": "ba254a08-07e7-442a-9cd9-92c9b01da10d", "value": "FE94BF31E7B1D038F4B305B14AB686B8B9357931573894CB62C13B8B6A386E6DC31B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918614, "uuid": "f215a03f-973e-4e78-b9f3-6cc95ffba4ac", "value": "729cfbd9792913a5ac829cfac110b85c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918614, "uuid": "111c8050-8f10-4589-abbc-919cbd557cef", "value": "12288:EN9bPDdhlZXA7gCN5bBnXi74yzkZhQAwLMMMMiMM:ENldDCgCXBnW4BhQAwLMMMMiMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918614, "uuid": "28db8590-c1b7-4878-b420-058f05d978db", "value": 434176, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918614, "uuid": "22fa604e-8aba-4756-a373-95f0c84146ff", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918614, "uuid": "7b0ab2a3-aac8-47d6-abb2-67fef3ed49f0", "value": "ac2449dff42de275b914e70a40d221ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bc9f9e-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615922443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922443, "uuid": "d7c20d44-7c87-4c6d-8569-c91803872394", "comment": "Malware payload (Loki)", "value": "6e1b5a8549d3b44bf15ea19d83ecd759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922443, "uuid": "0dee68f1-63e3-4a57-be27-b89480f2c12b", "comment": "Malware payload (Loki)", "value": "36ac5f42c407c585365c6e24107d0a03d1ef4c2955cd0a5b921c275dc0427b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922443, "uuid": "068980f0-5fba-41d7-b7cf-ebaaaa8ae33a", "comment": "Malware payload (Loki)", "value": "1cad77eda8d4209900dc81d17104092e602f6c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922443, "uuid": "8758c7e8-ebbb-4e98-a57d-3fd29ade96fd", "comment": "Malware payload (Loki)", "value": "1f02e21c8c010616264013eb1b9795ea509bbd3bba3a240bdc7b0c8e6b28bc5760e738a4239aa480a0fd3eb766fd928c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922443, "uuid": "1e8f4a9f-82ad-452e-94dd-a5fbe12fb9fe", "value": "A60501262398EB61D8BD577804B1450413F6FD0AEA63E78E7EE531ED2A71B808677313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922443, "uuid": "2b3d8a80-744c-40c0-a489-3926f38733a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922443, "uuid": "b3d0d54e-14bd-4e98-b55b-c7de522e08b5", "value": "12288:ldYR4l277/vdlZR1iM+u9t+3q24oB2Qa/0N52ivHUZWdkcU1v3QVcLAc2wmiJCsd:lZEXRGat+3xB2QGUHU14VcLN2wX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922443, "uuid": "ed7edcd2-ffa7-475b-b1d5-1d2b9771b567", "value": 804864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922443, "uuid": "43d62df4-ffb1-4401-9478-ddc9c929a484", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922443, "uuid": "d51474f5-892c-4bff-a76d-f88b2a6586fa", "value": "6e1b5a8549d3b44bf15ea19d83ecd759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c9bea0-8679-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615914125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914125, "uuid": "02c42e0c-2e36-4890-b1ba-55549725e503", "comment": "Malware payload (TrickBot)", "value": "4d06677488e8599c6573a75697079ced", "object_relation": "md5", "Tag": [ { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914125, "uuid": "d6cee430-e7a9-4bbc-9b95-aab20b5a0ccc", "comment": "Malware payload (TrickBot)", "value": "3812b84217cccc7c77678ef2dc90ca48e8372350025ef43ab4c711fa5d9974b0", "object_relation": "sha256", "Tag": [ { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914125, "uuid": "89a0d8d2-e44e-4263-86f3-123502ce5265", "comment": "Malware payload (TrickBot)", "value": "54507c755269f7608fa0251968fac3496f573e60", "object_relation": "sha1", "Tag": [ { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914125, "uuid": "c97bd486-5b47-406f-bc69-5079176b1f96", "comment": "Malware payload (TrickBot)", "value": "444da6ee0172b67e5ea0a84e0b745f783462b5bf7be430aa814f8907ba835491f7e3d5b2adfc124762452ef9f319f026", "object_relation": "sha3-384", "Tag": [ { "name": "rob78", "colour": "#504624", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914125, "uuid": "94185928-8721-4e1a-be01-59501874fbf4", "value": "67E3020E1A11BC22C398033894A7C7E3971A717FF372E55AB94CD8392F60BD56E1D58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914125, "uuid": "eb7f99ba-e4c0-4aa5-818f-57b4d5ddd9ec", "value": "3072:Fa6XpupSzxNEBBD+Os7/xxkKCtRbsYO1entseoXXw:Fa65GSzx0dmxk7RbsYsKtseoXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615914125, "uuid": "e89cecc2-ff6a-4ebf-96dd-f08208e703bc", "value": 152897, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615914125, "uuid": "d9019a2c-4350-49d1-83be-ddeb76ee19cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914125, "uuid": "b63f1848-e3a0-487f-9aaf-b6f6bacd5f66", "value": "DETAILS_682771212_1726618293.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788b7228-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890131, "uuid": "32e8a4de-1491-44b0-875c-dbfa9f783fbb", "comment": "Malware payload (Formbook)", "value": "7c2ee73e174730cae4c500f6537b6842", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890131, "uuid": "f22778e8-1f8a-4f6f-8eea-2efdaa5ea662", "comment": "Malware payload (Formbook)", "value": "3890c59b3745da2f923a62c53e299e35eb44e1cb49da0e42619e7127f0461cc6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890131, "uuid": "e4219514-8ae1-4bb3-be91-0305ec37d014", "comment": "Malware payload (Formbook)", "value": "8acaa733f7ab5d7c4d399eda23744ef1d4f03695", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890131, "uuid": "133279f7-b760-48c8-8517-333807409ffe", "comment": "Malware payload (Formbook)", "value": "7735a4198be6790a7fe792064b40ffc5be085411fdfff37d7c6f111f171849d4469bc01df34d1fd84ad7696c09d5ac4a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890131, "uuid": "db5223a9-0225-4a6f-833b-405ea60f4925", "value": "BAB433AC5145705B3ADA183AB31CF78E1BB8C0B7E06E1AC236FAF54254C5D729A4DC39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890131, "uuid": "d843eb27-b706-4b78-84c8-189a6aef7fa6", "value": "12288:FbcXh1hF/BuFQDmzdxZ6rDLg361losRA4v8ocImln3:yXhZwZIrvjwsRA4lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890131, "uuid": "488aa31f-de5a-49e9-b820-0939d90aad50", "value": 507648, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890131, "uuid": "ea8ee5df-7a8c-46dc-827b-74dc5921bff8", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890131, "uuid": "60684a1a-6e50-4540-93bc-1b2de1a446dd", "value": "RFQ for Machine Vision Semicon.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf918d2-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894835, "uuid": "47b4669b-15aa-4a56-9388-d9a164971500", "comment": "Malware payload", "value": "95d929168518df6889acae5754c39f21", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894835, "uuid": "459141a7-db2b-44c3-bdf1-6925bcddc311", "comment": "Malware payload", "value": "3910712a1dc932f0850378f1c4f80022ea1dad38a43c6a67eab53d2c8e577b8d", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894835, "uuid": "665615a8-be21-4383-a603-16e4278e5f9e", "comment": "Malware payload", "value": "22e6006af24d3aefa247cb6e25ed734ac99b8491", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894835, "uuid": "5542eac6-f5ff-41aa-a5e0-82cbfeb65c86", "comment": "Malware payload", "value": "461b599c1154d76bc56ebbfcb6586ba9bb8dc22830f8c98069c4a2c9dd91730e877477629fbee47017c13910565dd5f3", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894835, "uuid": "f991301b-8559-4718-9180-4c9918e23df2", "value": "92530267B53CAA0F0161C09B71AFB275336C9ECAB4B9311A5550D7E4062E07623FAFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894835, "uuid": "cab4436c-93a6-4d1a-b06c-f6b066b056e1", "value": "1536:h5MlmgYvDn+d9VlNuc0QZ/WJSa1GBNHEAfGVieL:hOz++bYE+JR1sNkAujL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894835, "uuid": "a47ed4f8-09a4-4d8b-9bdd-a6a21b6df66f", "value": 62858, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894835, "uuid": "10b0eb4c-49da-46a8-b61c-56a562c1fa4c", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894835, "uuid": "f0752ad0-ad46-43cc-aca2-d15588574b10", "value": "contri_2968.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62edda4b-86a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615933904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933904, "uuid": "aaa273f3-4445-4aad-86eb-c541e5902f2d", "comment": "Malware payload (AgentTesla)", "value": "77b7e4d60f851f41c2040a287e0fbcbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933904, "uuid": "7b039855-7bb4-4b03-a805-f7206300aec7", "comment": "Malware payload (AgentTesla)", "value": "393581c18056d7a4d1f141bbdff6c4d9006c1d15443ec16567802b37209e7720", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933904, "uuid": "69748cc0-6355-42fd-a060-89ff6f5c766c", "comment": "Malware payload (AgentTesla)", "value": "af7491cd3ee92bdde8d8509c4c4b074be4a72fe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933904, "uuid": "b28868a8-40db-4371-be8f-d2ad8d9fc0ba", "comment": "Malware payload (AgentTesla)", "value": "a1318df039ddcf28f150c9f4ecccc48e73f4437561ce89a7e5e6440ed37feaad3707750563fd0838c703184ee2a3ff8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933904, "uuid": "bf33327c-6173-4ffa-a458-5dc707af5e20", "value": "8805126A7731B6DEC45752BA6EE00F65AB50E155072BD313AA13CA3CC88D8D3CB513B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933904, "uuid": "9653ef95-b473-450b-a804-d23bf63dcba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933904, "uuid": "1aab40db-12c7-411a-ac90-c0ecb9086e70", "value": "24576:RJYHW7t6E60cMaY502qwl5Q1Ye3NAEkPNtu8I:7eW7tjvcMjZrQ1rMtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615933904, "uuid": "6e4323c7-3613-48db-94ea-1ae8f9e47521", "value": 859136, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615933904, "uuid": "da5efaee-274a-4dc6-88a3-9c4ac0097210", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933904, "uuid": "159840cc-f940-418c-9e8a-f6ef130f47ce", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.5044.4422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5eb46a-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615884637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884637, "uuid": "ce3a3fa5-7288-4c60-abfa-876ccc243454", "comment": "Malware payload (TrickBot)", "value": "d8fbf9107309000bdd8ed618c20690cc", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884637, "uuid": "3278d959-ae7e-4727-a3d0-170718b27316", "comment": "Malware payload (TrickBot)", "value": "3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884637, "uuid": "9ced4ef0-05ec-4fa7-aab3-fa61e1f8947d", "comment": "Malware payload (TrickBot)", "value": "f80d082737757b3b3472f2cfa3abdf0d0255bcbe", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884637, "uuid": "74990075-a038-4ff6-b601-e93b0f009ce8", "comment": "Malware payload (TrickBot)", "value": "b8f0b054dc3a3e06ca220b0fc27fa0c53fa5e72d475f0362f84a00483aa1936530eb820540248541614163858bd19d53", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884637, "uuid": "8e7c12d8-f02d-473c-9a3f-1ba4a26b5f63", "value": "26B4C030F9684802C8ED1BB36CA5FFC3E43D93AE2F527657F77C4A8D96508616286613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884637, "uuid": "c3aeff0e-dd01-4c2a-9ad8-c0bd16f07f4b", "value": "b5c8d37549a784c0c565febea0373025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884637, "uuid": "6f101d40-2c89-4df3-8ff6-922fa1bcbcfa", "value": "12288:8gNf8MMYejGMR3BJHCnTsAe3G93/A39/L:3uMMljGMRRonTDe3EPIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884637, "uuid": "c2193363-6e89-4998-bc06-f6e608a3c431", "value": 495616, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884637, "uuid": "93e10b6e-19e5-4f09-b279-5c4c718bf3f3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884637, "uuid": "f8697da6-1018-4b88-919f-30638f39e90c", "value": "SecuriteInfo.com.Variant.Zusy.370751.7551.3147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5bde94-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922082, "uuid": "1b7d07a9-5960-41f6-890c-ef5640b1fb90", "comment": "Malware payload (AgentTesla)", "value": "98cca022bc2fa5a6239634225f3abb1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922082, "uuid": "747514fe-9bb4-4444-a78d-1193771df799", "comment": "Malware payload (AgentTesla)", "value": "3a653867bb586489975da401f7f434fc1b09c228a02873b495e49ed9685c38dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922082, "uuid": "f18d9447-0fe4-43fa-b93c-e37547d416f6", "comment": "Malware payload (AgentTesla)", "value": "23d9a4eaa077e875ff45cd006336cfd09b8d5a54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922082, "uuid": "938a9931-3b30-444d-8a62-a9c1798a05d5", "comment": "Malware payload (AgentTesla)", "value": "4073424278883ef542d41a60c44d49a76b78255e114d95011b979c02fcec0c03ca486b3bc6b51310ffea15f9198330a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922082, "uuid": "36b2d7b1-99d9-4d74-90a4-dc2bcaa8ba2e", "value": "FE257B203EA69035E432DAB74BD661776D6DAF263B01F4F93E7073C60633943A9D1229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922082, "uuid": "0873bf94-56ea-4b80-9ed4-02b24a5c9801", "value": "12288:JOVs4iLOIu5HZr7qzJhdGwTXTjweCvgLrFgLjbw8c7w2pLPywQfByKA9SwCO8:W5HZr7qzkCXTj+vqrG3bws2d5+ByD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922082, "uuid": "7ffd5cfb-9311-4e6b-a7af-a4b41455657b", "value": 1008640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922082, "uuid": "3a6971db-6496-46cf-99ce-07d107e21287", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922082, "uuid": "766df00f-a789-47ff-96ee-b4e7350acb6c", "value": "98cca022bc2fa5a6239634225f3abb1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51d1ed1-8667-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1615906661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906661, "uuid": "07f3895b-a8dc-4199-9a96-bfcb2fad1536", "comment": "Malware payload (AZORult)", "value": "5d86b7e57a49db2cd1c597b02c3deae4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906661, "uuid": "51a9680b-7a5f-4541-8404-e5ea14239524", "comment": "Malware payload (AZORult)", "value": "3acf3f2b79ad2c1b58d9331a3754ff8109b0998b5729aba2429103511fa3bd65", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906661, "uuid": "96532ef3-9c58-4acd-98b7-11197e570542", "comment": "Malware payload (AZORult)", "value": "0e1c004e532d4a38b8ff818439682ab471ced6d1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906661, "uuid": "9ee85226-4908-4b91-85f3-bea41be24003", "comment": "Malware payload (AZORult)", "value": "dc28e998b4079291ecc863603c9b4d9615cd9a900c60d647df00a60d84ecde7572c79e8a64d2a4b2f7c69f5c5b6a1557", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906661, "uuid": "c4611c1c-9e7a-48b6-a78d-9ca46f77cd28", "value": "1505CE15B754BFEAC1AD2F3A88272E5483E0C23BA232F69B6DD554C40361F858B2F517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906661, "uuid": "e93fe2c0-a25e-43d4-90d4-ca29ae978cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906661, "uuid": "666226db-4376-4836-a5b1-d0febc41d5a0", "value": "12288:Cp7erYuyKRGWpP4Y0aOwk3mlLn9QjTjrW3mx+qi9kqPq:tSKnp4Dwk3ULN3vqqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906661, "uuid": "6c52d79d-0a93-46e6-92dd-48d65dae056d", "value": 809472, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906661, "uuid": "cee87bb6-70c3-4ca8-bb95-c9bcba797c94", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906661, "uuid": "36fd3ad7-fe9b-4bb4-a449-27827b63ec28", "value": "DARWISH TRADING PROFILE copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa14f780-8684-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918991, "uuid": "ead4e5dc-cc1e-4ef3-bad6-67043aefa49a", "comment": "Malware payload", "value": "1441967db3eb956e235dbbe7766e4069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918991, "uuid": "e5b91ad1-8d9b-4589-80c4-dc90fcfe1b7c", "comment": "Malware payload", "value": "3c4fa7275d77a0b837e417b056f9afce31027186700f2fabace4968287adcb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918991, "uuid": "a25c857f-46a9-403c-8686-4ec094e229ef", "comment": "Malware payload", "value": "08c017c0dd714311be8bfd948b8d9169c6d57d45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918991, "uuid": "54c49e92-a5c0-43bc-876c-4c71485137ac", "comment": "Malware payload", "value": "bdecb999c3885dc946b44d455c9645ca2cbd16bce5b67bdc28b2126b17fa7d4bb572a6061a80c7255e950921341b3940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918991, "uuid": "5501a96f-b0fa-491a-949a-0775b01cdb76", "value": "3406D066A8E604F9C6BEE0348552A32278723CB58B353BD31ED426A90775FE8773D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918991, "uuid": "de616367-a868-4e2b-becd-82fa56608439", "value": "49152:3F3GRXN4RslPGEhI5ZXG3tKX7x4wGHp7QkZqDp5L0clkNeFDI7hg2f:QN4RslPvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918991, "uuid": "cf1f8cd1-2da6-47b1-9765-980e43809f3f", "value": 3880371, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918991, "uuid": "c11ca573-58bf-4260-8749-5c104e140f39", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918991, "uuid": "081d4c53-2a93-4e4c-8b79-f6010ec5889e", "value": "1441967db3eb956e235dbbe7766e4069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451c9bd1-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1615923116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923116, "uuid": "7d3d2afd-cc86-4094-bb73-5bf7a2245a3a", "comment": "Malware payload (FickerStealer)", "value": "ae5b742f72d184d0a8ad1df948368344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923116, "uuid": "71ca8e27-b285-44e5-a459-8d81ff0eae3b", "comment": "Malware payload (FickerStealer)", "value": "3d132b91ad83f720371df1bc4e5879fffe0e7bd24aafb374f9f3eeb752f7441f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923116, "uuid": "8fe00bff-a72b-4b28-a58c-e29ef530c92c", "comment": "Malware payload (FickerStealer)", "value": "24ca2f9c749ffe60931fd1f61ebf0cf7bedda9fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923116, "uuid": "9dcfcdc0-5feb-474d-ab8e-a42078209f24", "comment": "Malware payload (FickerStealer)", "value": "42813814f843c2a9b4344e830894578aeda84f5d5ad325e9f94ccd3a3ea1878e3c6aa5ad2f7b999dab00144744d95a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923116, "uuid": "f67b9702-e1b4-4cb9-9b9c-254883d75bd9", "value": "5BB4AE4FFED49CE9C5935C3529A3771C83E2685F0572848BDE48436C462A8A8467FBBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923116, "uuid": "130d497c-7ef7-451a-b24a-47a18d689d56", "value": "c7f9f3f4681e672c59c53a0b16cf9e28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923116, "uuid": "69403fde-ef3e-433b-b51f-d188792a7f5c", "value": "12288:K+jd/FYmTo+RSeQHTaDHPnhOJuDyOM2lSwJwCT7qQ:K+p/+0ZRSe1vhOgDyz2lSqwCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923116, "uuid": "bbd6169b-caf6-4dc4-ab31-0f27569c13a7", "value": 509440, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923116, "uuid": "5a3e4ec5-28cb-425a-bfce-4808208e5f85", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923116, "uuid": "64d53aae-0a28-4468-b801-c791484f13bc", "value": "ae5b742f72d184d0a8ad1df948368344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f4660c-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615893904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893904, "uuid": "49987bc0-bb12-4f34-9845-246858d0c514", "comment": "Malware payload (SnakeKeylogger)", "value": "a9a4659d063844ced4c9f5e110577a80", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893904, "uuid": "ecb291c4-2a37-463b-a487-062f3299cb08", "comment": "Malware payload (SnakeKeylogger)", "value": "3da25300ec711385344467823ae229bbc25a9a5a7caeccd911875994ed74c5b9", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893904, "uuid": "286d308d-2c89-48db-b4e8-ad53a29d38ef", "comment": "Malware payload (SnakeKeylogger)", "value": "83ab54f1dc5a9f24858442d5fcb53b903b598fda", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893904, "uuid": "04d5f779-c52a-4d90-a294-2343c2482455", "comment": "Malware payload (SnakeKeylogger)", "value": "c57e2cddf9727a162539b93c27cd3f4c14832c56af098211a3ce1559ac0aa68244bf4aa7ad2c5e41e5ea33c24067ff16", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893904, "uuid": "1b073642-f6be-472f-bf1e-b297e35f17b0", "value": "5E95171127856E28E27A43705835641DD7F9EEB6D338C5BDBE9E328B0B73A4141B3623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893904, "uuid": "388d848c-d225-403f-90bb-ec7ad0b69824", "value": "24576:HQyBpa51mt6VMvyyArQhzPbSOOgZ5iJ1:Hxa5MtXvyP0bbSOvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893904, "uuid": "2c5c0f7f-f132-45a5-98f8-82f9ef8fc380", "value": 1966080, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893904, "uuid": "401b8de0-5d54-4b66-911c-63f2870349bd", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893904, "uuid": "8bd72243-cae7-4d1e-adbd-ec848868a053", "value": "17776-PIP-014_Rev-A-MTO Solid CRA Fittings Pipes and flanges For Bab Upgradation Project Xerox Scan_2021161134248.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2905032-8629-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615879894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879894, "uuid": "33d4d6ef-add8-4440-9949-e5175fa48660", "comment": "Malware payload", "value": "39bc788a3b732b5b5de56db2e83d3290", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879894, "uuid": "558f85ab-6c0a-4581-98e9-c0252174e81d", "comment": "Malware payload", "value": "3e08a05c04ed3a493393bbc3e462fc964eafc42d97bb1072149a001ea559327b", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879894, "uuid": "4a31d929-ae7d-4ad3-857e-0ffdc9f9e12f", "comment": "Malware payload", "value": "49155f32b635defa8f1fbad9f741e959152da55c", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879894, "uuid": "0ea3d488-3c97-4f0d-9b0f-e2695694faea", "comment": "Malware payload", "value": "319ce3efe54bddf86068de0aa5bd01f09886e9cc9a06a51d20800724f54574864f2a9802efb40c5712aac457a4d3f985", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879894, "uuid": "a675534f-b20f-4be2-a791-f097fa19fb07", "value": "2443E00AE335A465C1B9B83AE62894C04E0C5057E985F11F31E9BF00BA676C727DFA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879894, "uuid": "41d5b815-7fb8-4fbc-954d-ee4d9b277bd9", "value": "1536:zHbqn+OW+V7obwRMU0SoBijQolCTl1PqogHPG1SE:6+OWIoMmYoB/qCTlwNCSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879894, "uuid": "e31d3342-1195-4230-8036-116846dc229a", "value": 60484, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879894, "uuid": "38aa63a0-c11d-42ed-9fb2-bbb45fb1d9d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879894, "uuid": "cd552d9f-7df1-416d-89e6-3514ab3bed51", "value": "dettagli_1976.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7938632-8665-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615905699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905699, "uuid": "6342c092-acea-4e4c-a3b1-8a88c344b37a", "comment": "Malware payload (Dridex)", "value": "9d78dc986a5d0ac120f5de93cee589dd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905699, "uuid": "5d9429a3-2101-4791-8274-390f6d592ae2", "comment": "Malware payload (Dridex)", "value": "3fad298f7149acc9aa83e1e4bf4f6b0e8eecc0a60aecfa433a3bbc373665d61a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905699, "uuid": "76181963-87d9-494e-8e0c-78ba3c23c231", "comment": "Malware payload (Dridex)", "value": "610ab8f25a89d2666fd0dac30fbe7f1e8bd16d62", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905699, "uuid": "70d7fc1d-29d2-4b23-b438-ee6b2fd64681", "comment": "Malware payload (Dridex)", "value": "a05340878db47b22ab07dc4c68a7fa72e6c9d63174f7d8cf4c3b8c0480c68fb33f4a7e0ba0473579ff62fdd535a5a9b4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905699, "uuid": "c4c87bd7-f9e9-42d0-ab2a-3cf9efee83aa", "value": "0F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905699, "uuid": "d68b2839-a266-4a37-9790-6d00db7b8dc4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905699, "uuid": "06167cd2-77ca-438c-a4be-68b0bd807347", "value": "3072:t1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:/i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615905699, "uuid": "d3b9b725-d124-45ca-906b-942f9454c944", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615905699, "uuid": "21fa6045-c21b-4177-960c-63d2116a72e0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905699, "uuid": "6fe552cb-1d0d-4e45-a751-93cc92def7fd", "value": "3fad298f7149acc9aa83e1e4bf4f6b0e8eecc0a60aecfa433a3bbc373665d61a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afefbb80-864e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615895808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895808, "uuid": "5d812835-a494-4b7e-bb1f-1f6566803eb8", "comment": "Malware payload", "value": "eec048ecda6c67c0c3e4d9efb431bb72", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895808, "uuid": "95fdb1c4-5fc1-4608-927d-2c3dec1c9c74", "comment": "Malware payload", "value": "3fb6b4f7749a5fd6a49cbadd6a7e14fa786d24e4c4bd110565127221e702da3b", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895808, "uuid": "ee9ab618-adfd-4a9a-8194-1183dd81aa6b", "comment": "Malware payload", "value": "248a6b1656c51511fd0e2d98033493c7382d1ddc", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895808, "uuid": "029626ab-32ae-46d4-a5dd-a6293343e2d1", "comment": "Malware payload", "value": "49e2c762647402fdb61ae963a75e137cc4430e38c5da204dd94239e971b723e52c80f2ceb0a817c12e3fef89aa063a86", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895808, "uuid": "10729c94-9fc3-473b-acdc-17dfdd3ba091", "value": "AF838E5EE164B075C266743C9306A8D249887097D4C3F52E25A47E087EEB2D72BDF2BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895808, "uuid": "e359d5ff-0fef-4e68-95c8-96e0389dfddb", "value": "1536:oTIfrrGsW4kc7qTRhizXvmc6+N9w0hOdxoMU0d4Nb0YV:ogrrGH4IFhW+cAX9doYYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615895808, "uuid": "c6c8a93f-64b2-443d-8086-56faa9292c7e", "value": 87199, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615895808, "uuid": "dedfa55c-6e0e-40ef-93a7-0c5e98a6ebf7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895808, "uuid": "599e7d65-e2ba-49cb-ab91-088c5f319f71", "value": "contri_2206.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0abc7a-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615906727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906727, "uuid": "3e0c1965-7254-4d7b-93ff-47c99e227006", "comment": "Malware payload (SilentBuilder)", "value": "1fc8e84958d40886d6c701514c655cbe", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906727, "uuid": "2c9d31f2-3665-46d7-a2bd-f74d160c91a6", "comment": "Malware payload (SilentBuilder)", "value": "3fcb61eb0a502ebda86dc313e7ce31a0ea2098b3172404afaa620f4c75b84d67", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906727, "uuid": "6ca65370-c46e-4a63-a1e7-d074a35aa3c8", "comment": "Malware payload (SilentBuilder)", "value": "55ba8bc1bcb801883ddd7bb1fd8ffa41672baf2d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906727, "uuid": "22e4f11c-4da7-4c01-a7a4-ab573ec16a08", "comment": "Malware payload (SilentBuilder)", "value": "13d032ebe853c967c6313018746f86f078b659c4e75ec2deb8a8c62ec2a473c9b47094978fe20bc29c0ef32ea50b6253", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906727, "uuid": "0d94066c-02b5-4649-8768-b33a9f92082e", "value": "BFD39907DEEB462FC5884B3A41B34A1A32D68C4C47DB424B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906727, "uuid": "34dcb22b-fae3-422a-bd44-922a499a55d9", "value": "768:sKdUd4TaBosDMW+u72nCPVCmgUrNaQTZipEmDPYbWdYvdJkyMLefR2bMEdu+ZqGR:skUd4TaBomfs2ha3YbWGkgJsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906727, "uuid": "ad17bffc-b8f6-42d0-97df-890d78531e11", "value": 141312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906727, "uuid": "edbda5c2-789b-48af-9c0c-04071118ba6c", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906727, "uuid": "29176441-0825-487b-b83e-55c8d7b40786", "value": "document-1761664386.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd86bcb0-860f-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615868880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868880, "uuid": "8e267d3e-ea41-4085-bbe6-ecd0fdaf0f49", "comment": "Malware payload (TrickBot)", "value": "8c1a5f7b777b0dc5fd2ad7b269f09af5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev1", "colour": "#8986D0", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868880, "uuid": "1136a33e-4cba-4eb5-a4fb-a23a48497852", "comment": "Malware payload (TrickBot)", "value": "402008d2f30e935328b792c31f140a4867f00343e30dbcbe859cefe2d988554a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev1", "colour": "#8986D0", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868880, "uuid": "576310a8-a1e7-4a3c-b8d7-477b22aef3d6", "comment": "Malware payload (TrickBot)", "value": "58eb2cb370aea8b6fd1c45f126d00cd194f47701", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev1", "colour": "#8986D0", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868880, "uuid": "78b7fa2c-4b50-47b0-8e7a-a1691fd321ad", "comment": "Malware payload (TrickBot)", "value": "2b0f6dc1c7b3a03c537358494e58d30e32f195e38cd825268230f759d1433fcf92c049ec27424dee85778bc914839877", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rev1", "colour": "#8986D0", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868880, "uuid": "9e872ae4-14bd-43d4-acc5-4dc615b41d58", "value": "D4E4AE1176E0C071C17A36705416E77856ADE8E0AF3D87CB6BD42A7F6F342C29A3835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868880, "uuid": "d06b3018-9d3e-408d-9a68-8b0c603e7fb8", "value": "cae73998be5b008dd1c2d777a562de39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868880, "uuid": "cd9cb00f-489a-4f80-a688-5d0e902282f3", "value": "12288:5Fq5gJqjDe8jUCYPnXjX/5n85pFb85uuxR9cOU3sziSseDn6m62:X0+jXBnApFojX9cOUfBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615868880, "uuid": "584969ba-6073-4fa6-a28f-2f65e453adc9", "value": 691200, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615868880, "uuid": "03ab7feb-d0ee-4ff6-b8f9-f903f067c5b1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868880, "uuid": "b2eed2a5-a9a3-4a2e-a9c3-5549a1dffa23", "value": "rev1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7858fddf-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615918478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918478, "uuid": "9db3ece5-fcef-448f-bab2-f7c7d1a54c98", "comment": "Malware payload (AgentTesla)", "value": "f753526183ff54bfadacfe31929196ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918478, "uuid": "59b86a4e-4f0c-4040-9437-2ef57497c14c", "comment": "Malware payload (AgentTesla)", "value": "4126380b3ee04197336d8f6a48384ec73289e4fa14762bec745089f4699b2330", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918478, "uuid": "fc846e20-ff4f-4ce9-ac35-d6f05df4b347", "comment": "Malware payload (AgentTesla)", "value": "c9fa9e7e667e4276374356c9b905a9be32c90b1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918478, "uuid": "80df540e-31e7-49ae-afa4-c6d22e91d408", "comment": "Malware payload (AgentTesla)", "value": "eebde6fc3866022dfb3f3bdd588661ffc1e26ac05311331b9371ade53969bc99cb85e555eec24cae64e4654a010e63cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918478, "uuid": "fd7ce259-4fb8-42d9-b8ef-d47ea2315c4a", "value": "AA259D7A2A087F60F23D173BD9955840A3FDAC02D323E85A3DF671E995A1FF50672806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918478, "uuid": "034851f1-8254-4ce1-b179-997cfa923610", "value": "6144:DSEtSf3miPWFhJTqUDnGOkWpuyy0/74ZWBry9O:DLtSf3miOFhJTZ3LO0/88Bry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918478, "uuid": "65930330-500e-4e12-8de1-c648a9535e39", "value": 1005056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918478, "uuid": "6e5411e0-8fe7-4460-ab71-16cd95b9f84d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918478, "uuid": "3b814192-dbf8-4f1b-8b2b-7e025d5a7747", "value": "f753526183ff54bfadacfe31929196ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe3579f-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615923537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923537, "uuid": "c5888ba6-5688-4948-a3b6-cdb4da6d58fd", "comment": "Malware payload (Loki)", "value": "55458eba8e65dcbfefe75be7cf733b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923537, "uuid": "4cd66785-7411-49bb-94de-b8a772635b95", "comment": "Malware payload (Loki)", "value": "416af6fcddde9ba2a0fc38e66a511e64e420cd19a2ad1a66c5e9c0947b4943a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923537, "uuid": "e7e23cec-e760-42e7-a568-e04a6406799d", "comment": "Malware payload (Loki)", "value": "151a6a7f7eb8df945e5774c170bd4b00f3e5cd93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923537, "uuid": "2b193042-3431-4f40-b8a2-5823b392a65c", "comment": "Malware payload (Loki)", "value": "d73e4ac07ed175d123db6991d6c8e235842ef23683bf4d95ec528afadf53b7cd035f382eb12c025a4338e3e00b16c94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923537, "uuid": "5f38f1bb-ab3d-48f6-94f7-38e71d7a45e1", "value": "65255822E640AB70F07C373688740771A2FEAC02A622DABE7C9975CC5476AD541F3D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923537, "uuid": "afa0f56b-19b7-4efa-80e8-b30bb8c9ec7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923537, "uuid": "31531635-aca5-4e35-af6a-4ada7fed9b43", "value": "12288:oMG3Hx+lB0c/5yw19FxfeTe9eutBiqbyswBcLmsx7Rc121yMk:8b257Fxm6oCdGHCmy7Rz5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923537, "uuid": "82133903-cd49-4ac8-b0d9-80cc71517374", "value": 1017856, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923537, "uuid": "1ee79019-c524-40d9-aff7-7263802039f8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923537, "uuid": "d140b7a2-aaec-408c-99a3-e1f6d41bdc38", "value": "55458eba8e65dcbfefe75be7cf733b61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f78c58-862e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882014, "uuid": "3d8e206f-3a54-406f-9138-bf40ae79b003", "comment": "Malware payload", "value": "ac3b544530a8edc4a8206c1db005640d", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882014, "uuid": "870944ca-b6a4-4a10-baa8-7f6f83eaca8b", "comment": "Malware payload", "value": "41d87aaadd8003400f6ee829bec529fa167d61ee0172b64160e4437eb546bc43", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882014, "uuid": "aa135737-eb67-4b29-b0f4-e8bee2f6b3f9", "comment": "Malware payload", "value": "afdc1de945ceb8cb3f16e9c790a5b182354459cd", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882014, "uuid": "998f7b86-c814-43f2-bd31-f6807b34d74f", "comment": "Malware payload", "value": "a30cd87b99b73f7c8911b5a90be7a7924769bfad6e7149c0dc4c754d3d5a937e269c4405bc5010d21dbfa4e5db4777a1", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882014, "uuid": "a8ce7a12-e27f-4a48-9abe-5e10d2f1c719", "value": "844302FE7CEBA2D1DCC3D40E1FB02650B292490FC4B624A6799385215F56592898F8EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882014, "uuid": "49faf17e-b212-4b83-8d3c-6561be75b50f", "value": "1536:Mw0oAmppK1ZnyXtJb5BTFPnufQvl5AbWIVTKZCa9mLpdH:fy19o7hWfQ2Wotf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882014, "uuid": "47211eb2-f397-4e23-b1cb-b5e156797d7d", "value": 58782, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882014, "uuid": "0fa0f9b8-f999-4cbb-a44e-3ee65f797755", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882014, "uuid": "98ba4233-0c80-4bfc-a57b-724bd2103117", "value": "dettagli_2740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0db9a68-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615889394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889394, "uuid": "9807e4ce-0975-473b-baf3-85f9f17c983b", "comment": "Malware payload (Formbook)", "value": "9c99c46a517e9210974c7b5bb2f7c43c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889394, "uuid": "376ce72e-f34d-45d5-91e6-8b878a000a72", "comment": "Malware payload (Formbook)", "value": "41f69b9484d31a7e3bc4945b8fff410de73cb01ac2a08161da57690b06af2953", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889394, "uuid": "24fbed6d-ed43-4798-966e-993970e48dd0", "comment": "Malware payload (Formbook)", "value": "28d9dad99f37ceca7907257f07f096570d4eff61", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889394, "uuid": "9f9e226a-5625-4d39-9633-cb493d861e46", "comment": "Malware payload (Formbook)", "value": "8724e576e791b0546fb4b3b0aa3ee76c98630b92357746e8fa4c644959d98aaf4be9cedddc7309f8e7e28cc1317d4139", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889394, "uuid": "62ec2a60-8ade-4517-a1e1-f6d4a635b9f5", "value": "71C4231841FA2DBC62975593E1535FFD44D8B9B93A6F2E62E33A2A034FA1705CD8E042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889394, "uuid": "e99c720f-d52d-4fdc-beda-1c56953abca8", "value": "12288:CyjBEffw1lfpq8jcD38lGRn1OETMxns2Y8hzFfStik1PrjbjYaBz:CyFEHwo803r16sZ8hzF6iwzpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889394, "uuid": "1fb59877-f485-42fe-aeca-79e0a7b3b83a", "value": 584812, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889394, "uuid": "0ad4b27f-af49-4b2c-b1dc-c8ae229a87f8", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889394, "uuid": "d58fd776-160f-467b-8a32-ddd06dd7c81b", "value": "LSZEC2101115860\ufffdHBL\ufffdTLX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c233f1-865d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615902205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902205, "uuid": "907458c9-0bed-4672-b44d-44c534d9b2d9", "comment": "Malware payload (SilentBuilder)", "value": "149ba9a5dffc5e10b3c16a87742ce5d0", "object_relation": "md5", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902205, "uuid": "336d6390-cd46-412c-932b-0a41b3b755fa", "comment": "Malware payload (SilentBuilder)", "value": "420d151699c12c46eff2ab2574667b4ebcdda90e3be6212ba33ea4ec0e8d9030", "object_relation": "sha256", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902205, "uuid": "80c7d5f0-aee3-4058-9ffc-c912e677ba8d", "comment": "Malware payload (SilentBuilder)", "value": "0bbc16c5c733167d7f51230c82021e499d06be73", "object_relation": "sha1", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902205, "uuid": "232bc4a3-1679-45e8-a3a6-eefee75ccb70", "comment": "Malware payload (SilentBuilder)", "value": "8a4e9a133ca8fbdfbfede89b698f84d4061b948ccf2d04489df2ae846ea0b8830f1545676767f6d48ed3ba3089d1f70d", "object_relation": "sha3-384", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902205, "uuid": "dc0e621d-617e-4a5c-b11a-3fca85faec82", "value": "E7349D57A9458E03E918C3B9BF634E6E631BAE145A9633C7312E7E5B3FB41900C4B11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902205, "uuid": "3baed38e-dfbe-416e-9f9c-154a62e055fd", "value": "6144:eKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgv2IS7FgiJsJ4BR5043yVuBCMmnqLsU/:WzGiK4504Sy/mnqoU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902205, "uuid": "51e2a556-91d9-48fc-a1b6-3fd71a3161f2", "value": 237056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902205, "uuid": "7f18d4a2-b26e-4019-b955-717d9b32ef4f", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902205, "uuid": "71059c47-5c63-410d-b24d-c9b6e3063b40", "value": "1331149726_03162021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27eac14c-865d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615902022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902022, "uuid": "588409b8-eb49-4149-8948-51082f5dfdb6", "comment": "Malware payload (AgentTesla)", "value": "3d50d4259e4a534db3a9944061b4a66e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902022, "uuid": "e0056a83-1382-455f-9133-1bd7a6e04593", "comment": "Malware payload (AgentTesla)", "value": "420eb55a610b87b50a1f216ad003ef777283224e1aaedad7723f240ff1fed218", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902022, "uuid": "cd47f858-9ef8-48db-befe-76bf327ed506", "comment": "Malware payload (AgentTesla)", "value": "9cf41cee6e726eaceb2c9c0a535bd751210a737e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902022, "uuid": "fa690ff7-dc79-4e02-a1d8-399553b69422", "comment": "Malware payload (AgentTesla)", "value": "f471a8ffbbbd7239aa7b15e98ab672d48f972a81237eeea267e502c5e3ef690a49afcbabe5d98f02c760c7f5827560b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902022, "uuid": "f56b6fd7-1bf8-4be8-a85d-808b0ae3f3ad", "value": "72741285AA4084F6E5B88E73287B6D24F2F71E6C547CB75F5F503AB92AB33841407A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902022, "uuid": "bd135ee8-cf34-4639-af21-d7c049079ae4", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902022, "uuid": "3251b0f8-f14f-4a17-83ff-52971381ae7d", "value": "6144:kTqjFARzfNTo95IQQx5czNPbONWxe1eITVRz4pG8gs9ZmtC6oj2H5mTRm4W9ibrc:k55o9zQIZDASJIn4pcsKtq2ZmoZ9ibrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902022, "uuid": "8c71f3e7-f43c-4f67-94c0-6c4d4791791e", "value": 368797, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902022, "uuid": "31dbc841-5d67-42ab-9cbd-cbbebe02c52e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902022, "uuid": "40c22aa5-f8c2-48c0-98c3-62af528ad4c3", "value": "SecuriteInfo.com.Malware.AI.2600777769.24920.32594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab4a5ff-8669-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615907234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907234, "uuid": "4fe3fe02-498b-460a-95bd-a4196fe74977", "comment": "Malware payload (Gozi)", "value": "a2fa2954b658b1042c52cbf789831a43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907234, "uuid": "b23f7d51-b0fc-4ea7-9d87-3e1d5fb88547", "comment": "Malware payload (Gozi)", "value": "42edfcd68a1dd19bb276fc6b112351d7e367313322e6a83acc420d6122349e8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907234, "uuid": "92a3ef06-9f00-4aca-92b9-06ad6dd91d92", "comment": "Malware payload (Gozi)", "value": "c9fe2ff6d5cd7d32def51c1dc163b07a3214d60d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907234, "uuid": "c9ae14ad-20c7-43a7-81e1-9a69261f3c27", "comment": "Malware payload (Gozi)", "value": "6b7b7b66e050daeefa99a576389effc70baff6d1b016bccacfe7b8ce8cb81ea065c9fe5820f0ffb7c5403025361d984d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907234, "uuid": "83b99d9e-99f2-4e61-ac32-bc10626dd15e", "value": "3F3449E212D4C6E9E62339BDC474F7FA360E4CB58B6274B731C12AD5A4271D82E049BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907234, "uuid": "5f25b2bd-3d8b-4165-baf0-c1b7b8432226", "value": "159d3ca4c00186624da6d19bd3df6965", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907234, "uuid": "daea5204-1413-4277-9edf-aab885c24cf1", "value": "3072:BH49b2gRPa2oriHBNyc3GCaNFI2ZGQcxgJKTCvjIGmPPPCZSyyyzpsmN:BHw5aLwBNZxIFj0QUgJN8PPPHyyyzp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907234, "uuid": "3f001e6f-40e1-4603-b796-3ca7069488e6", "value": 236544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907234, "uuid": "975db383-d8ea-424e-a194-608bc31c7f97", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907234, "uuid": "2c2d13c8-2598-42b9-b1f4-532bc7d404f6", "value": "home.jpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cab74f-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615891635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891635, "uuid": "f0555de5-b0fd-4e36-a383-ede5b56a5379", "comment": "Malware payload (RemcosRAT)", "value": "fe13038f3db82296d07781ce38443bd0", "object_relation": "md5", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891635, "uuid": "530eac72-8874-4b65-9973-68f9ce0b8c14", "comment": "Malware payload (RemcosRAT)", "value": "432f71ffe8228503c7696e5981fc8da33d44e0727f06ba6c756b9e733586a5a1", "object_relation": "sha256", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891635, "uuid": "5431db80-a119-446c-baf2-5c2a8bcd8044", "comment": "Malware payload (RemcosRAT)", "value": "d72cbf48168627ae8b8260b460731f8f4bdc100e", "object_relation": "sha1", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891635, "uuid": "e5e9b81e-7055-4263-9d04-c65a0e5f511f", "comment": "Malware payload (RemcosRAT)", "value": "7535298a62057f2e3d8cc32a506b2803d175ba9a598739922e91b05673427349f4d18c8648b000564de759defc329f67", "object_relation": "sha3-384", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891635, "uuid": "7a0cb301-2ff2-4517-b9b9-0a7ab6ded633", "value": "5D15330B75976E0815A77949FE436FD4281EDDAAC84F9A9EB83A5870102ED1E4FF0037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891635, "uuid": "9e313498-0363-4599-9110-046b0e50b02a", "value": "24576:AiMrZF4qmNUZOu227O9nyHBHFujikm3EntvA0JKVaFi8Lm:8rRkUZ/G94umk0E5nJZLLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891635, "uuid": "f87995b2-1862-49d2-bc00-8d05d8852e17", "value": 946357, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891635, "uuid": "86128a87-ceb1-49fa-a11e-d4e4f1277c0d", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891635, "uuid": "577d4211-301e-4fc9-8eca-7091ac1dc0df", "value": "Doc_IMAGE-587HTY-9545-55401.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec0591e-8667-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615906624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906624, "uuid": "508c29ae-8d37-4518-ad7f-c01c13b764fc", "comment": "Malware payload (GuLoader)", "value": "618efd5a4d482650b075f437dc99c00d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906624, "uuid": "b8a18dc9-574b-40d6-b4e5-80f4a67569b0", "comment": "Malware payload (GuLoader)", "value": "4388fe7419520c4dc256bc3a9b1f9c39b31be1238e01833335463a3e177375f4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906624, "uuid": "e9537b3f-473e-46cf-9d6c-f4442049b844", "comment": "Malware payload (GuLoader)", "value": "cec913acde0ddec2e731932f42aee15b211c23ff", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906624, "uuid": "bddd5c35-f4d5-41b5-a56c-a0ac2dcde3bd", "comment": "Malware payload (GuLoader)", "value": "d4bf28166c7c553af10368f34ec8dd0bc1609b2a3aa40649e46fbb8bc8d6ebac6424d76c6ba88e02aecf57fe93e66d75", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906624, "uuid": "a8549d94-5cf5-4d0a-bd2c-57244a83f9ee", "value": "9F733902B5D49833EF2475FA1B554ABA31FEBD3C2218CDD364C8BA5DAF71704682126B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906624, "uuid": "a0fa6518-8c82-43da-a51f-ebcf3c41b713", "value": "7ae91190628cce6a1c5e8124ca1a2d35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906624, "uuid": "a34d6791-9946-4853-90bd-dcc7e1bc203e", "value": "768:lbtjJOXK1uW4SWWT9kKKrL/oMHFg9XdMvmI4OLjIUSJ540:FtjJqK1u3I9r8LpHFghdif/SI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906624, "uuid": "b2c70c1c-87b3-4d20-bc22-ccec6862c410", "value": 73728, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906624, "uuid": "a6b4c7cb-b916-4995-ac73-0ac7c6cecff5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906624, "uuid": "266dc858-4a3f-47c4-b453-cdd07d699696", "value": "CHIMIQUE CHEMICALS & ENGINEERING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf7038d-8613-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615870597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870597, "uuid": "7581db7d-5269-4616-998f-c267c14df401", "comment": "Malware payload", "value": "f03b26c370e7f561af1f1b6dfb4dff17", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870597, "uuid": "c8b056d2-688b-4b3d-a05f-d90400233ca0", "comment": "Malware payload", "value": "43ec1540fb556ea63fce7a3148916399a5ebe9f4ca2a85d2539b87e734a641ff", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870597, "uuid": "7bbcfb56-219b-451e-b570-b5976093e9c9", "comment": "Malware payload", "value": "da0c77ee3d0f886d4da63f2365013a2203e23653", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615870597, "uuid": "2d52d148-c760-47f9-a306-97fc6e9c1390", "comment": "Malware payload", "value": "0926a28818d57d3cc4d1f4faa777b1630eaa2a0b14a6218ea15531d8a17354dc7fbfc6bbba678aa2da3ad66c245e5117", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870597, "uuid": "ffb7ca43-8c0c-44b9-8bdf-bc271dbc42ee", "value": "6B739D5EE160B469C23D703953429CE25D4A6297E843B51F24B47F0979EA1C33BEF2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870597, "uuid": "2d44cdea-3e91-47cd-8dd9-095908d60772", "value": "1536:LkLYySjKqIOe6ppGjYekcUWiXatOkXhbqpZ:LTle0GUekOiwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615870597, "uuid": "09f56eca-b4be-4a57-ba3d-803a53f9d2d7", "value": 76386, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615870597, "uuid": "a6dd94d2-d097-4e22-899a-153ca00269e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615870597, "uuid": "4a1e86c8-b6cd-4a9e-bd09-c1dba9c0b182", "value": "conto_2837.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83704242-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615891009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891009, "uuid": "167b678d-60b3-4285-bdb6-edff3d63ce5a", "comment": "Malware payload (Formbook)", "value": "66408abe0ad530044298aedaefe97574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891009, "uuid": "27b7f6fa-d4a3-42ca-acd8-6b4a158c4fbf", "comment": "Malware payload (Formbook)", "value": "441a0a46bcdfdee8c8b6761798e75a65204eac43b47547557604f80f26b87e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891009, "uuid": "87bbea31-96fa-4fd7-9522-8d9791feeba8", "comment": "Malware payload (Formbook)", "value": "6ea94881f52cdb561c1bd5c477abee8fd915d529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891009, "uuid": "19851344-e54f-43de-8ab2-ddfaf28fd59d", "comment": "Malware payload (Formbook)", "value": "3e6598a0f2fd959b48d561f4bd825909166e3597b6be3ed1e51ee56fc859c8ba28c24d6776701c64f9bf18af5b95dae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891009, "uuid": "dc0494b5-1ab7-46e3-aefc-b9f0d7654b34", "value": "F0241265A7C0AD73D3938230587AB935FFB78119412AFE4B43AC1EB6791046F8F25293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891009, "uuid": "9f124ef2-800f-4243-8791-8cd84cdf735b", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891009, "uuid": "12ad558d-e3a7-451f-868d-344fed349a57", "value": "6144:6TqjF7DHPL5sk21vb7L+DD3jqcBBq/gKWWivTUM:2qbPL5sVb7C5BUY/9IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891009, "uuid": "54ee8f4d-d0c0-4489-ab04-9cbcf54f9892", "value": 215949, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891009, "uuid": "bf6e842e-4f54-438d-99fa-9c9ea7d6f014", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891009, "uuid": "5bcd64de-9d81-4fd9-b289-78a9a076ffea", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6a0ee9-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867455, "uuid": "2254ead0-a723-4bf5-9542-adf8318f8207", "comment": "Malware payload", "value": "1ad65dab80a62c9c724a2f1a6c3c0a82", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867455, "uuid": "abe4f2b6-0351-4d61-b0a9-0e62174d4b58", "comment": "Malware payload", "value": "44c5aca8dc1e487f9c620341d2e8a640143b0428bea4387c77a8a68004fd3bc4", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867455, "uuid": "253f007b-f88a-44ac-94f7-ba90887bec00", "comment": "Malware payload", "value": "6fb13348b84f13e23c27e446a3f7fd4013aafbfe", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867455, "uuid": "6cd9f5d2-b828-45c3-8cc9-099334ab48d1", "comment": "Malware payload", "value": "31de52fb3d75f1e486718ce729ccca73438cf9d75d049c1873f398599fa55388d113653a1f375ff760d442b3125d9c50", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867455, "uuid": "bab59da1-ed69-4f30-a26f-d52b3a5257e4", "value": "A9838E5EE614B565C27D703C4346ACE25A496197A883B11F24E07F0879EA2C37FDF2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867455, "uuid": "df272ffe-8a55-48d1-b598-b8a60ed85a0c", "value": "1536:dDtzun7HMLnSMgOdHP76ppGjYekcUWiFvU3jXhVep+qpZJ:dDtI4LvdT0GUekOi7p+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867455, "uuid": "7ec69f23-508c-44c3-acd2-b6098c2af333", "value": 88669, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867455, "uuid": "0370547b-c748-42bb-bcb1-0a81db1e79f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867455, "uuid": "f9c543c0-9ef2-495d-bc7a-390317c69579", "value": "conto_2792.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2043d3d8-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615921766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921766, "uuid": "4f01f711-1504-4a3e-8d1e-65ae1c909ddb", "comment": "Malware payload (SnakeKeylogger)", "value": "aac4db0a347f465c30f319d63bc88c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921766, "uuid": "11176181-3ed2-4efc-8013-b7000862aad8", "comment": "Malware payload (SnakeKeylogger)", "value": "44e98855189a8a6f9c355a61650bb0174d118f3cf7318cb66092af6207381c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921766, "uuid": "4efb6d85-fb42-49d1-8df1-b2cd5419d184", "comment": "Malware payload (SnakeKeylogger)", "value": "63f67d196ec5c07dc65487b4476b251588af5941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921766, "uuid": "4009922f-f047-41c5-ac0d-599af4574c86", "comment": "Malware payload (SnakeKeylogger)", "value": "203a893567458f09b755101d5d024ac5f078837c53343605b927d7d1b8f3c156e8be7e3710b7c986011e4becea865955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921766, "uuid": "b529d9b4-e155-4fca-868b-190e6a449f4a", "value": "4E05CF63E65E8AB1EC6D793F045F44598389A59BA8E0D3C7A54D0F723610CC97BCCCA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921766, "uuid": "f49e02af-3a77-48c3-b8bc-5a59430f230f", "value": "12288:w2z6350jwcEc6tvuI0a646v6oAXx9R6WsVn3R:whp08cEc6tvz7646v64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921766, "uuid": "d47ecaf2-5fc5-4c7f-8773-b2079c53be3e", "value": 812465, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921766, "uuid": "c464d9e5-d845-465b-8006-af6231294109", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921766, "uuid": "83cbfa84-d0dc-4901-b52b-e6a02042054e", "value": "aac4db0a347f465c30f319d63bc88c39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb2d159-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890115, "uuid": "0ee40d99-a71c-4260-b199-11a221ea307d", "comment": "Malware payload (Formbook)", "value": "c624ab007b8dc7111ca4ded4ac0aa536", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890115, "uuid": "6b895a52-7550-4019-aee2-dfef043d2837", "comment": "Malware payload (Formbook)", "value": "4538157040dd9ec8956382843291808c24b3441f4adb4db6b5b9dc015cc01c02", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890115, "uuid": "667a7bf3-44a3-40a7-89e5-ef9c0550b77c", "comment": "Malware payload (Formbook)", "value": "d57089aaa6f0a07d0be2b6a26176602b6cf1d55f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890115, "uuid": "6a0b691d-a1ca-4ff1-a535-a75fe7451d09", "comment": "Malware payload (Formbook)", "value": "21d99001d1e2467cda7c4a4f517cfe6d447e72f333a5e5aae5f95b5fe2a92c11b98cf7ecdb0d3057d7df8fc4c21186d7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890115, "uuid": "b335cbdc-c29e-4934-b956-56a8ce86fc27", "value": "97357B21F654AB70F03973754432033183FEAD069626E6BD7D4871DA4A76AC182F3EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890115, "uuid": "1c3382e6-9ae1-49d6-811c-ef266dcc2935", "value": "12288:NxfouKlSESIdRBG9+93je32cCa/AC5lDd+/Dcl7+CRS8zdzd1:NCaIdRBjdsAC5ZdAm7Nlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890115, "uuid": "e0499243-c246-47e2-a6dd-d6cb7054dd7c", "value": 1101824, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890115, "uuid": "01aac71c-05eb-4c56-9d9f-39ce259a23df", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890115, "uuid": "735cf9d9-d4fc-4f7b-900d-fc5d9b45aee4", "value": "Receipt_007876.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b39fbf-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906964, "uuid": "eac4db5c-c046-463f-bc2a-c2264a5a4586", "comment": "Malware payload (AgentTesla)", "value": "945c09f7b03e98f98a7a9ebd1e17f1eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906964, "uuid": "5231d03d-debf-4949-ac19-8c54c2c4ab11", "comment": "Malware payload (AgentTesla)", "value": "453884fd9c2498e084481af7478237c128940d57ad8340f35c8e513b8d3b95aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906964, "uuid": "b850f5de-5139-435f-b94c-ffcc5da17931", "comment": "Malware payload (AgentTesla)", "value": "399304738c4e2334930d4280d4de7846739a6a9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906964, "uuid": "485512dd-877c-4a7d-9e58-592a954d179b", "comment": "Malware payload (AgentTesla)", "value": "87ba105b69fcc3af9f3837010d81b90e7a4ddcde9d961ec6d462309c2054f969a22b23cf44e28f6366d87a9defea7b89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906964, "uuid": "f9f93b57-4948-41da-a3f4-124a37470df3", "value": "85F423DE1ECDF7C6F6ABA1569E48371A960A4005333508CD8AF947F977C5A930B60B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906964, "uuid": "d07787e0-3a1d-4bb7-8c96-7da82b53b147", "value": "12288:o2F/sCC1zdnSZzEOEvk+igbeedZcRYhAFSmv33y1XYYPpC7nZ1yH87:o2CCEz1SZzTEvsgbv2Rx3fy1LxC7aS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906964, "uuid": "c6d94238-f41b-491d-9d25-f22556674189", "value": 723668, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906964, "uuid": "3d2ca62c-052d-417e-94df-ba67c05b5579", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906964, "uuid": "960353de-1503-4ca0-b152-9235d90481c0", "value": "Payment copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77842ae-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922047, "uuid": "a8bc9cbd-205f-4670-9fb0-e2635ac84edc", "comment": "Malware payload (AgentTesla)", "value": "17e61b65fec953907f49f99f757dd4ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922047, "uuid": "3c8d3ea6-e72e-438e-9145-81486be93a97", "comment": "Malware payload (AgentTesla)", "value": "4709c17e3a1cde10a874ee2d42b7ea213b9de8763f0e43ec438a78f46609f965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922047, "uuid": "2fba3d2f-2ba8-4905-882f-e6fb0519dcee", "comment": "Malware payload (AgentTesla)", "value": "245fb3c7983a18177cc9ad17d69cff3f336d4dfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922047, "uuid": "96e29ad0-0af7-4b4d-8d02-ed9b940c27e9", "comment": "Malware payload (AgentTesla)", "value": "351385efc0ff0d296111730907ef3384862ae1a9d8cd95ca4db2aed9ecbfa962cc590d8e572645881b45c95220385ac0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922047, "uuid": "4e03cb49-c64d-4454-ada5-b29dfb02e6ee", "value": "17256B203EA69134E472DAB34B9661776D6D6F263B06F4FD3E7073C60633943A9C1229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922047, "uuid": "187e6431-ed4d-413a-93fd-01d3cfe6b4bb", "value": "12288:gOVs4iLO58UMBXmeEMsDyWeREK57lUYJsSRf5T/elZLCtJB9ByMWj1k9wvPqtj9x:dRMwMsDbenfgGfcZ8fV6GKC3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922047, "uuid": "ea35f522-a2f2-46f3-81c6-a0ccbb99924c", "value": 998912, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922047, "uuid": "1522ebac-337d-46ae-8206-bc61bafc184b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922047, "uuid": "a8f68d54-f9b4-4603-9305-e303b3c74472", "value": "17e61b65fec953907f49f99f757dd4ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2f9345-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615884635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884635, "uuid": "8dce2c9f-383f-42ef-a3db-4bb8d8d2576c", "comment": "Malware payload (Gozi)", "value": "b70bb01648a76dd8545fd12ec53b9ce7", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884635, "uuid": "f39e7cbc-c385-4921-b38e-e52622fa44cd", "comment": "Malware payload (Gozi)", "value": "4713834ea4f17e583ce824f4c2ee391cafac251d6f0d64a5234b417ac593094b", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884635, "uuid": "abe3a856-6995-4b03-9997-50b9b3299fd5", "comment": "Malware payload (Gozi)", "value": "78a6919ffa9a86d8e85f248ce6435754b4d6f60b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884635, "uuid": "581efdb5-4f96-4b3e-9f4b-71ffddcbf561", "comment": "Malware payload (Gozi)", "value": "9a2e6129d16562cc970e4ba29708fbc528207ed0f4ebaa57047d110ca693745721a2cc4905c11d006527a6733671c142", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884635, "uuid": "1afa51b3-41b8-4c90-96c7-d81d78484982", "value": "4D045A1F301D4974D6223B740D12F19A9BEB2E9446250CE7F9D6247BBAE7390F938782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884635, "uuid": "90773acc-da62-413e-992f-4e0eb835414e", "value": "c481e199f517f42656de62b5a78cdc5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884635, "uuid": "4ead6da9-1fbe-45e2-9ff0-07b9e7ee9e59", "value": "3072:uJnA8XIzK1HiMpUDnGDfhyWTlvHzUUHu22/oZ2Wwl85y2K0YeafU:CqK/Enwfhy2lvTUUb2/oZ2Ww+5VKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884635, "uuid": "d3192d86-5f4e-444e-93fc-27e4c32e5f9b", "value": 174592, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884635, "uuid": "9beb35f2-448b-45b7-ad66-0fa3867ce893", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884635, "uuid": "6abb960c-c967-4e67-b14d-df06eefc7468", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.30469.3458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe51694-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615922886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922886, "uuid": "b2e7a517-56f9-405f-929b-2e653825bffd", "comment": "Malware payload (Dridex)", "value": "29ba4166f86d157ac203ce325789fe98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922886, "uuid": "ddcf929e-ee10-4967-aa14-ac45b1affe19", "comment": "Malware payload (Dridex)", "value": "471d3324fbf89f77fa9ba83c8dba8af28588504075ef331ac52e797dce8947b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922886, "uuid": "b03b105d-43f3-439b-9cac-2b49d9f31815", "comment": "Malware payload (Dridex)", "value": "4b617a40c4b0eeea79a797d4896377bc5c9d117f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922886, "uuid": "e6dffe58-a57d-4998-89b8-9eeef46615c7", "comment": "Malware payload (Dridex)", "value": "c23656d96023d610af2bdb6d6e1343a7e1ccbf9696ac8024cff2c98ece51f1d064c855373899892cb64349abfe8cd4a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922886, "uuid": "48726cd8-b6dd-4664-be57-fed231499913", "value": "5414BE2DD736EA9BF7F3DEF21420272A59676D61117B918D6AC224BF82BF90C006C14C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922886, "uuid": "5b025a58-7ecc-42f5-8235-724841d39579", "value": "f51e8df6bd6c2af7857cce5930a68887", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922886, "uuid": "b71691f3-6eb6-472f-9409-663ac6a70e7c", "value": "3072:4f/CNh6hxzkBkRCnNo0zLv71FGYH9bTBoXRVBGLlgQPx:4f6ixID1FGYdvBoXBGLmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922886, "uuid": "1f288dbe-fe8a-41ca-ad79-bdf62845060b", "value": 204800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922886, "uuid": "9cf2b28c-cf8b-4de8-8406-4eb7a020b20b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922886, "uuid": "5ce023ae-8a07-4949-a250-099244a81351", "value": "29ba4166f86d157ac203ce325789fe98.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f5197b-863a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615887065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887065, "uuid": "db783921-5c5c-4002-aa99-ce4a1da5513f", "comment": "Malware payload", "value": "84abae1be51ff9491238dfe5bb5e7cee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887065, "uuid": "14b4cd08-eda3-4c1d-bd23-c234fbd11bca", "comment": "Malware payload", "value": "47849b5915fec96e3896ce3af564d5a42cac3452f1c114bbd5a7adeb6a910479", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887065, "uuid": "e8fe2fc7-ef73-4011-8abe-08d2a9cd0d98", "comment": "Malware payload", "value": "c9be2443dac45c98db368e90f0f9b138fb54cc38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887065, "uuid": "4ef170b4-3036-41ef-bac9-2f806034e68a", "comment": "Malware payload", "value": "536a02d344d8c0d3156501c603e977f8ef42c9a71a1da62486fa4511a9a4c18b3e534e85ac3342b4c652e681dbbba145", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887065, "uuid": "f5ecfb8b-9e4b-4b24-befb-51b203a3f236", "value": "7675821316F4FD15D27D32358CBB5409C6ED95329338F0A97D6E33868A6F9104FA22AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887065, "uuid": "d6333c6d-c996-4f7b-bbd4-1e4a55ee0e95", "value": "24576:661WJ0C0DzlYVQoRJ7Jyvpj/Lw4CpHYYY:6gI03Yh3JyxbCpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615887065, "uuid": "5446a526-6bc5-4284-91d5-49e129e957d1", "value": 1617920, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615887065, "uuid": "f3d494da-14a2-40a5-a0b0-931b90c04857", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887065, "uuid": "8d1cc7d6-02f5-47fd-b4ad-30ef75bd98d1", "value": "Quotation.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af6dfff-860e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615868258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868258, "uuid": "ed51f9d4-20d8-4234-95e8-a963aad99410", "comment": "Malware payload", "value": "2d99aefd764c9bf0ba1e5eb1ed657958", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868258, "uuid": "958bd3df-d34a-4d24-bf8a-77914cb4a6cd", "comment": "Malware payload", "value": "47881cd7b0bb12903d07fafb98f917e24aa4520ea257e519aee31fe914cf4d20", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868258, "uuid": "e2a8b388-37f3-442a-82de-27382232ddc5", "comment": "Malware payload", "value": "2185c1f9546b67532ac795ef47fa5207efa0634b", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615868258, "uuid": "3f74325c-5cac-443b-8105-12063c24d1e4", "comment": "Malware payload", "value": "482f1cf7b0f7ea5cbc4e3b1eb19bca35e09c5d396147755a696499d1367e7b9a5c28b3fa3d3c55c769b47da092478a53", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868258, "uuid": "84b1937d-2cde-462b-98ca-8121614f381f", "value": "0263C01EE510B469C37C353D534658E2AC5A2297E883E51F28B06F5479CA2C72BEF1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868258, "uuid": "8dd94b6f-6429-4430-afbf-e7cdf1811616", "value": "1536:yGPTNzCRX/OhFVv9pys6ppGjYekcUWixyRe9qpE:ymTNzCRXGhFNz0GUekOiMRoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615868258, "uuid": "cd619ad2-2006-4952-b5ce-a142bccb224d", "value": 70629, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615868258, "uuid": "f4998685-4d7a-478e-ac1f-8e6175a8c48e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615868258, "uuid": "f13b1922-f32e-4931-8261-72a5aed6831c", "value": "conto_2170.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0ffdf2-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615922432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922432, "uuid": "2dd67b7d-5004-410e-8f87-33fadce02106", "comment": "Malware payload (Loki)", "value": "a81c8325b042d9a25365023a8657ee67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922432, "uuid": "27d323ce-6dab-4ca3-9807-ba99763e16f5", "comment": "Malware payload (Loki)", "value": "481c8b41f5a6532bbfce5ac53a4e33d457aff5c0200523aeccd60ec6d04b94c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922432, "uuid": "0946fc43-c385-4753-89e0-a8b2e8143470", "comment": "Malware payload (Loki)", "value": "0cfb0f5144622cc0f9cc375502f739f5878da7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922432, "uuid": "26d965ee-08e7-4574-8862-26d87c32cf33", "comment": "Malware payload (Loki)", "value": "59f1f08342473c29951ec4cfce86afa173c0391174c587826a5c88e0ed4ffe1490585f3be533833674bd772dbac561e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922432, "uuid": "5fe22096-56f0-45e2-b451-6833b7a4d4cd", "value": "AA2512B952181DA7C4AC23758427888603F69D39A5A0FF5D7CEB72E91DB37D30712A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922432, "uuid": "0cd3e088-35f3-48a7-91ce-b2983ed82b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922432, "uuid": "bbd7c670-d41a-49a8-99c9-af26caf4ee27", "value": "12288:jpbm07myDG49Mzo9E6F6Uamstkljt2TkMH3ygS0yZxls6:k+a49Mzo9LF6Umg6igSPJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922432, "uuid": "18f48f9d-3331-4dde-a8d4-a105a0549035", "value": 997888, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922432, "uuid": "a18ef8be-f2a7-4a8f-af70-1f3ae8b1bb02", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922432, "uuid": "43fde573-1898-4ab6-86ef-02f891659f7a", "value": "a81c8325b042d9a25365023a8657ee67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6147b8c2-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615923164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923164, "uuid": "54057439-171a-4715-b18a-1a1a38a35313", "comment": "Malware payload (Gozi)", "value": "91bd711bde58f59fa668592fb1abc5b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923164, "uuid": "56c93397-5414-475c-98b3-ec17a1b6536a", "comment": "Malware payload (Gozi)", "value": "48ade0f2b38700fb0823472b9041da19a9dacee5cd14558a04d1a77da62ef737", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923164, "uuid": "137db4c8-3aea-4871-83f5-410c0ce44cc4", "comment": "Malware payload (Gozi)", "value": "731656f259e8951fc5de16e9e60f0ff0c2c235bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923164, "uuid": "b1b6437c-4346-419c-96a6-3e8f4a950c92", "comment": "Malware payload (Gozi)", "value": "3776b3649eb2e8f0473c3dc1d8a2aad4e569afae72da84d27e3ea52220dcd2ce326e39306c9c2d2b81676717ba8a4093", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923164, "uuid": "9aabfff1-c117-4351-bc40-8523155bc153", "value": "40A4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923164, "uuid": "2311b97e-afd9-4c51-89ee-8e2fd24c7188", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923164, "uuid": "11a30c7a-b02b-4fe2-8373-2ac090ec4e7d", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZV0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEvRNdbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923164, "uuid": "4e56d8d1-0fbc-42f0-972f-d9b5d5dd8980", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923164, "uuid": "609cca69-fd9a-4f2d-b7b8-5fa4d0754166", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923164, "uuid": "85ed9515-81a1-4c18-b8a0-b7df61ee9d55", "value": "91bd711bde58f59fa668592fb1abc5b6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db906040-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615876554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876554, "uuid": "4f8b1004-6c38-4085-bb74-8d5657fb2bbc", "comment": "Malware payload (Loki)", "value": "625b601ec3fc57886da2a14d5cdb7185", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876554, "uuid": "662f1e44-0308-445e-b526-27cc608a9cd7", "comment": "Malware payload (Loki)", "value": "49912746d4f3f40b818e401780cf42f57675c0363b4b4c9a4a6adbd0c15b53af", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876554, "uuid": "8fec0153-86b0-4079-ac49-5db3e205b523", "comment": "Malware payload (Loki)", "value": "32112e4be7def16bc88d09e00e500339a9ee0f93", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876554, "uuid": "266ec53b-a7b0-4edb-83c7-f088c578af3f", "comment": "Malware payload (Loki)", "value": "971c92c4773b07ae98f310b5364b2adbd57e47b9f235e7039ffbecbfc145f113c775c5c4f218712f88cf7a074c1a2766", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876554, "uuid": "b3ab5e96-15b1-4210-90a9-aa268fbb6df0", "value": "43329C79D54EE421C973C578709912F2FB098606B662D12BF857E8D9C8745BB032EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876554, "uuid": "15c23029-d25a-44ec-ae8a-754f079a238b", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCiVe:aNxUyn0i13LROEiOLkX6Ujnw+3pVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876554, "uuid": "b90b0dbd-9f65-4bd6-b461-98d6b8277f39", "value": 11724, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876554, "uuid": "7d0edaec-deb2-4b0d-b69d-2037c5a59dc2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876554, "uuid": "3b0a3538-c824-43d2-8914-702a5242ec5c", "value": "Revised PO.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b0b056-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615889264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889264, "uuid": "09cb8ae3-73e2-4310-9281-1aa5cd5e0fe9", "comment": "Malware payload (Formbook)", "value": "4811dca22808f5f8ad98583ce9674d13", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889264, "uuid": "d3b06c17-e20b-4f87-9a59-a9fe414a474e", "comment": "Malware payload (Formbook)", "value": "4a3674a9698185ced6eef94f2838de70c417130487edd02f7dffffc9839d1735", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889264, "uuid": "5a84051f-279d-4968-8cf0-56f519a79686", "comment": "Malware payload (Formbook)", "value": "d9a23f00e0ac00d5c360c5646b9238c386065ab5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889264, "uuid": "8674e769-3daf-40a5-94c7-f55dbb3f1330", "comment": "Malware payload (Formbook)", "value": "7112b30f097553ab3014c382a5d931f9e3577a778f05ee0f172a44d108aae54d05e97c1858554820c7d297d97a196dc1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889264, "uuid": "71e649b5-75c4-4bd9-870e-69b77fabe427", "value": "56B53301E49F8F47C6A256BD6679AC3A02F54C172513990AB644FBEA513F73832CBB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889264, "uuid": "27c63bf6-d29e-4106-bf7d-36f0a699389d", "value": "49152:7/S8i4ALnTgiSculeXojYTV+9C//bJizisaroBVKKxDs:dA/qSX9c9C//bJi+s15S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889264, "uuid": "4be0befe-e3b1-46dc-a144-154b068c6a51", "value": 2408960, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889264, "uuid": "c8730fb5-5c36-4846-8dbb-35f86d5d23b3", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889264, "uuid": "4c65f1cc-f870-4381-83cf-c7aeb4ab318c", "value": "MT LIANG SHENG_Ningbo Notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3658ac-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615923343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923343, "uuid": "1b278a25-6fa1-425e-9dd4-95cf23456721", "comment": "Malware payload (AgentTesla)", "value": "8f108e8ea58d3b6591ea7e5fe24839eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923343, "uuid": "18f921a8-e89f-40f0-bc34-03a4f499698c", "comment": "Malware payload (AgentTesla)", "value": "4bc0559cbf4ec33e38c556bc91fca79005454ec4b72e1101638fc4e2bfcbbb70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923343, "uuid": "ca5234f8-80c7-4200-a3ae-9098c50c6836", "comment": "Malware payload (AgentTesla)", "value": "be53907b2e6ddb808222c7692960ca5c8692e0ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923343, "uuid": "c64b7c4d-6b9d-480a-b3ca-7d1e3769c75f", "comment": "Malware payload (AgentTesla)", "value": "9efa6f55d742aa5e06fc119e3f9142635feb0980c6bdca3dd68bec838b13817624daea7ac10b99664415da503556e629", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923343, "uuid": "d024d54c-1f26-4239-90fa-3460fddf8d69", "value": "8F257B12E690AB70F03D73755432133093FEAD0A8626E6BE7D4871DA49B56C446F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923343, "uuid": "d860ef41-9db2-4884-b73f-43d95cd0da34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923343, "uuid": "8273251f-defc-49c5-af65-663d12ef2d5f", "value": "12288:C88BK1jtyUe+AiEOIS25uaB+mcPDsiqTzcGetNQ61:fjtyUlAhRr5PzE1qTQGhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923343, "uuid": "1bd7b6ba-cd8e-49a2-90db-d0072e2a7c9e", "value": 1017856, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923343, "uuid": "5e6a1ece-f41b-4b2e-a966-87884039735d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923343, "uuid": "b6181dc7-6bb0-43b1-bc70-9ce306e9b5c1", "value": "8f108e8ea58d3b6591ea7e5fe24839eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccd43bb-8615-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615871294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871294, "uuid": "80307e8c-c50c-4e8c-a0de-00ebd0e5b631", "comment": "Malware payload (SilentBuilder)", "value": "8eb18fc2adfa58b5fbaa7b1d419e8d59", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871294, "uuid": "e8bde701-9e09-4e83-a62c-5c585247a772", "comment": "Malware payload (SilentBuilder)", "value": "4c81a812c94f36db6856da77365efc8fdda68d4cb50b133b0123a8e731a3e447", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871294, "uuid": "d5532358-c476-4bc5-8f72-31caa6687376", "comment": "Malware payload (SilentBuilder)", "value": "cc55610911ccb087f5153713f4436f5e59ad0adf", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871294, "uuid": "d50b8202-add7-4bfd-9cd4-f90f9b8ae397", "comment": "Malware payload (SilentBuilder)", "value": "a0b9177301a47a49d0f3735534bd95b0ba1ada2952585f1e65c682e49bd0425fb1d2aa1799ee5b83e81d274c161cce81", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871294, "uuid": "8f708c8d-0751-4fae-a809-2a3abdf056b3", "value": "C9C35996A1E5DCDCD734CB350BD245AC6687EC670B6A23872218B6097F7C3640B537D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871294, "uuid": "92c5cd4b-e646-43b6-b0ff-511f48942f28", "value": "3072:HHcKoSsxzNDZLDZjlbR868O8Kfc03y7uDphYHceXVhca+fMHLtyeGx2zZ8kpTIGG:ncKoSsxzNDZLDZjlbR868O8Kfc03y7uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615871294, "uuid": "2fb49b99-d5b7-4824-adfd-4b33d270dcad", "value": 119808, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615871294, "uuid": "38a005a6-fdce-4843-9b2f-332bebfc5f31", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871294, "uuid": "775ae71b-a382-4485-ba95-050067de79f4", "value": "subscription_1615836612.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aff9e7e-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615875935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875935, "uuid": "bc9ad991-eee5-4742-9167-ad37dc6418c0", "comment": "Malware payload", "value": "72774cf9537a90f3e44c4e7aaa6b5036", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875935, "uuid": "35a607b8-708e-4bd0-9087-a9c1aae9348d", "comment": "Malware payload", "value": "4d1fbeca1370d7cdcf552ea717addc311fadb1293d35cd5ee1d04006de30a620", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875935, "uuid": "0eb52dce-e72c-4722-a755-948125d4c147", "comment": "Malware payload", "value": "b482bd1f388e0a21b53bc479a508fd4118f8f2cd", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875935, "uuid": "f5f9f66d-bcdb-442e-b905-51f0783feda0", "comment": "Malware payload", "value": "dec8d84dd794ea129b4e52eb6f60839751ed1a862507cd86d829a6a5582395047be7c7c2decbfa054bd276e38f900444", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875935, "uuid": "8eecad92-9330-4aab-a95b-15fb579ba882", "value": "EB753353C72B4E1A0796DD3ECBE0915E29D376DAB62ADDCF4E8D05794C343A0E80C4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875935, "uuid": "17f9b58e-2273-4bca-b1ff-c161ffd51508", "value": "49152:KHyU7tECL6pfBmhPhG4+EQBacmr519x6P1Lg+:KHyU7tECWpAhPs4FBzV19xsL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615875935, "uuid": "2a96d58e-5a70-4bf2-9619-3c881b8510f0", "value": 1677450, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615875935, "uuid": "e8295c1e-2022-47b4-addb-684850248d8e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875935, "uuid": "c7d1742f-5769-4617-9193-914b6492aa86", "value": "RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29574db3-863b-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615887421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887421, "uuid": "298fcb51-97e3-41c6-ace9-924a366319df", "comment": "Malware payload (NanoCore)", "value": "f9e96969b83ad6ce40e61b134350a344", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887421, "uuid": "659cd37b-b575-4948-a54c-6b9105c718c2", "comment": "Malware payload (NanoCore)", "value": "4e21b20042e84c609b006bd5424f1c4895ae50b733e70fe0b20ee4de36433566", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887421, "uuid": "20f45ba7-f818-48e7-b7ec-d449155cee20", "comment": "Malware payload (NanoCore)", "value": "57938aa550dbb241f14b96912b01e763cc6e6c86", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887421, "uuid": "aa69320a-1211-4a15-b20d-3238c2f58498", "comment": "Malware payload (NanoCore)", "value": "a1057416ca88a633488dbbc5029ef46a57a1a2b5e92d9a98f8beba674e0688733f17b70829a057e417db4a33a5111de3", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887421, "uuid": "2b9f3c57-8ab2-4bc6-a72c-45a5c99227cb", "value": "D3253883F04420BDF8DA7277A5B64B39A1DD1D5A4842590C72753F84BFBEAC242C3D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887421, "uuid": "e78597d1-5f09-4182-b150-42cc2da5d5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887421, "uuid": "c1fda302-4a5b-40a2-add0-1c887ca21752", "value": "12288:dPi0/A6u/yELQ4oE7zC/hAZSxmydapoAFz9VJWnZrj/C:dSaEPC5YSxVHAFz9Vsn5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615887421, "uuid": "ddb92e50-b154-4184-ba92-fb50fd3b40c7", "value": 1051136, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615887421, "uuid": "5b498921-fc88-4bbe-a0d7-934009e731f3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887421, "uuid": "ffd49e6d-e407-4cf7-b29c-79ab61b63a1f", "value": "4e21b20042e84c609b006bd5424f1c4895ae50b733e70fe0b20ee4de36433566.exe (1).danger", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1bba8a-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615890966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890966, "uuid": "f8f7ad87-fc44-44fb-9ca1-e2c0a4c5e65e", "comment": "Malware payload (NanoCore)", "value": "cc0a37ddad078e7990da5155ea22b12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890966, "uuid": "0a177af1-41cd-4bf0-8fbe-c4a00d2782b8", "comment": "Malware payload (NanoCore)", "value": "4ea1e2fe984d6203dc6d70efe8babd31370a2e42dc779fe57e5698607e299955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890966, "uuid": "876ed65e-f0f5-482d-86a6-fa4a7eb1cfd4", "comment": "Malware payload (NanoCore)", "value": "26ba5123df81b8ea48553cbc69950804b832c971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890966, "uuid": "08b35aa7-f872-4016-9a5d-6e1856ec402a", "comment": "Malware payload (NanoCore)", "value": "7376492057bd5fcf11bd4b92e9ab56fbe2d309ada1fb23cbce9a522799a0b1a17e0f17ac2980089e819c95a4580377b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890966, "uuid": "1d133a27-1822-4e04-91d3-2b5b2e6bc05a", "value": "129360E4996650E7D27CF57A9C411D42AE32A4F7F1145D3B958382C3C42ABA33CC86AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890966, "uuid": "3bbc4c25-1853-4f20-9772-b76e11f45088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890966, "uuid": "03489059-c7a3-4bf7-9d93-bf2039e87cd3", "value": "1536:du1kHI5UawJDWaPm/DEPHo2A09XSgNrVAXA2+o+F8g:duOHI5bwpAGq05NlqZ4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890966, "uuid": "bc993266-f52a-416e-844d-7b679a8c32f0", "value": 91136, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890966, "uuid": "38083b76-dc6c-41bf-8a6b-f814097ae6f2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890966, "uuid": "82f199fb-019c-4414-a449-7ae2b1f580cc", "value": "PO_6620200947535257653_Arabico.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620feee0-8699-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615927889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615927889, "uuid": "68f823a6-0b09-4c2e-bbdb-66812fc116e3", "comment": "Malware payload (Dridex)", "value": "70178878ea1ec00d4af0ebf685a531b7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615927889, "uuid": "797467b0-b5cd-447e-b938-346571b789a4", "comment": "Malware payload (Dridex)", "value": "4effb86e292824298a26c7e70f913f5186f34944d392e824f4d07661b1156b96", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615927889, "uuid": "928087af-a1ee-4035-b20a-0b5257463879", "comment": "Malware payload (Dridex)", "value": "1a21a242cb37b07380ed9a739155a4f61cdbf141", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615927889, "uuid": "d9ca1da1-928e-42f6-97d5-edaf0011cac0", "comment": "Malware payload (Dridex)", "value": "2c0a989073a417d728a19557e6d2986403b625f82aefdb200742310e8ce07079aa7acc82b5f179b51d47f9d2fba5a784", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615927889, "uuid": "9397150b-6d38-4ce4-bf3b-4be70aab983d", "value": "B214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615927889, "uuid": "3db25e2a-61da-418f-94db-5826871b8c4a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615927889, "uuid": "087e096e-c52a-4702-a833-3e16a289ad53", "value": "3072:21i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:+i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615927889, "uuid": "7bda74b2-7994-48b4-ae4f-f09380c3f479", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615927889, "uuid": "0f45116b-0387-4132-b9bd-a77b27cd1c92", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615927889, "uuid": "6b3fd38c-346e-4175-a5c0-3372e40b690f", "value": "4effb86e292824298a26c7e70f913f5186f34944d392e824f4d07661b1156b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d986186f-8660-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1615903608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903608, "uuid": "2b86b76d-2b8b-4de7-ac55-7688977cb669", "comment": "Malware payload (IcedID)", "value": "386ee9c74df6b655db3a273c32373260", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903608, "uuid": "6833c599-aef4-463b-9314-4a51a5922156", "comment": "Malware payload (IcedID)", "value": "4f667f4267b2a1e90029ec3e66de84f0131e573087d4a0f50e4c9b5b9e0a8173", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903608, "uuid": "4a1d565e-ce6d-442c-977f-9b477bb73b4b", "comment": "Malware payload (IcedID)", "value": "1c8dc39f8c5b59be3f1b86339f7fd86f3a115c5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615903608, "uuid": "cac6461c-fa93-4c2a-a591-ce5145383dd4", "comment": "Malware payload (IcedID)", "value": "d48e8475674e89182f7880bfa12aeebc60ac1a25bdee92f0c01f733e31023f0d060b9a5ec8e1d810903f42a49f7e6824", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903608, "uuid": "56812f91-ecca-4e6b-8010-7d9481cc6713", "value": "CF135BCA55B00B22C5312A75C4F31B2CC327BB51B79319FBE148776AC692194EB325BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903608, "uuid": "eb70422d-5f72-402b-96f7-fd32f0a6ffbc", "value": "95b2898fa77b48d0d76af3340137da99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903608, "uuid": "5bd0ab8f-e153-47d2-8b1c-f91f4e62d163", "value": "768:pKr9m1jUXGVJAPF8QQG+dLSPqJyufzV+QC7SK0ZqxOWVXP:pKr96Ac2tl+dLSPKyoz0QuBnrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615903608, "uuid": "816f6789-055a-4fea-b241-b1c836b48ac3", "value": 44544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615903608, "uuid": "07b9ae52-b51b-4a39-b40c-0882220a6f35", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615903608, "uuid": "1b167f50-ed0f-419f-9c0e-92d9a876e430", "value": "44269.8575331019.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b313b7ee-864e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615895813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895813, "uuid": "4b9021fd-9289-4722-a185-c30456771b4f", "comment": "Malware payload", "value": "448c9e02057d525380dc4ac9a7d71b85", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895813, "uuid": "b4a849ed-c871-4968-8073-8da814474751", "comment": "Malware payload", "value": "4fbd92c7fbf802d80fa2c7a92af5557e502c3e1d632bb0885d1aedf0c43f420d", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895813, "uuid": "0b6a4202-9180-4aa5-b8fa-e0191d4f7bae", "comment": "Malware payload", "value": "0cf6d352f55ef60c1138cc93dbecf583300df129", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895813, "uuid": "fc6bee70-a277-4a51-8c84-55db235381a6", "comment": "Malware payload", "value": "11cc9d926dd87cd174a6baf1edc27d8d023949396e53d932c1d2ee3d8b678f99eb56f6f237d20a0452a0f942d81423d9", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895813, "uuid": "3ed85a5e-e3cc-4ca1-bdf8-37333ee7d434", "value": "046302F7242821DC5BFF0AF64BAFF85736F21E9ABAE571806DD636BE40945820120916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895813, "uuid": "86b8971b-6aa3-4252-a933-dbca15e3d8bc", "value": "1536:wWGvn1ijIqGLqTngvGjz7zQAfSI7RiYwceHC+sRyW28glU+L:0vclhn7zSIiH4RYDu+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615895813, "uuid": "4f2a7675-4405-4258-b238-fdee7c03b878", "value": 67124, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615895813, "uuid": "b7c6b5c7-b369-47c1-b9c8-f9a8a2360ed5", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895813, "uuid": "30b46fa2-dc8a-4a3a-a959-0c33ed4e66aa", "value": "contri_2206.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da834318-8658-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615900174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900174, "uuid": "8cda1b21-e93e-4b15-b08e-7fea1db335a9", "comment": "Malware payload (AgentTesla)", "value": "5bdea44382cfa378dc195cfaa676a9b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900174, "uuid": "06f21e2c-2eae-4e2c-99ba-1e0488ba0c3f", "comment": "Malware payload (AgentTesla)", "value": "4fd4e43c38eeef1f98a50b5938188bc5fe86cd3aeba8553300097fd8732b3dfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900174, "uuid": "ba59990b-cc0e-40fa-87bf-bb5c55c86964", "comment": "Malware payload (AgentTesla)", "value": "db1b1f2ed8990d2bc32ff33348dce7e0eabbaa2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900174, "uuid": "48b4e043-eba7-47c2-9101-8ef73e197cca", "comment": "Malware payload (AgentTesla)", "value": "3a8db10f1e913e0d40c526cb60738f2f55d46fb987965ca32739ef044910b53debc9646bedef92b99d614e4c43f24040", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900174, "uuid": "3573dabc-70ac-48b8-b6af-1e5b04f34dda", "value": "DD0533D3E1A55DF9C0F9F2728E60E87AFB4BE34028E5C93F46E5F6321606E809710196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900174, "uuid": "2a3f936c-0bb6-4f46-9bd7-c767bc0c623f", "value": "24576:MJ/1beiCUyYvMufbn1KbZYdPQ0PNXw12dJxWfIv4CHgs7rUSt:M9xmuT14w9PNkkJo/CHgWrUSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900174, "uuid": "cfc597e9-1b07-42f8-b0ed-652d073266c4", "value": 805324, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900174, "uuid": "9f285f1d-40d0-406f-a30f-7ae5cb8e8fd6", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900174, "uuid": "67438afa-6e73-49e2-a625-7154c4c01e2b", "value": "Purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18feab1c-8646-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615892119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892119, "uuid": "436a5e8c-97a1-41a0-a4bb-b4ad68d101e8", "comment": "Malware payload (Loki)", "value": "f5ddb8aeb5d10b0b6d8d1825326f4433", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892119, "uuid": "f40c4c7f-089c-4ecb-a139-3b54f05799bc", "comment": "Malware payload (Loki)", "value": "4ff76e59bdb163f4a63546a7533defa34faeaa22eab908dcc90b04548f41c8c6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892119, "uuid": "77a82ce9-3c8e-4bab-8c3e-d383a3075329", "comment": "Malware payload (Loki)", "value": "dd2bb347cdfd61aaa31d221760bf2de7739d5b07", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892119, "uuid": "7a2d7df4-b494-446a-81c1-ea73a9e86d2f", "comment": "Malware payload (Loki)", "value": "64f4226318c859ef3a11be4ab2d4e4d9db52dfe79485552d631fb3e6ee3cd112b90cc58ccd119a060b39a945f8e17574", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892119, "uuid": "ae6e0750-7883-4643-980b-866ade78329f", "value": "9FF3022623D14CFBE69B45F11CF3B73DF7B6520187216E8743A01E762E32A95D90D2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892119, "uuid": "7989a43d-dad2-4b69-8de0-50091a417000", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892119, "uuid": "d1b590cc-641f-46f3-95ea-9851ae1c560a", "value": "3072:03jqjLX1DLPcHUiAVZids/tPDsG17ZdAK1zb8tV7WDf8MNO3kE1Pfg:0TqjFgDaiuVPoGPiK1zyMT8MNOZPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615892119, "uuid": "1d6a2ae5-5b0f-46ad-b83b-1fadb7f17a44", "value": 159979, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615892119, "uuid": "03717c0d-0234-458f-8f48-001467997a37", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892119, "uuid": "8e4c0c97-9e3a-4247-8d98-20af93d11859", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.29933.31784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96dcfa2-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615918131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918131, "uuid": "7851f890-7607-4a01-92fe-9b44a247ec79", "comment": "Malware payload (AgentTesla)", "value": "342a4c4974fff373668c6f124a5178db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918131, "uuid": "f993d742-711a-4c50-9fc9-fc24b697d2b5", "comment": "Malware payload (AgentTesla)", "value": "5050aa9f14ee4ec918a09d27545b9dafe4e31c24da294845c2cbb5d927f5fa27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918131, "uuid": "f305ad8e-fe94-42df-bfbf-aa35cc47144e", "comment": "Malware payload (AgentTesla)", "value": "dbd04db8a8755b01959a3bfb5089bd8f74edc834", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918131, "uuid": "595a8e4f-8f4a-405c-8907-228ace2119bd", "comment": "Malware payload (AgentTesla)", "value": "896cb87393b74d908728af6f2326bfa37dc5849797a15fbc63b5709e642b1bc9d61bb65c82ca610a787963b6e209b87e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918131, "uuid": "ffe0e982-9e3c-4aec-add7-b03de1a65fe1", "value": "76B423513CC4CF73DAFB69BA17B18D26634ACC7147379E0F7829316A88393A215A351E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918131, "uuid": "741daba1-5e09-45ea-a82a-3f88646faf37", "value": "12288:RoDSb0uUKMjJQCjOyPo6jTtI/cXza0v4cB:RoD03CjOyPo6ju/Aza0RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918131, "uuid": "f2cd6c73-a240-4f98-adb3-c781088326e6", "value": 498688, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918131, "uuid": "459debb5-1c60-44f0-8f38-69e917138131", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918131, "uuid": "b068848e-e2ad-42db-9a94-dd9d9df9493e", "value": "Order08388393.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19db7f8f-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1615923044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923044, "uuid": "d82abd80-6254-45d6-931a-a2ba3994c4d5", "comment": "Malware payload (IcedID)", "value": "cd44cdd21a1ae1983d3829f664296a16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923044, "uuid": "ca9a325a-a011-49c4-9d8b-ddc34b9e205d", "comment": "Malware payload (IcedID)", "value": "50960acb80404df412b26661c7e4f16f2af708c5998d4c7bcb3b5a0098327013", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923044, "uuid": "aceb9605-29e3-4992-8fbf-df7f70081c26", "comment": "Malware payload (IcedID)", "value": "d6ba56123e160793990a98df37d23b5e5c3b2d47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923044, "uuid": "c7d7905d-51ab-447f-976e-3a0aae6c6af4", "comment": "Malware payload (IcedID)", "value": "26b635f037ef7e1cb45f5fed4063ba7763a27f7056a2bb37846b594ad0033c19c7a117a7ffb837389de3d0bdc47d5629", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923044, "uuid": "778153a9-10a0-4ccf-a188-0e31e76d82d5", "value": "02F3CCA4BA97476EC663533E4E5F223C8B7B3FF4399902679449B4B2231C9C493E7109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923044, "uuid": "15d84a0a-3f0a-4456-a212-db7540f9403f", "value": "015f7aaddd9f464d8fe721bf20f7b501", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923044, "uuid": "2dbf008c-098f-4041-bbc4-3dd1112416c2", "value": "1536:Dvf1BPhZCGp+AK4zLl9E1Y3wvaowg6Sla6JwLfyUTuUgylQ3JBx6Ro:DvfnuGp+AK4zLl9E1Y3wvam7Ug1BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923044, "uuid": "a4cc599b-e0e7-4ec5-aeb8-91932a279630", "value": 157696, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923044, "uuid": "e32e7950-ca77-4bfa-a9eb-618a41ba7ffa", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923044, "uuid": "49eeac6a-d395-48ad-9ede-5503305d2db3", "value": "cd44cdd21a1ae1983d3829f664296a16.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbcd821-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876346, "uuid": "4ecad3a6-fe25-49e2-9374-0ed24cbf801e", "comment": "Malware payload (Formbook)", "value": "c8c9b369e614a962c27fd96b58db79e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876346, "uuid": "6707e518-fdd8-4f28-82fd-24cd623aa91f", "comment": "Malware payload (Formbook)", "value": "5137dce99172be36a0e1df2964d70813e52fbebe6f528b652dfbf22faf545024", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876346, "uuid": "9cba86ad-c10b-473a-852e-eea59b1d5972", "comment": "Malware payload (Formbook)", "value": "d9e8334f8c87436860571cf7b9423f2c901dbbf0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876346, "uuid": "25fbbabb-add0-4d8c-b882-3d854f04c5f6", "comment": "Malware payload (Formbook)", "value": "357d92b1f8d0c0a1b498a0a4ace28a2df7c8daeaf4416b19d55abb556b2ad8018320324ac3cb6f3cb7abb7d385db52d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876346, "uuid": "613ad76a-5989-4594-9f2a-4a231bfe4121", "value": "91C4231C41FA2DBC62975593E1535FFC44D8B9B93A6F2E62E33A2A034FA1705CD8E042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876346, "uuid": "213872fc-21cb-4f35-8679-a397e7fc7c78", "value": "12288:9yjBEffw1lfpq8jcD38lGRn1OETMxns2Y8hzFfStik1PrjbjYaBB:9yFEHwo803r16sZ8hzF6iwzpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876346, "uuid": "079e2f5a-481c-4776-8ed5-d3a395c2d473", "value": 584784, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876346, "uuid": "40f00015-73dc-4402-8936-da6b35323d62", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876346, "uuid": "7f505ea8-f630-48f2-8fea-674867bc21f1", "value": "IMG_94301.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6944e98c-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894830, "uuid": "d0d6d2fc-db1b-4f5b-8109-48778e04a8e4", "comment": "Malware payload", "value": "e2a24d4b5575b3a758fe5807d3f6633b", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894830, "uuid": "151d467a-599a-465b-85b0-f6320e030a31", "comment": "Malware payload", "value": "514ed2eafad1c274c468dabc1e9e6bf5b24e52629b9d7b66b75ee647cf42c1e5", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894830, "uuid": "f0b2a503-2bfd-411a-ab26-e191e559ef46", "comment": "Malware payload", "value": "4efaeceb073830ee1bec29be3df18fe597298149", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894830, "uuid": "b9e3f36d-497c-4e9f-8678-0b509a9e1ca8", "comment": "Malware payload", "value": "4922b3d1283ff3a691c88e23088425c5b9a76752016c45afa2ceb36ef0a98ab443e5c4a2c66f92766f17d1a498c42b66", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894830, "uuid": "416eb0ce-4880-453d-ba7c-be49118de509", "value": "C043F224B4533BE45419F3DE6449F0D9FC412BBF7859040AAD3A648AFAF62290E6F53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894830, "uuid": "3c26319b-73f5-4360-b87e-6399e7b99397", "value": "1536:w1jJmZ3jqJQdZZub2PNgg96XyT9B6nVJWl59HgBhAhcEwkE1:w1S3WaVub2Fgg66OVJWl59yhAhD5E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894830, "uuid": "1e6737c6-4302-4848-a652-5f1d40d86329", "value": 55789, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894830, "uuid": "dba1f3d3-3797-43da-ac59-2aac902c1864", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894830, "uuid": "1a9c7e15-ddd6-419a-b172-d7688b2c58f5", "value": "contri_2442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996566b1-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890186, "uuid": "0ee22859-0d85-4ece-8d57-3e547b410e96", "comment": "Malware payload (Formbook)", "value": "2a758a9660c98814c451ecaa136a66a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890186, "uuid": "274d23cf-c117-4594-9fa3-62980bf20d09", "comment": "Malware payload (Formbook)", "value": "53de22812c250114c4a25de969ccebefc8a9ca7044974db873ee29c78209cf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890186, "uuid": "01b3ece1-cc2d-4758-ae23-2d72a854a92e", "comment": "Malware payload (Formbook)", "value": "9e741ca692bba7ca9ce551809eea406803304da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890186, "uuid": "e671c69d-7516-472a-b25c-fda1245ad543", "comment": "Malware payload (Formbook)", "value": "ab5aa28a9dfe4c5f58bb67724f746adc5282523f963788d3947750527ab60d3bc424ed28cdbbd3145e193896457c0255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890186, "uuid": "1e027c0e-ca45-4545-a0e7-e612f741e496", "value": "E42501612688FE50F0BDDB7C046115C017F7AC06EE26FACE6F9933D91A72681467A633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890186, "uuid": "26eb1c5b-2e9f-4b5b-8275-3b843e974e5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890186, "uuid": "739705be-8153-4706-953a-4ba0dbc1edca", "value": "24576:M+9VKqcBR6ajPaQBmQKqWlzyuQxzquJDQ:McVKqO6yyQefXNuJDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890186, "uuid": "c0f379cd-57fd-4cec-b1d6-fe3af05442d1", "value": 975360, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890186, "uuid": "0ffae6df-258d-4ec5-9d60-2cfcee947efd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890186, "uuid": "b15cef8d-34be-400f-8df8-1d5d281c3f63", "value": "Quotation_2536478234.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc8313c-8629-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615879884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879884, "uuid": "65f254e8-82a4-421d-8fc4-d3c3ee6a0a92", "comment": "Malware payload", "value": "25ba2f7f660713e1660b27f900979b0f", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879884, "uuid": "9026eeba-3d18-42dd-bf33-6ced5cbc2159", "comment": "Malware payload", "value": "546dfa9fd465edd379d9efc13602df744283ac47c9ad649c711f29ee46d8d773", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879884, "uuid": "b5dff5e9-65a9-4a74-8f43-9ff54bc4e896", "comment": "Malware payload", "value": "9ebfa76a5fa381673391320b8589e4cff8eeefbd", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879884, "uuid": "16ee42b3-95b5-476d-8f58-bcc0a68aa53e", "comment": "Malware payload", "value": "1f8ba687595e8ff46067c8948f2b2078df6791f0afec8a6581fdd1bfa140674dcc644c6e032de02417e7ba7580e074d1", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879884, "uuid": "33693acc-120d-4991-8279-c268c2cc4bde", "value": "DA4302B7054B6E0CD473DA704D52343F5999FD0AC96A7ABBD5CEB7E2C16EC28462C280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879884, "uuid": "35ec054b-9c44-4ce4-a93c-fa9664c47370", "value": "1536:vOCvC4Kx6zZk+RM7K15y3TjlZ07CKosnk0SHA:ZRrO78iZ07CKPkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879884, "uuid": "99079046-c90b-4b19-8e7f-40ec7b9597a8", "value": 58984, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879884, "uuid": "6631fff7-1801-426a-93e4-5a716b844312", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879884, "uuid": "8ca37d17-6076-443b-b0df-e0d0f743f70a", "value": "modal_2276.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afea5872-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867461, "uuid": "1baea769-e920-42f8-9418-cfcfeac06767", "comment": "Malware payload", "value": "5c380aada43584cb942a3f3c982420e7", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867461, "uuid": "f6e4797f-d893-4a18-8cbc-3704a409f8e7", "comment": "Malware payload", "value": "5499a5b9e59cb76f0ff61083dbc75b554bbefa22e886d192bc5d07025e1add51", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867461, "uuid": "03bcb7e5-7000-4d30-9715-4af813131142", "comment": "Malware payload", "value": "d22c914eb360933f3d51ca3da01178140fecf9e3", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867461, "uuid": "27e574a2-f259-475b-8fdc-5d2705c97cc7", "comment": "Malware payload", "value": "e294b5df99b55522402525f18d1f5bf20a336a92216047c6187ff748625ea70bab81865f396eb86f8c8076dbc9ac7854", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867461, "uuid": "9b361178-db5c-427b-843d-590214c4c5e4", "value": "D883AE5EE22475B9C27DB43853466CD24D892093A483B12E25A47E097AEA1D33BCF5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867461, "uuid": "560e1b83-6878-487e-af71-addc4f0652b2", "value": "1536:hHnx1ycICgZh4g6claQD+BfvYUpZZbQjRNe4Jxt7nQXJt/:hHxNICQN6sazpZZwRohV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867461, "uuid": "972bc55c-c4a6-4954-bea1-10055616acba", "value": 86940, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867461, "uuid": "180f78df-6374-463d-9988-cee63df7df0d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867461, "uuid": "e6eafe6f-d981-4076-8a73-ad6c73f03d4e", "value": "attiv_750.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e0883f-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1615918657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918657, "uuid": "13cbc70c-052b-4e38-995c-a03f4cae87e6", "comment": "Malware payload (DanaBot)", "value": "9fbcfab95e9f6da331d12bac2d8771c3", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918657, "uuid": "b105f754-8687-40f2-af52-50d81232b12e", "comment": "Malware payload (DanaBot)", "value": "556c4d308956c4892de1b8ebee9efff4f30a720e16de34e740e6ecc4099c7846", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918657, "uuid": "998f1ece-cb66-49bb-8a03-9218096af53e", "comment": "Malware payload (DanaBot)", "value": "9daa0d3c65576106a55f0bea08fe25415ba2bee4", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918657, "uuid": "8ec941b0-04a5-4862-8f66-44521e211455", "comment": "Malware payload (DanaBot)", "value": "2498536067b5496b8e6db2564881679ff312e5cb52bbe9b9842bb117e43f3212aeddacba25da4c21c2a5d375d7787053", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918657, "uuid": "4c32d43f-480d-466c-8ab3-06ec748ec489", "value": "BF563332DFF0C024E4B701768ABA4668753C7DB257BA82C753C63A8B5CA46D4DA71B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918657, "uuid": "853f9b88-1f80-43ba-9440-32920d44b731", "value": "5e01395680024e2c9af5d940d3604ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918657, "uuid": "d1510129-f5c1-4b7a-8bff-6fa267062e45", "value": "98304:vEJCXjq8KqBv/rGUC6rL8fqJ1WFXPgLWtQodK8vmUUyhoVN/X1XJji2OAWMMMMiT:68ZB7Gyrx3WFIKQodK8vmKof1XJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918657, "uuid": "85f15afb-f0fb-4c65-ad94-395913262d44", "value": 6281216, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918657, "uuid": "28bf8c9d-a4f2-4e6b-9682-a19d240e2bb2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918657, "uuid": "868e5dd7-4225-4b52-adb0-a29e6fd597a7", "value": "9fbcfab95e9f6da331d12bac2d8771c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007f9f70-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1615918277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918277, "uuid": "fbd0db70-be63-4c4d-a6cf-ab2e40bec3d4", "comment": "Malware payload (Smoke Loader)", "value": "145449203ce0a012f463344d93344162", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918277, "uuid": "1f2d6b60-9fb3-4d1d-a900-a0895e35847a", "comment": "Malware payload (Smoke Loader)", "value": "55e764c875d2aba36aeef3d6ea2096cf395c8b3a62ee641b1e37d141f8c9ecc7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918277, "uuid": "345b229d-f072-490c-b9a6-c0343ca40f09", "comment": "Malware payload (Smoke Loader)", "value": "1c72a8b30c9564345f2ced736d85a5ff93d4b053", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918277, "uuid": "a962461a-6ee9-4cb9-a8f2-19acae8d157f", "comment": "Malware payload (Smoke Loader)", "value": "1890b85315ec41c73d715f70a90d342b2bc769fcc4f5d32ff967a8c43e7807d22aa02317add5db662237bf99c5811555", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918277, "uuid": "dc6c8b1c-6b40-4f86-ad31-0625871dc914", "value": "F7547D30E7A1C034F4F701B646B686B9A9347D315738A0CB7AC06A9F5A346E6ED31B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918277, "uuid": "878588ae-defc-4dfe-9295-3f5230454642", "value": "4b91c14eb0915fdca34ac1a2852aef0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918277, "uuid": "370e946e-af6d-4c25-a5e6-6f43bc9c1427", "value": "6144:PfaemYubCgW4wXvtVhEneL7s5eCAMHqdw6uGMMMMiMM5q3:P7mYuGgW7ftVhEePu3rHqlMMMMiMM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918277, "uuid": "a258cda8-9e14-44dc-81b0-fafed4db048d", "value": 293888, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918277, "uuid": "d211ab1e-34f1-45c5-aaa0-8281d232c6ec", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918277, "uuid": "b4a54b70-9f1c-4a4e-aad4-d1cde5946a4d", "value": "145449203ce0a012f463344d93344162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8424fd-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615876183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876183, "uuid": "de8e62f7-37e2-442f-b365-2dbb1025e09b", "comment": "Malware payload (AgentTesla)", "value": "ab71fd66bc94821983a14613aea198be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876183, "uuid": "7be3ec30-4ca2-4e85-9681-c5cf92c82345", "comment": "Malware payload (AgentTesla)", "value": "569dec2c15a4a7dfab4540e6ed61ce8008985de16e5b2f91222c7b93793614cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876183, "uuid": "7433c800-b0e8-4d48-a2e1-441f17441861", "comment": "Malware payload (AgentTesla)", "value": "65c26d7d81f82c73f9d33064e4c41656efa6f0a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876183, "uuid": "e253b956-9449-4e88-84c7-cede9d327823", "comment": "Malware payload (AgentTesla)", "value": "b8b18a18b42817c85b0f2c979e0bf7c0cfb4c632663ff969dfd35d3310cbe2c2cb5c6a51586524bb4fddd19968b06646", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876183, "uuid": "36bf6bf1-2848-4e56-8e17-8db1a1ccf5c7", "value": "C455F85127846E24E27A43B04C35A519D7FDBA7BD338C4BCBE9F328B0B66A414573623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876183, "uuid": "c8a345c2-77f3-40fe-a4c8-cda6a1487de6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876183, "uuid": "591e9189-1b90-4397-9343-cad0b0962599", "value": "12288:BjGXOtIh0RToVGQCSb3JUyB/Zz3usl8hdMQ5yLUR5IJIKXFlqq8J3v5A3UYkCVXU:WUyBxusCDRTYU9cUiXdklf+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876183, "uuid": "514a0154-d625-489a-8e85-770eaf2caa35", "value": 1317376, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876183, "uuid": "d4ea6024-73ec-43f3-9b67-4964a02edf08", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876183, "uuid": "3cb4f8ff-7f62-41ff-9633-a9749bd43b5b", "value": "MT103_SI.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2523bae6-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615876248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876248, "uuid": "4f072195-52b9-4ca8-9303-280fc7f0d31b", "comment": "Malware payload (AgentTesla)", "value": "601b968db6728baaefb869662e368349", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876248, "uuid": "2d7fcbab-98f1-499e-a079-751881f79934", "comment": "Malware payload (AgentTesla)", "value": "56d8a2469192ce83d332691cdeb0ba357c9dda7770e2b633a372beded0fce39a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876248, "uuid": "8efe33c5-d312-45b5-8769-4c9fdce63d16", "comment": "Malware payload (AgentTesla)", "value": "9d9a97f13d888de0aac4d8145961daa2b606c71d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876248, "uuid": "db3198fe-c58b-447c-932f-180ccb44d294", "comment": "Malware payload (AgentTesla)", "value": "dec0daf6991eb5754551d777ce6958db7cad3c6a822abdc346ce8ed6b8f492c7e298eea167a0c832c90025769f78a66d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876248, "uuid": "575d033e-6ea0-4cc8-bfd9-ea3922f18fc7", "value": "CC74134278E16DF3D58396F04EA8CBB6F776C0254682FB4787AC4E385E4504609BF3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876248, "uuid": "90db5025-d3be-4ec8-93f3-e7aaee2d4fa9", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876248, "uuid": "6b22865e-98db-4460-a4cf-3d6a0dcdb5dd", "value": "6144:sTqjF+jJ/AshhLBMr44I69NRkj6hDr4gaZeaqEIL2OIDDlEaSM:stjJDAI6hkj6hDsgaZ3bICOcvSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876248, "uuid": "6961cb9e-f2eb-4a75-8197-aabfb2ce665a", "value": 351318, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876248, "uuid": "09ed3820-f533-46ac-969b-9ef809658fe2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876248, "uuid": "4f477737-c754-4337-afff-8f3bcbbcd8a5", "value": "4YUT00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57e8216-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1615918580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918580, "uuid": "8c369999-4833-46c0-a44b-269d9f3b0dbf", "comment": "Malware payload (ArkeiStealer)", "value": "d13092cd4854e3f28d379ce5bfa0238f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918580, "uuid": "465ee550-226f-4eb0-b775-41b2a9b1820e", "comment": "Malware payload (ArkeiStealer)", "value": "57265e6674b80a1e6292f45a4cf8be1a1b623cb1e5f89b7e07d8b7916e381e30", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918580, "uuid": "e45d64b7-593d-46a9-86ce-857017fc6e2a", "comment": "Malware payload (ArkeiStealer)", "value": "3c9490725e8f6020e208c10d03827e700b6ce913", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918580, "uuid": "92b68f2d-61e7-41b1-8bbd-2be90bcee6d5", "comment": "Malware payload (ArkeiStealer)", "value": "3d127d308400cd33fc06e6edd61a4a85d12bcfb224d7b454e20cb1a25ece99060f402f3adc0d677c5b77ea75e3d19775", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918580, "uuid": "2108579d-8e36-405b-a6a8-e6bf77c26c7f", "value": "53D4D030E7A1C038F4F3057566BA86B4AA357E31173885CB63C43A9B56782D9ED31B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918580, "uuid": "1ff06da6-d005-4fdb-b8ac-dcdf0f5cfbb7", "value": "4b91c14eb0915fdca34ac1a2852aef0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918580, "uuid": "57b13c6f-476f-4277-af92-3de51eadf3ce", "value": "12288:U/bnkaMXzJ7hQe3pFyijjIwa1whC38YN0FG6CKGp68Hv7UsgfsY3MDXjBOCWsauI:U/YXdj3+KUq1YN0FGHd0AUb3OXlOCWb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918580, "uuid": "3fefef07-7456-4ec0-adb0-75a2204419e2", "value": 651776, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918580, "uuid": "d3ba4cc7-f383-4a41-b289-5f7d674d497f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918580, "uuid": "5ac34bfa-5c47-42a8-89a8-6d80aa820b9b", "value": "d13092cd4854e3f28d379ce5bfa0238f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cda78f-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615921483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921483, "uuid": "dcf57ee8-7d96-409b-9ce6-c3d4b9da65e9", "comment": "Malware payload (RaccoonStealer)", "value": "193632c5516bdc656fd95f85fcab4392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921483, "uuid": "b61eacd3-5453-4ade-9879-6ac029032c76", "comment": "Malware payload (RaccoonStealer)", "value": "575fadc1850594983be11811f89e72e61d2911415ddec1e0ae26615da823e912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921483, "uuid": "d31e0037-e130-488d-9a2f-3e449a5f3a17", "comment": "Malware payload (RaccoonStealer)", "value": "06ff26b77b801cb487367d807be5033ecc724d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921483, "uuid": "e3b167bd-669d-4b84-be86-de7818ee5b3f", "comment": "Malware payload (RaccoonStealer)", "value": "b4d631b52f65ba7b07290fa59412e43630085dc7e67b931c046e6140f95ee60a415e8cc3bd706837611ba9eeb422bc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921483, "uuid": "a77022b8-c67e-4804-bc48-5cab95c3e0e6", "value": "C7C4D002A765D025F0B305B586B68AB8B6357D739F3884CBA3D026DE56346E1ED33B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921483, "uuid": "8704a907-1318-40ec-9ecb-fd12026a69c8", "value": "95b1a81d545c603a5a65a17dc8240c82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921483, "uuid": "bfa2074f-f983-447d-ac85-78d96e2bb8d8", "value": "12288:UhGMv004ITIHQMPuPMXpi57YInqdgU5KGYNKIlsesOyvxg4:UhfWHViMY57Y/dgDpkIlsVOWxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921483, "uuid": "57dd1b2b-d0ad-4e1b-a92e-605f10bb7e8c", "value": 578048, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921483, "uuid": "e08a0f2d-9a89-41f4-a0d7-8c9b21f0054b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921483, "uuid": "0c2b6b7b-f7d7-42bf-af70-6f9fa0e8be54", "value": "193632c5516bdc656fd95f85fcab4392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac47f59b-8622-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615876904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876904, "uuid": "7246f772-8d89-4ca7-8984-ccba020f6ec5", "comment": "Malware payload", "value": "bd4ce5409a78f57c035f03c448fd3b19", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876904, "uuid": "1bfd1f5d-71b1-4093-8db9-9ed039c5d35e", "comment": "Malware payload", "value": "57857533a81a13b4eaa17f3516d5c5a9be138ee5dfa7b2c73788417061c9dbc4", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876904, "uuid": "1a3d36f7-559f-4332-84d9-f5d98caeb97f", "comment": "Malware payload", "value": "f8b559eb5eb472852437c5f3478aa24e5cfd0915", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876904, "uuid": "7638ddaa-85fe-44de-b7c0-4473c0952175", "comment": "Malware payload", "value": "d0e7e7c381d15aa0ccb75610ac54a786da64c9467a147fa960ee1a0c601cc6b76c25c214c668ef6916d8f53ad2338b8a", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876904, "uuid": "9de2a1d1-be7f-4f5e-bd4a-8fffc5f2d98e", "value": "1263E15DA5418076C352A93D930858E21C8A7062D997F41E2EB4BF067A3F1CB7BDF0E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876904, "uuid": "6236c1e2-d8e5-4359-b729-b79b0c79dbe2", "value": "1536:TlSmbtyyQi9sgVdolfovdrEEcpYdBVByM:TlxbtyyVqrAuEcpYz/yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876904, "uuid": "035fc1a9-045a-44fa-9a33-47ed982a1688", "value": 69666, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876904, "uuid": "e90307f0-5df2-4379-8eea-a602cc844afb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876904, "uuid": "9edcec54-acdd-412b-8351-dc3dcceb8494", "value": "modal_1176.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8968e7-861a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615873607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873607, "uuid": "326e2d07-d177-4bf0-8972-8f3c0a308553", "comment": "Malware payload", "value": "9e72681925e64f5de7c1549c1b9cb3e2", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873607, "uuid": "7b453345-5f0a-49b5-b050-1c48cae1009c", "comment": "Malware payload", "value": "5958cb7775ebbdcb84a6b278dc5074cad2dd55ce9eb06c7aeed4f08077470bd5", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873607, "uuid": "95263df0-7481-4d6a-a443-42fa5f1d33c0", "comment": "Malware payload", "value": "cac2cced890bae7a9ca73702f753c974dc640898", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873607, "uuid": "d8881f81-4e3f-4232-b613-6998a10aba78", "comment": "Malware payload", "value": "93896b6343f55eda1a4ef0a8f926c322972147bd37691886800b3ee8647287aaf10c8d51bf21e25044af67bb512ffaee", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873607, "uuid": "46e19621-0610-4fc4-9e6c-05a5e3c95b84", "value": "BF838E5EA164A0B9C336743C67069CD159887057D983B12F21A47E087AEB2C72BDF6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873607, "uuid": "13b56cc4-e6b2-41f2-b429-6d348822da77", "value": "1536:EDbXbzfoiIa8gVdolBQ/iJvLdvJ7WYHwPpgAUVOdxP:8ciIa81k37Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615873607, "uuid": "cd87d5a5-ec3c-487c-9f86-5332b4d062dc", "value": 81222, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615873607, "uuid": "fc02d589-606b-4f44-8de2-65da9e30ee55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873607, "uuid": "5496647e-3f05-4138-a68c-d6196f482ab2", "value": "modal_718.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a6557e-8617-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615872067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872067, "uuid": "f374d1bb-9150-4c80-b19e-e20a783eca25", "comment": "Malware payload (TrickBot)", "value": "e905846ca83adae7c9fa32e55ed1b826", "object_relation": "md5", "Tag": [ { "name": "mon138", "colour": "#D4B852", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872067, "uuid": "e47dc02f-3599-40b7-9122-5b89a40947c2", "comment": "Malware payload (TrickBot)", "value": "5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60", "object_relation": "sha256", "Tag": [ { "name": "mon138", "colour": "#D4B852", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872067, "uuid": "be7b122b-a727-43fb-bc68-08768ddb7831", "comment": "Malware payload (TrickBot)", "value": "daceb19ebb5b9938a49e39174d716d769f2d12fe", "object_relation": "sha1", "Tag": [ { "name": "mon138", "colour": "#D4B852", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872067, "uuid": "66be63ea-f94f-40f5-8515-0ffb25a00cf9", "comment": "Malware payload (TrickBot)", "value": "0a268a0f120f4b6de4adf872baf26cbb3edcddd7568f55814a6dac8897a520d6910be896b675b77c2022e249f0a2e442", "object_relation": "sha3-384", "Tag": [ { "name": "mon138", "colour": "#D4B852", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872067, "uuid": "e0696b63-7de0-40c5-aca7-1fe009a50628", "value": "E35402056BE199B7D0651B3044F6C2752B7FEC50A6A2834B2FC43EAB7E71B905D0839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872067, "uuid": "2e7947fd-1a67-4c1e-8b6b-aa9c5b265f5f", "value": "10692b69586a6cd6b934d4fc52bc47e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872067, "uuid": "ccb1299b-568b-4c84-a757-edf283d8e2c3", "value": "6144:0XbKnoIz7ZJrdnvfxvlFwS3Er3MRaXtktiqMLU:0XWHRRNCoRwSMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615872067, "uuid": "f221015c-b6c7-4f73-9f30-0882ff50bfd5", "value": 291328, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615872067, "uuid": "da8f6b17-460c-4175-a0cd-a649ae8ca41d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872067, "uuid": "0c1b5946-f01c-4365-8b73-5ab9d7de860b", "value": "linas138.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67bb252-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1615922555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922555, "uuid": "c8082575-085b-46b6-b105-7e3f1016e5c9", "comment": "Malware payload (ArkeiStealer)", "value": "12e9af1e0e3501aa6935e1d55fcb1e30", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922555, "uuid": "466eb47f-7f02-401b-97b9-9f6f34de73cf", "comment": "Malware payload (ArkeiStealer)", "value": "5c0e2b35b86934ee3a0ad590a888eda3375a86afd01b55572eda349d06fa9364", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922555, "uuid": "6674797c-0269-4450-b2da-6474162cc9e9", "comment": "Malware payload (ArkeiStealer)", "value": "0a3b508e358c354d8bb7253bbde7f4a070e9109c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922555, "uuid": "c6bbd87e-f9d1-4fb6-bed9-b34c16d2d1e7", "comment": "Malware payload (ArkeiStealer)", "value": "6a8550e459f091515bec39c2fbd1c5c2928b075868d747d6cea652eb0c9fd9a2c1971202258dc1b59f560a90541c3ad5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922555, "uuid": "5c3df877-0cfa-4d45-94da-b7a7e7dbd319", "value": "8BD4E100B7A0C035F6F722F4867642B879297EA17F24DCCF62D52AEA56785E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922555, "uuid": "20202c55-1bc4-45e0-ad53-cdaa6dc83aaf", "value": "6ce9d3d90c7fd3dde0888519f67222eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922555, "uuid": "c68cde75-8ff7-40a8-a1e9-682af462b171", "value": "12288:dsJnk6TrpuovUQAkCEFkzmY51zQWbAoywQBG9SRVvTWkVlllbHdAXJ:d0nroZsSzmY5+W1ywQBGyVdlrbHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922555, "uuid": "6e120a72-dc08-460c-b256-28f01c520e48", "value": 612864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922555, "uuid": "27bc26b6-b728-478b-8d0c-0c910ef6fea6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922555, "uuid": "a8a01aa5-a431-449c-b096-447187c796c4", "value": "12e9af1e0e3501aa6935e1d55fcb1e30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fa53c3-863d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615888401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888401, "uuid": "96b51365-4854-4c17-a2c4-e9bbb8cc90c7", "comment": "Malware payload", "value": "7fdee0e0d404f6ad70c302ebd6aff8f8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888401, "uuid": "31049c2f-a762-4b39-87d9-c8543a069443", "comment": "Malware payload", "value": "5c46a59fceabd95ac026637d58c9bcd909918d6d3a86db82a5686747004cf4d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888401, "uuid": "cb973ad0-7ecc-48d2-be98-b04246087b7e", "comment": "Malware payload", "value": "27c5c5c7cf3173c59127e7a736ba92ca6b23870e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888401, "uuid": "5b21e7b2-dc41-467d-9bb8-6a614adf6b24", "comment": "Malware payload", "value": "f57f40eb4b0d286a5b71ef8b6eeb5953d33fb77b82f23fc651769f9f2694416f46e9f0ee1cab19225bc3c4c09d98b980", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888401, "uuid": "e08d17b0-997a-44d4-82fd-d8fc76aa9027", "value": "74F36CE8E891CDD4CB8FC5D9561E7A941023FA79CAC36C9A4438F3F50BD267F1A1A850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888401, "uuid": "ab075ca9-bf63-4c6b-8d2a-0235637ba74d", "value": "3072:Wv6q7s4NjDqil/lPgZuIMfeyVKU3O+M0m40SE6KKuc1oXKqnra1kWKCc:WvRNjDqivoMfe2938ZWwKO2jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615888401, "uuid": "4c47e5f5-9f90-464b-8037-79ed55452582", "value": 168845, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615888401, "uuid": "a2d865a3-35d8-44c3-8b48-6fae567ad7ac", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888401, "uuid": "784ca813-b596-4bce-85a5-c431f0c647b1", "value": "Scan 002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb06e4e-8639-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615886922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886922, "uuid": "75bbd95a-34a7-457c-8818-39dddc42538a", "comment": "Malware payload (Dridex)", "value": "ef5e58bc7447a82df3dd521b742b1870", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886922, "uuid": "0c1ced6f-01e6-4709-b5db-22c36faf2bfc", "comment": "Malware payload (Dridex)", "value": "5d0abef8d0083d03c0923bf6c1fc38e3210e116febeaee8dd22523330323be29", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886922, "uuid": "7a783e6f-c952-45ac-b31a-92e70e0220fe", "comment": "Malware payload (Dridex)", "value": "133d12be67b5f0cf6e27d03bf15f989a0a524e49", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886922, "uuid": "ea83fe0b-179d-417f-ad66-248b99fb7cff", "comment": "Malware payload (Dridex)", "value": "5e043094108edb342e2deebddbb50eb9d323882b1d7e39d81ac1513f01a3a205be506e5da1d4c98e59dea8213fb58625", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886922, "uuid": "8886d2c7-9fd8-40e2-b431-60ab25f6ef82", "value": "6814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886922, "uuid": "2c3f2443-008c-4fe1-9d4a-18cfc3550b80", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886922, "uuid": "1f425c29-36bc-4770-9750-fef9a3c63908", "value": "3072:h1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615886922, "uuid": "12e32e8e-1129-49b7-9d40-f03e5638101b", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615886922, "uuid": "1b26d616-cf41-4f9f-982f-0c965d8f2db3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886922, "uuid": "d326c0e8-edae-4a59-8f04-e1a3f8ac2ef3", "value": "5d0abef8d0083d03c0923bf6c1fc38e3210e116febeaee8dd22523330323be29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2361bd-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918028, "uuid": "2f2bc29c-4e4c-4be2-a191-b54d502c5376", "comment": "Malware payload", "value": "7e2a0517f24a3aa9ee11a93801b03577", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918028, "uuid": "551418d9-0a7f-4f4a-9ad6-e34881998198", "comment": "Malware payload", "value": "5e7620fa41d37895740669507812ad7be73088aa661b38d9ff8dd563c0448b47", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918028, "uuid": "77dcaa56-eac1-4cee-a12f-8ccf9ff439eb", "comment": "Malware payload", "value": "25ce40a48968b55ee4111d89e231a4a885d93388", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918028, "uuid": "654d0630-2fa7-4314-becf-c4d59a4e0ad2", "comment": "Malware payload", "value": "e423a0ec175c26683648cbfe62177357ac8867c99db4c9d1c6a8adb10109668bb1c756faffda3e066466f2381586b138", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918028, "uuid": "a312b2d7-6962-438a-8246-a74a1da16315", "value": "B5F36CA8E990CDD4CBCFC9D94A1E7A952022FA7DC6C36C964438F3F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918028, "uuid": "71d037a6-9cb9-44e5-87f2-0e7ee47ad9cd", "value": "3072:hqSCZts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8e5id:vCZts6vVGt/2l8nxpKJTJznhdDT+8OG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918028, "uuid": "1c73b949-bc0c-4762-a29a-9dbae28cbc85", "value": 164734, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918028, "uuid": "2d7af7b1-e1c2-4107-b5cc-4be4d51fdec7", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918028, "uuid": "867d476f-c4d8-4a36-b86f-1666dee3ebf5", "value": "Payment copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54d261c-862f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882583, "uuid": "20a6ea38-d280-49de-81eb-4a8e8427bc2e", "comment": "Malware payload", "value": "f2fd69d006d954bb4c81c7258a97eb7d", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882583, "uuid": "fb71d337-ac0c-4b36-bddc-6fd6cba46ab0", "comment": "Malware payload", "value": "5e797fe41b7dd2c6328bf6173a97fca3d88fbf39dca38ef7a861c50d00d81302", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882583, "uuid": "4eebcd75-56a0-4b2a-b5e7-159f46c6caec", "comment": "Malware payload", "value": "b1b3b29d140d76e070de8ffef81d17239417800c", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882583, "uuid": "54d4a857-0c8a-4549-bc27-651e30412ae6", "comment": "Malware payload", "value": "e89843c533e8d8a76616d024cf25529b520828bdc5ef30315ef2ba728c957c2ef7b8a4bc156aa16b55fe1e9087434710", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882583, "uuid": "3379e7c4-db31-4ff1-9179-2c6c969d028f", "value": "EA63C10ED650B46AC2B5B03D931A44C24E44605BD887A52F32E87A0479AF1E727DFADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882583, "uuid": "3f092c6e-03d4-45ad-9164-5b5f04330768", "value": "1536:/nKf2Ax6WlfV5obwRMU0S/wIQKHPGiQL3FY:/Kuw6WlDoMmY/wIQ80rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882583, "uuid": "db600816-49c7-4481-b719-08f66cb342f3", "value": 68281, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882583, "uuid": "ac1362e7-97cc-4ca4-9197-f5243682cb7b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882583, "uuid": "0cc96c5d-1029-4f01-ad29-78f7ec37b770", "value": "dettagli_234.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691ceff0-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615890964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890964, "uuid": "0fdcb8ce-f975-4829-ab66-80d68ae14e39", "comment": "Malware payload (NanoCore)", "value": "1f280e2e3a71160b5cfa8f4c8a980c79", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890964, "uuid": "96aec397-beb7-42ba-bb8f-fb15bd4d00a0", "comment": "Malware payload (NanoCore)", "value": "5e9a86c88e1f0c7e4c31a043cf60be8629d7b95db1fd69ea8b768213772b5083", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890964, "uuid": "a5a356ee-4d66-403e-8c03-a70fc07f4dbd", "comment": "Malware payload (NanoCore)", "value": "84a56d0fbb749966df12296c02a70553b2fedbe7", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890964, "uuid": "096442f5-6c8c-4a6f-a582-31f99cb3dfd3", "comment": "Malware payload (NanoCore)", "value": "93b11e5f9507c610b40f262bd52ca79aa8de2223140e4572b6f4dc92ecb0ed3bc288f3745317f172d333589afa4bbfe4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890964, "uuid": "4f6037c4-7250-42c0-b664-f4b26c5ee896", "value": "99E35FE4996650E7D27CF5758C811D42AE32A0F7F1245D3BA58F82C3C6167A23CC86AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890964, "uuid": "3b454810-e5a3-4f7f-927b-4c388b29f6a8", "value": "1536:Xu1kHI5UawJDWaPm/DEPHo2A09XSgNrVAXA2+o+F8g:XuOHI5bwpAGq05NlqZ4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890964, "uuid": "938bfc9e-8257-4a84-93e7-c9c78a72581b", "value": 153600, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890964, "uuid": "86a50fd6-58d9-48db-a3a6-f7dc162f455d", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890964, "uuid": "527ac8e0-7866-4f4e-a7cd-e5d4451bd849", "value": "PO_6620200947535257653_Arabico.PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ab56c1-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1615917985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615917985, "uuid": "13a6e68a-a0c1-413b-a6ab-33d58e8f0a78", "comment": "Malware payload (DanaBot)", "value": "cb045619ef946635e204ab07993be8bb", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615917985, "uuid": "a0be4d7b-2c38-4780-8412-7f42e6ae3393", "comment": "Malware payload (DanaBot)", "value": "5f8bbd5b165b49e1cadf31a88eb1d0e714c60f77ae81da2e727dd4ca99e80aec", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615917985, "uuid": "326fba39-c28c-4593-a95e-c033026fe4ac", "comment": "Malware payload (DanaBot)", "value": "415a7f46d7aecb72d54acbe062754c5bdfdd5bcb", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615917985, "uuid": "da693ff9-81c5-4f34-bd2d-7ee1d6a06688", "comment": "Malware payload (DanaBot)", "value": "ae0d208085a22cff9c6481ccc28c9e21c7ce4e64fa967b9f676611d75a073ffc01acc8d1958e3fcbceaf1d3ac36f1d89", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615917985, "uuid": "92b63397-7831-4676-a0eb-925388a0b2ef", "value": "27A60240F34160B9CAAF5A375768158A83BF83503BD6BBF51D9648FAB382466C570ECC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615917985, "uuid": "7e15ade9-8d28-45ec-83f5-274d5e0ea8cb", "value": "232b3339a4b09d8e6017c840f891b351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615917985, "uuid": "570e111d-5a25-4e87-8291-e6dd8d409479", "value": "98304:New4yUmr3R/Kl750JLf0HKs/ZWP/YcwBpAfKKH3o/ibkH7B7WJ8zVRE:NqyUmr3lK150lfcpcwBoXbkHpk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615917985, "uuid": "5f7a9d50-6c6e-4e90-90f6-0358f2ebb245", "value": 9854464, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615917985, "uuid": "ed8687c2-edc4-4b25-8b11-bb62393738d3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615917985, "uuid": "77883fb4-c152-4481-aeb3-15e2c258ca6a", "value": "clopzpa.dx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8cd12a-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906912, "uuid": "932d044f-1289-4d43-bb6a-f1cc45375619", "comment": "Malware payload (AgentTesla)", "value": "32e65b65059398948d2aec9ad65ec8a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906912, "uuid": "b602b94e-ebd2-449b-a0c9-3a6cdb52af3a", "comment": "Malware payload (AgentTesla)", "value": "6117ef5bdf129b7cc226a3bb9e3734f1b7502ab893603c4368685017f31a0677", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906912, "uuid": "9079f047-a847-4f89-878f-ba3dc9a74cf8", "comment": "Malware payload (AgentTesla)", "value": "ad78bca326a847d4da74974cfa6fe76a3fa25267", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906912, "uuid": "97cd1959-0b17-4b04-a312-35e11a18ad82", "comment": "Malware payload (AgentTesla)", "value": "7cb49cadb3b8899ab3ee07d4e53de3a9418643c42e273b7f8f7b5285bd13fba564a84260e83ebcaeb38b7b21b624b701", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906912, "uuid": "e2357673-8dba-4d10-8217-465827236bd3", "value": "07F4F128A658992BCB1CF0BE04E3136C4F305D17E6E5D3C76C9675A92B847EC280E9D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906912, "uuid": "b602373d-8765-49ed-acb0-fc5dc78e571d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906912, "uuid": "a8f8c697-6ee6-4b2c-88f3-c485afb194bf", "value": "12288:NV+ssWKZEjm70KaElX1NQYsEXAj6RNI0XANbDFAdUguuZEOBpmZeZdUPpNoEupnD:bgTX8SA2RO0wNFMUju9I0O7oEupnh3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906912, "uuid": "f4f5f499-1ed7-4099-ad94-35c4a676871f", "value": 767488, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906912, "uuid": "2e2226e2-6300-4339-b758-0b969141e4ec", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906912, "uuid": "2e0e4ec1-85f5-4724-a3c0-4b02217e709d", "value": "PO0172882021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f76bec-8667-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906585, "uuid": "0589cfe4-d7a3-4298-80bd-00ab7e39faa0", "comment": "Malware payload (AgentTesla)", "value": "e37ad95aa90a7e6370d78e9ae506a0fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906585, "uuid": "e3eab6e0-d410-4ad5-beaa-d2efd19b0f63", "comment": "Malware payload (AgentTesla)", "value": "61d71ab4e23eba8055de07d4283a6e2f70e00fbb3c4fdeaf8ae8258fafe340f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906585, "uuid": "edda6a99-6347-4d07-8eaa-c04c5c9b518d", "comment": "Malware payload (AgentTesla)", "value": "ae9734bf55e9f883f5fbcbc0b692db7a0fe2e293", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906585, "uuid": "f8bd29c7-6c0c-4bbe-af68-3ec01de70ea7", "comment": "Malware payload (AgentTesla)", "value": "58c9f5406aec5b0cee985767635ee40e5778948a9c040a715528cea86ef067e99be32e600c1168936f76b12ed86bfcf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906585, "uuid": "4c63258b-8c0c-4fb9-98dd-f2e7ac0ed658", "value": "F0C4E0D2F11045EDEC6A1A7224271DA669531CBEE6B4E11D71F936233FF31A3402EA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906585, "uuid": "478405e7-0a7d-4c47-bffd-c8987e0381c6", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906585, "uuid": "552a5cd5-03a3-49e1-a637-72218541a061", "value": "12288:/OW0a8Y2BfqMsjpfVjF2t+4UT1wB2DH0P4uPDucfMvr:Ya8Y0qxjUuZk270P4uLuoMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906585, "uuid": "8cebf32a-0d98-439e-85da-4d8d415f5e49", "value": 555191, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906585, "uuid": "3a52613b-b565-4c6e-a2bf-225dcd072fa2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906585, "uuid": "fcbc668c-5a78-4af4-bb3c-46520658e2ba", "value": "222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ef7652-8671-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615910736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910736, "uuid": "5dca3b14-c720-4f7b-b54d-2149b7f17c72", "comment": "Malware payload", "value": "a24571eb4baea7a5b67480d524668617", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910736, "uuid": "97139570-ab46-4117-91aa-417a52fe61e3", "comment": "Malware payload", "value": "623119afef4f91cf052823dd4d6b1ec9f04dc7fbe76a313035e0e4aa00888454", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910736, "uuid": "fd63ba50-142f-472b-b166-cc66b70cdc17", "comment": "Malware payload", "value": "1471a4b801b065b315f130a5d512dc7597c71657", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910736, "uuid": "02d3391a-3647-4620-90b7-64c9d54a2aae", "comment": "Malware payload", "value": "c70be406ff428593018f85cc8363635c259506197972371e24f7161011a8a46dca83ac0268ca80d8a92d6ccf93fcc9a1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910736, "uuid": "2cfbc792-a983-48a0-a45f-d7a4e3eedc7b", "value": "30F36DA8E991CDD4CBCFC9D94A1E3A952033FA79C6C36C964438F3F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910736, "uuid": "0c45dc0d-b059-4c4d-a795-f4e220e0e024", "value": "3072:Cv6q8aN9Zts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaESF:CvkaN9Zts6vVGt/2l8nxpKJTJznhdDTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615910736, "uuid": "5462e482-5851-4e38-888a-a0dba0e61860", "value": 167472, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615910736, "uuid": "07106bc1-7f50-4b77-a2a4-c46a17db03ad", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910736, "uuid": "647aa4cb-a13f-4536-8ebf-4b711b9e4c30", "value": "Purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d1bf5c-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1615893885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893885, "uuid": "d61bb238-4de3-4613-bd3e-9ade747ea231", "comment": "Malware payload (AZORult)", "value": "2e947f5ead2f5d58124c9923e1e2849c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893885, "uuid": "2839186c-bc88-4e3c-bfcd-c8271dac8dc7", "comment": "Malware payload (AZORult)", "value": "6296905cf4a331aa9a278c3df71c8e6cb3c1e60b48402696264aac0f4d0df659", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893885, "uuid": "998c7fea-761c-4098-8024-7a0eaed74de6", "comment": "Malware payload (AZORult)", "value": "711f35a83681fd73b23fd2f2193fa08ad953a546", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893885, "uuid": "3ac64e44-2709-4fa4-8c1c-a0d611718f71", "comment": "Malware payload (AZORult)", "value": "59d1b8aeb7f99c299d4a375ef8019da886fe1ce2b959419efba09db56aee6f0fe4761514263f8bdbcdd3c7174abe217c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893885, "uuid": "f19d7fbd-6da6-4313-a04d-894ddba7c41d", "value": "A8647C21A7A1C034F5F305B546B282B8A5397E71573C80EB63D02BDA9A386E5ED31F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893885, "uuid": "28c37dac-f55c-4a93-b8fe-10da49dad94a", "value": "6540c12e2e2c0b7741803a1b0f2f06ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893885, "uuid": "7ea619e9-183c-4ee5-8f4f-878d6570f98e", "value": "6144:9mO9ueehDC7PkPOhbJT06esz6q0s5hxe1JDH5GbhjyVRcUQ6+Og0b:9d9+hDkPkPOJT0DsVMPDH54kR9+Ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893885, "uuid": "87f38186-e855-4a5c-9635-d061072c03c0", "value": 331776, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893885, "uuid": "0ecf13e2-d746-487b-b1c9-ef264d428643", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893885, "uuid": "bd09ef40-15af-4b73-94a6-7825dcbbfd57", "value": "OPEN01929291000_2021-03-15_07-28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250be416-862c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615880972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880972, "uuid": "eb3e7642-a63e-4b7a-a6f6-18663550d200", "comment": "Malware payload", "value": "edfe75e39b2aebce261feb1be407e92b", "object_relation": "md5", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880972, "uuid": "ca8c5937-862f-4908-8791-a37ccc36f756", "comment": "Malware payload", "value": "631358be748a3e8fced6e852fc870f850e42207f66e0d77c54d3e3d89427125f", "object_relation": "sha256", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880972, "uuid": "1f87f52b-3aa1-4897-97a2-58a08c2bab10", "comment": "Malware payload", "value": "b2172e6e7f7d973db33a47d31af4f5010cef723e", "object_relation": "sha1", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880972, "uuid": "712a3bb3-c938-4ec8-b975-fe9db16357d8", "comment": "Malware payload", "value": "caedf46335f514e39800a7861e4bad3a690411e152a8731a698a78776aaf13ea6e52d227c410f1dc8d10b5423d8c6805", "object_relation": "sha3-384", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880972, "uuid": "3d23bd27-b612-42bf-93d7-40d2d15a6861", "value": "D2C55C22B245653FC4AB2A7A8D37A6589C3FBB7127168C5F56F4088C8F355402A3E74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880972, "uuid": "a60153a3-e341-4618-8233-e70190fba74f", "value": "f871e7b97444b8f61dfcc85dbfa5aa2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880972, "uuid": "54561d49-a620-46d1-ae88-54217be2c76b", "value": "49152:7Ke/YbM8YJkQZwSXsORKUMszejaMT71h7u:ODaNBSOG1hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615880972, "uuid": "b899e93e-4ea1-40a6-ab1b-bc98616a3eba", "value": 2685016, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615880972, "uuid": "5dbc4b80-ace7-4bdb-986e-53f45a441ee8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880972, "uuid": "ef7b8c34-b1cd-4929-be4c-0c6d01db6539", "value": "631358be748a3e8fced6e852fc870f850e42207f66e0d77c54d3e3d89427125f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b936079-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867427, "uuid": "75fabcb8-819a-4fab-90f3-a7a2aff74091", "comment": "Malware payload", "value": "8ba4353b1b103567757616d21314177f", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867427, "uuid": "67ae6c43-a424-4b62-a9e8-c83ee1bd289d", "comment": "Malware payload", "value": "637e21b710b392153648a72ca2ebadf6f4dc908371fe2c2c061bd57f7b2d7afe", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867427, "uuid": "54fc6a04-8f05-4ca1-95f7-70f2774796db", "comment": "Malware payload", "value": "bd1a3e034f405ef0efd56e1b81387e4a28d093c3", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867427, "uuid": "31e96c18-572a-406f-b75e-6c0e1a8530f4", "comment": "Malware payload", "value": "446d3c2168162c74b31c172c1e486bc1b6e8e70157e08c30ce00c18b938f6602c44167fa2caecf9661ec599b685d549c", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867427, "uuid": "9a8507ee-c1fb-49dc-a2f6-227bf9480a7f", "value": "914302DA2157297514D4983EA2873AD7D0932E718B2AF92D113EC1BB6CCF4E10858F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867427, "uuid": "0a6c9e78-eb92-4fca-b4c7-d04bf2ce9669", "value": "1536:dOWx9IMgvPj3gb5mnytkNW8iVMTzRCNwWF3bgr:19IMIMg4+WETzRCNDFLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867427, "uuid": "1fb7b7ee-c469-45ed-919b-af06ee9649c3", "value": 59693, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867427, "uuid": "455ebbe4-c92b-4bd0-85b0-1767123f7d8b", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867427, "uuid": "17510b8e-aaf2-43ee-97b6-e8b041a86319", "value": "attiv_2417.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae9cdcf-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615875962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875962, "uuid": "4582aa5d-42e6-4336-930e-dcdb4b5eaeae", "comment": "Malware payload (AgentTesla)", "value": "f192f19623b557b91493587c8eadb256", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875962, "uuid": "cbbced08-b64f-46f6-9012-c356a3a2e534", "comment": "Malware payload (AgentTesla)", "value": "639aedb92d3fa814549e7719e0e2cf67c4c3ee0fd9fd92619def557b159f9ca0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875962, "uuid": "ad20c633-d32f-49d1-8595-147c18525ade", "comment": "Malware payload (AgentTesla)", "value": "83baf761c13fde834d4ed7da4d2ede734aa645a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875962, "uuid": "52d147ff-bc1f-4350-916b-4b51a9d135d3", "comment": "Malware payload (AgentTesla)", "value": "f93e25be7ab61aed26c37fc88f241df032b66a1560e3db208ee5b908fa9d4fd21bb4287b50800afba76c70e98b0fe0dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875962, "uuid": "2fc22237-c39b-401b-bc6a-6de54ca8d099", "value": "3BF37DA8E991CDD4CBCFC9D94A1E3A952032FA79C6C36CD64438F3F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875962, "uuid": "99ba26b1-b45c-462d-9828-224240c28bfe", "value": "3072:Yt2dZts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8e5p:YgdZts6vVGt/2l8nxpKJTJznhdDT+8Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615875962, "uuid": "0ba82cf8-2c72-4764-bc4f-656b71b76f6c", "value": 166684, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615875962, "uuid": "8c06427d-fc23-40e8-aa70-12f7b5567508", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875962, "uuid": "544e77cd-34c8-43b5-8bb4-99d1254a9e0c", "value": "Debit order Instruction.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a1e7a9-8640-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615889613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889613, "uuid": "49cfea70-2506-443f-bf5a-5a2f762a40f9", "comment": "Malware payload (Dridex)", "value": "8552e8721e0b222abd564304603f0266", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889613, "uuid": "0a61661d-7766-41f2-9bdf-41df55a1649a", "comment": "Malware payload (Dridex)", "value": "639f61b93ebc1163a5f26ca89ec46c679e902d2f741d6bcb05d09a2074c1945e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889613, "uuid": "d06790bb-6f71-4286-85b9-966a01c520cb", "comment": "Malware payload (Dridex)", "value": "dd8754d024887b9c1ef13eacb500deccbb44129b", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889613, "uuid": "77b648d5-a24d-4667-9145-1c4482638b8c", "comment": "Malware payload (Dridex)", "value": "87a05c56f8815e19e92d7c8da23b70e424be976d84b6078906fe5e3be29d4be4b4ed852389e071b7615d73fb73c4e08d", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889613, "uuid": "1391b589-63a6-40a3-b5ad-32527d1fed88", "value": "11E2BF56C907495DCA2B0078D34D82F4958C3544A079EA7FBE24E2DC07936D3A7AF2DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889613, "uuid": "8d53f689-77a8-453d-a0f5-87eeb7fac977", "value": "384:M/QSxm4ZBf2koeu2UllJBKA73OX3HnTeIsjbUyjPersnvlc54QUSoQ+vbyNRnJ:M4yVuleu2iBKAKHHnTeIilUucmuVNRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889613, "uuid": "3186f607-d1f4-4be6-9adf-9188a17cdd3e", "value": 31290, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889613, "uuid": "5e67a9aa-58f9-426e-9c3b-fee325ebb7ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889613, "uuid": "483dca15-c9da-460d-9342-c42ebccd9bbe", "value": "Fattura_33423.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d05535-862e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882018, "uuid": "a473e8e8-228b-4d28-9883-b27d928729a1", "comment": "Malware payload", "value": "bc88f989eed24eabad8f14dc9676f36f", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882018, "uuid": "109c77d8-55a3-4d4d-8219-e7b877dc4df4", "comment": "Malware payload", "value": "64e14dfd467082886fff36d2ed44c155ee07fa363c52f6c73d7c62ab23d973a2", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882018, "uuid": "d944662e-5da7-4e53-ae40-840500566986", "comment": "Malware payload", "value": "e4b9fd2a09a654f5eaea426a203ec37a71b03bc3", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882018, "uuid": "c5034950-aed7-4e2a-a69a-61d78ea264b3", "comment": "Malware payload", "value": "e7b83c833b9fda8c5dcf8bb21183011e1fc83700cbbeeae61994d385fc88302c1cb4598f48449cc6004eedd5c5c4556f", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882018, "uuid": "53eeac02-8237-4a9e-bd41-e811c8e1ca54", "value": "C75302445DEBA0B058E9C64C04B7C546C5B73A17B04F813D2AFF52E85A8EB39187A4EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882018, "uuid": "a6c9aa21-f3a5-460e-a3e8-0f8f36898d1f", "value": "1536:ogTP2FLF7MJ5EulyThpdBo0BgexoCGNida8Twirm:og6ZF7Ac7dSegeuCG4d7wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882018, "uuid": "05ab38ad-f892-4993-a011-9c50ba7e5fd7", "value": 66491, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882018, "uuid": "a0fafd9c-f0ba-4fb5-aa77-ed397f235375", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882018, "uuid": "56153e3a-5621-4e87-99ae-b632649c3ccd", "value": "notif_949.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1eb5cc-8647-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615892711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892711, "uuid": "a98ae031-fb15-440c-b10f-f00998b8b191", "comment": "Malware payload (AgentTesla)", "value": "ba8a91ba1fea5523b6e281df0c0a6288", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892711, "uuid": "ff3bca8d-6f00-4bb2-acb5-ac5f0ac21e89", "comment": "Malware payload (AgentTesla)", "value": "6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892711, "uuid": "1972eb60-cc4f-4988-81b0-6acaceafa3b5", "comment": "Malware payload (AgentTesla)", "value": "f5df5a4ccf60035d0e17e60a2cd4b0b29b84217d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892711, "uuid": "5ab9876f-1b55-44e2-86ff-36d7ab6f159b", "comment": "Malware payload (AgentTesla)", "value": "565f2b0108fc4f8d1145e73b204029912a1d38dd9f8670dd413218b4ee7fd1519e5d74ef351c04fd5c0919b01fbed902", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892711, "uuid": "0fad8502-3897-4ea5-8245-d5b3cbff83e0", "value": "6F15235882539B205970BFDB93C05FAE501C79EFFEEF84E08646F9B640A262DB1503E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892711, "uuid": "d13b965b-7c4e-4201-9466-7a5e8d5963e0", "value": "24576:1w1KocplQlpYVd0B5b0RaxHH380mPNboXJQzNAV47yK:yKoiylpYVdIdOax380PJXKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615892711, "uuid": "575f20aa-197a-418d-ad2b-851036e4cdd1", "value": 883238, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615892711, "uuid": "e7975b39-e745-4949-821d-eeafd49d8116", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892711, "uuid": "f04ac75f-91c3-453f-920d-6a0738503683", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18339e04-8604-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1615863770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615863770, "uuid": "3a013c1f-dab7-4600-b37e-d89513e8290a", "comment": "Malware payload (Smoke Loader)", "value": "04290323e3dae758ad39580ec1e4e402", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615863770, "uuid": "d4ce376b-c273-4379-bc66-70ef746d0d6a", "comment": "Malware payload (Smoke Loader)", "value": "65af1ef671dafde80bef708f3001a4d94eeb54fb9193d409002d4bae52fbd99c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615863770, "uuid": "c8e8346e-7ae7-45f6-b6eb-a9cda15c19ed", "comment": "Malware payload (Smoke Loader)", "value": "c806dcd9c2882cb340c977a67a4ce85ec567c084", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615863770, "uuid": "de7a13d5-c36e-4bcb-8d5f-7d3e9e9a5449", "comment": "Malware payload (Smoke Loader)", "value": "494e78770386a4659acda1748552bcbe14e4ce3ab43bf8731c2ad4bb130f8a2c94c19aec1ee9f43d0d14949faf390cf2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615863770, "uuid": "1d508796-cf7c-4525-92be-826a05cfe131", "value": "B4F38C1076E0C473E056157188A6C2B50A3AFCB64F2566C77BD47BBE5E312E28A3634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615863770, "uuid": "3c0a6624-44bd-4ae4-91ca-88b29d364d16", "value": "0db5122541c535013699ed54854d9680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615863770, "uuid": "65d24e5a-f891-4ebf-81a3-acc8f272786c", "value": "3072:cAEdyqWRYzX4vn+aFOWTdWGxisHWK5Xzqp:p4+RYzIZOCRxisH5zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615863770, "uuid": "58b361f5-401a-48f8-bd75-d3e475f02de3", "value": 165888, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615863770, "uuid": "18af20de-a2e2-4181-b3f0-7fe2810104c7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615863770, "uuid": "53db0b72-5176-4a1a-b7ed-f49bf0d7d62b", "value": "0umvx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99523dd-865c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615901810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901810, "uuid": "eb936c23-ab14-4707-b4ea-7f839e63b621", "comment": "Malware payload (Loki)", "value": "b4d3907a0852009a3639e2213920debc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901810, "uuid": "1c49cdf4-c5fc-4bd4-88cd-4bbe5639e260", "comment": "Malware payload (Loki)", "value": "65b6cc575eac7e69ccec2d892f7abd25965a301c4b02a7d82a977918edf3b16c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901810, "uuid": "245e9863-df2f-46ed-ab68-7fd1313e9743", "comment": "Malware payload (Loki)", "value": "7e1460bc3e8bc53964688dbfce933c204eb1cad8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901810, "uuid": "85e95e35-b14c-4dbf-a2e8-8da477a0f9d2", "comment": "Malware payload (Loki)", "value": "fe904f9dbc6136873143624d17e54211b3597b413a63aa2d2cc45fbe5bee8c760ab88ab8b3fd93d8da3484894846ab83", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901810, "uuid": "f93ff6ce-c8b0-43eb-a609-d79876476a02", "value": "97255921E6946AF0F03973754832233053FDAD1A9626EA7D7D4431DA09B4AC185F3EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901810, "uuid": "5531e683-e904-4285-b834-3402de199de1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901810, "uuid": "a21981b4-a539-4757-8c67-96a046bf15ac", "value": "12288:YxfouKqS5AhBFOFdMZ5Rf1BySYOGedqPry/61:YrS5AhBFoY5hSFvya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615901810, "uuid": "d8d0cd11-a784-4c40-bb3d-90c2aa0d8378", "value": 970240, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615901810, "uuid": "13637ef3-8650-48e4-bf7e-4a4cede119c7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901810, "uuid": "5bed019c-258a-475b-aa3c-33312bfded8c", "value": "INQUIRY 824629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a818129f-8629-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615879903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879903, "uuid": "a00850ee-be11-4764-87e7-08bcab7c8854", "comment": "Malware payload", "value": "2b520cb9ac3714f35fa4b6d20a3910c1", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879903, "uuid": "1522add3-ee06-4cea-b3a5-080a25aae476", "comment": "Malware payload", "value": "66705441f12de8bed48779449b93ac73a4c3d3ccd1127e7d81f13d034c7688f5", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879903, "uuid": "e256b4e7-c45f-4e6b-b560-36b0fe2b0dbc", "comment": "Malware payload", "value": "05a708c65514d84639b7810088488acdc33b6f97", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879903, "uuid": "b862a123-c9b0-4b7f-a131-5f09fde8a471", "comment": "Malware payload", "value": "d7e9f8733a503d2ed6c91941fd85816f320142b8c89774b2ed5fd9df55313ffb43edd8e335308cf6f95e16d487771559", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879903, "uuid": "a7f8634e-cd41-4ccf-b4fa-f00700404e2c", "value": "9A63F20FD1241166C2F6B93EEB140DE21E0E15199DC2710D9BF07B455AAC287A7DF2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879903, "uuid": "63efbf59-71c8-409d-b8a8-70ffaed70dae", "value": "1536:br0tRwxdNBx0f6tmgH4At2tdLoJLxqdsq0ZQ+yIQ:/BLNBqf6ttIox/tQ+yIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879903, "uuid": "8cc7af56-56e6-4aea-9ee0-a6ff290ad193", "value": 67158, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879903, "uuid": "ace93c31-1540-4b10-b845-eb5d28acabb4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879903, "uuid": "5d176962-ea05-4251-9d21-8728c79127a0", "value": "notif_2920.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9cdbe4-864d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615895158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895158, "uuid": "ff7c031b-c7dc-448e-9d28-2e7742afbdbc", "comment": "Malware payload (AgentTesla)", "value": "210481528255fdc519a555fd1374936a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895158, "uuid": "f16c3014-6422-425d-a301-d8dce045f867", "comment": "Malware payload (AgentTesla)", "value": "679be301fd0f48899057062006f88c95c173c1532e955c1c99ed6a8135b793fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895158, "uuid": "a8fdf66f-d008-4806-946a-6adf828f5c0b", "comment": "Malware payload (AgentTesla)", "value": "4701e425f36a1b6d45668c90dc482dcb7151bf29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895158, "uuid": "ca28c558-ad36-46dd-aab6-0a0b65971243", "comment": "Malware payload (AgentTesla)", "value": "e1004cf3349a3ab86d19401561cdcf9a39e8477a918f5294d48f4ae81e1714bde8b81e8a59d2bee630614427ad3c6564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895158, "uuid": "e5e68b78-8f86-434e-8be3-e2495a345cd6", "value": "ECE423152F524C3248EE667FC0A1CF52E96415CBEAC6BA09539A97D0727EE738CE3502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895158, "uuid": "b95bf0be-edf8-4756-8714-017c0fc80c44", "value": "12288:L8P3DHXPkcqSpsBL9ZaJTewkb7TZDo9+/zq5KG2EC00P4OWK1:Lg3DgL9ZaNeDbAZ0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615895158, "uuid": "38e3aa4d-9cc3-40f5-9060-b233ddd7257e", "value": 696260, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615895158, "uuid": "24fbbf30-98c0-4560-b3c8-1c482c248d90", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895158, "uuid": "33f4fc4b-dfcf-469e-b24c-2b0d4eb66180", "value": "Swift.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5e2041-8623-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615877065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877065, "uuid": "f1a8d36c-2c24-43ea-b132-8175372b4d86", "comment": "Malware payload (Gozi)", "value": "e57116d079e5f8532959ac73fa54211b", "object_relation": "md5", "Tag": [ { "name": "5500", "colour": "#5AB9FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877065, "uuid": "032ceb34-16b4-4342-adf1-c4dc0fb62aa8", "comment": "Malware payload (Gozi)", "value": "68c1d27603528e896c0d5cab01240c441b4cc08797faf0d4578261b824d07f82", "object_relation": "sha256", "Tag": [ { "name": "5500", "colour": "#5AB9FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877065, "uuid": "cae56887-5e71-452a-b42a-2ceda8c19e25", "comment": "Malware payload (Gozi)", "value": "3c4615f2200c1d01c5a1880bb1bc2c072117ddf8", "object_relation": "sha1", "Tag": [ { "name": "5500", "colour": "#5AB9FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877065, "uuid": "14071896-d7a7-4fa3-8341-2f40fcc4cbf9", "comment": "Malware payload (Gozi)", "value": "ed78119bfc279096b2b6483b4b4bc039ad3bd51ddfcced4e86d9d8a93ac487f3026bc725b0327cf1d60412262c775958", "object_relation": "sha3-384", "Tag": [ { "name": "5500", "colour": "#5AB9FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877065, "uuid": "6f787bb7-f214-44b8-9e8f-8ef6d35f3924", "value": "20A4DF2176C14276C133913A82B4E4659FBDBC721B6898CF339D153B4F35AC28637A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877065, "uuid": "73b42e54-a884-49c5-a929-2a608246cd0c", "value": "a630252fecf19c6a1d5a12714d51b100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877065, "uuid": "a44575ad-bba9-41ef-9a36-553807c036a4", "value": "12288:DDPwaYJKdJzsyFyA+GXigqhaDqsAR4LuTSAuAyo:DDYVNyFyz86BsA1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615877065, "uuid": "b2bb6dfe-8829-479e-b9d4-3f793058e018", "value": 467968, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615877065, "uuid": "4d30c0dc-7cc2-43e1-a1f1-69fd4939ad6b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877065, "uuid": "441df81c-33b6-4c31-8af9-9e5ae9f27188", "value": "file.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a63e0d-8678-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615913559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913559, "uuid": "47f9f24e-c4a3-4773-ab36-2a32c2772f24", "comment": "Malware payload", "value": "380354140a1ea78238a8865c62a82534", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913559, "uuid": "a745974b-e33b-4b86-a1a9-81cca4927f4c", "comment": "Malware payload", "value": "68c873617d2214b157763e54a7fc9ec567d0e67984af96bca5525e13e7423fb8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913559, "uuid": "f808b849-e2bd-464c-aa73-c51c9c234885", "comment": "Malware payload", "value": "3f2f21bbc9bd044773c3d7f55ebccb8b0f563cdb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913559, "uuid": "15805e3a-0f91-4f90-9dbd-29e483e2399e", "comment": "Malware payload", "value": "afe73d8f049bb44b5e88f1b917aeb1682385049706bdb939367059f1ea033dbc02ee93cc0ff4605c953224248a3af9aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913559, "uuid": "0f190d95-7205-4746-ad0b-e19e14e79241", "value": "23C423FBE94ED35C7C5C5E1614273B469AB9A07748A6CA32DF305C0A0025B3EF8E4C99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913559, "uuid": "2d1e9ff9-a729-4b09-8638-c518f823e614", "value": "12288:sQsvFc/oPHruka2XmvOugqVfqFY0o2Z7jc:sQf/YLurnvOQtqpvdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615913559, "uuid": "e0a0d87d-419a-403e-adf3-eecf51b5f6be", "value": 547418, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615913559, "uuid": "0adac349-2003-4e34-93c3-3b752a0747a0", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913559, "uuid": "75d498d2-d6d5-4c1c-aeb6-162ca94095da", "value": "cotizacion.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a570f075-8629-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615879899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879899, "uuid": "d9339307-2c59-4cc4-8782-5461647a5525", "comment": "Malware payload", "value": "d73a7db9f19b66c09e831dc8b9de6e8a", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879899, "uuid": "1dd912a2-26bb-46a4-ba6a-22fe37233680", "comment": "Malware payload", "value": "6902a1d34acdc62f6f9b0722852c9fd4a0ec8d05d9ccd936257d7a0224e7c3e4", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879899, "uuid": "f210e930-5d71-458f-8158-e2d6d7ebf42b", "comment": "Malware payload", "value": "74532462f7debc64ec2bd9da5dfee6514db60309", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879899, "uuid": "4b248b81-f7a7-4b02-b6fd-1f4718fb341a", "comment": "Malware payload", "value": "4c0eacb06397b4285f88a5500ae603cbaf30be55726cb63c1e38f61cf1db6e115f17a4109c3c7b5484e4f265d0ee7f34", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879899, "uuid": "ec1f749a-417a-4a24-afa3-26754ccd9eb8", "value": "B963D06DE14060B9C373B47C52098CE6594860A3D896F52F26543B49BEEE2D3278F1FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879899, "uuid": "26e6c6c3-5d51-45d5-b797-5dac19d3779c", "value": "768:Emr+j4U0ni73o4i71zbsMWNxKvtU6rgkB67hjolhTXqJNnZRP0cNYq6Pqv8BumYh:ZrBnoiZsZwvCKgVdolhTANzNYqpVmYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879899, "uuid": "db323f63-12ed-4514-8146-cb9f4b6f9271", "value": 68203, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879899, "uuid": "27ce62e2-008b-4dd9-be8d-26653d42febe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879899, "uuid": "e0916c73-40c7-4c5e-bf6d-40401298f4e3", "value": "modal_2276.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581ee498-8688-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615920571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920571, "uuid": "f8c8729f-bce4-4e1c-bb32-0b4fb886853c", "comment": "Malware payload (Dridex)", "value": "5616ababb150d1b9c0971b827b89bfad", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920571, "uuid": "de126211-7231-4fac-9eb1-d3f80ee6acd9", "comment": "Malware payload (Dridex)", "value": "69d9b90dbd78c5454b080b5cab8e83c499febe351cf1b74624f90870a4915814", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920571, "uuid": "c2d286ce-bfc0-4fbc-aa57-ffa00c18e9c0", "comment": "Malware payload (Dridex)", "value": "12fcab7d9c9aa838d84c79c8fe723d6c4eda2202", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920571, "uuid": "4ef368f8-b697-4e27-b444-6eedf12626dd", "comment": "Malware payload (Dridex)", "value": "64074da4c0f1919059a4f6b7e921254c3ebc43d8c8cb836c85c91f5be461bc6b353a7c177068b9996886e05f603b8c11", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920571, "uuid": "9b6ca7d3-1684-4b5d-8c29-9ccf7a432173", "value": "2514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920571, "uuid": "ce765142-437e-46c7-8fe6-bcd7c2601c73", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920571, "uuid": "25693ecd-2c5c-4110-a4fa-88323eabf5df", "value": "3072:a1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ii78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615920571, "uuid": "3f3db171-ae18-49de-b045-41ee78ef84d6", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615920571, "uuid": "cb84a37f-a638-410a-8101-100a5f1994f9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920571, "uuid": "85f94aac-ecce-4742-888d-365347c15d48", "value": "69d9b90dbd78c5454b080b5cab8e83c499febe351cf1b74624f90870a4915814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb85d97-8629-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615879889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879889, "uuid": "9e8a5e01-504d-48ea-8ba1-8bf87be021cf", "comment": "Malware payload", "value": "d3ad795822e768923994d94a8d5547fb", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879889, "uuid": "f33e2b64-cb34-4e1d-99f9-fa78df44d800", "comment": "Malware payload", "value": "6a40cb1857b47686d0093057b2a3e03cd7c2e342239388751fe93eb3d063493c", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879889, "uuid": "68747af4-18fa-44bd-b246-41959d41554c", "comment": "Malware payload", "value": "1ba77630940332c6a7725535dcc69a0101ab7877", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879889, "uuid": "076d28c4-d4ad-4cf9-b942-eb6f256bd24e", "comment": "Malware payload", "value": "024c0864c2dfbcc6400815ba69a550ff74b9e3590e6260597713ec2abf6831280f2c4a37ad450369243666e1facde014", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879889, "uuid": "463d716d-0200-4796-b822-6a50bdcfd0d5", "value": "B85302EB2E95AD73C5D967D0E06050B0636EFF54A24FC38AD035FB88E8D95C3925B904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879889, "uuid": "1d5f6228-15a1-4d78-aa88-1bbe6f82e9f3", "value": "1536:m/Y70y6k3v/jqPCunHIkZtLWhYUUROx3tgx1YT7wxNyN:l7d6umPDoM+YUUiPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879889, "uuid": "28bdd2da-b256-457c-8fd2-07823eb4c48f", "value": 61587, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879889, "uuid": "095eb7fe-03da-4565-9948-7d65e4015e52", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879889, "uuid": "b87de4f3-953c-4b34-9c10-ff67e3971889", "value": "notif_2920.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19b0338-85f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615855492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855492, "uuid": "6c4572ab-27f0-4fa0-bea9-a0d60be9a3ca", "comment": "Malware payload (Dridex)", "value": "29300905c5190211e4f2e47535eaa511", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855492, "uuid": "37dda340-482f-469d-a66a-49c65e4d1ee3", "comment": "Malware payload (Dridex)", "value": "6afaca7e32e632e1f135de5f38ee0374545b9552863942c8fc142d9ca2b187e4", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855492, "uuid": "56e7a180-ef6a-4edd-9135-35dc260ea3bf", "comment": "Malware payload (Dridex)", "value": "e00bb45094c4e32e46e7f86fbf3958161016a805", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855492, "uuid": "e68b8b47-c731-49b8-afe4-649ca736c7d7", "comment": "Malware payload (Dridex)", "value": "bf7f1bde540b096584c68c108b569b4da1d76383db1ed3f956a0b60cd0c8f5530be39792c10798e1ad90985ce70c6a9f", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855492, "uuid": "8aeb2f4c-071e-4e17-b587-cbd282a9f2bc", "value": "0405A1627A41F8A1F2681632CF12D5FC23547C19CFB069A372E62F5F39ADDA3A500395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855492, "uuid": "8bdb822c-d50c-4341-91e8-c02d7eb1dbb9", "value": "ec6784ea2a9401383a41ece9a9122f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855492, "uuid": "d593c68e-73c9-46ab-9ba1-ad947213d946", "value": "6144:rz/nJLLMsKHnCr9ZH9mY+oADHnAHujH6Lm+LfPFNJufqE3NJFLx:/xLLM7HCrA88AHEcm+LfPJufqETFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615855492, "uuid": "64564348-b685-4d0f-bddb-47b5245654ff", "value": 830464, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615855492, "uuid": "5742f73f-eab5-46a9-93a2-5105ccfdac95", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855492, "uuid": "897ec973-ed16-4e41-a9c3-306ada3903dd", "value": "6afaca7e32e632e1f135de5f38ee0374545b9552863942c8fc142d9ca2b187e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0571048e-8669-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615907118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907118, "uuid": "900d9e69-4a4f-4a9f-99f7-3815e40e3f2e", "comment": "Malware payload (SnakeKeylogger)", "value": "21b200418c9ff5c6ab375f1ed22aefb7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907118, "uuid": "1dbcfea5-1677-49a7-8f4b-bf3a2a6ae43d", "comment": "Malware payload (SnakeKeylogger)", "value": "6b75eedb88318d707a89944914c57b4a4752861f8b14c8d290e5e460464307f0", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907118, "uuid": "95b4a63b-6e05-4c28-80d3-cb0ca0a8e440", "comment": "Malware payload (SnakeKeylogger)", "value": "842ff709fcf2ebe1474a960af5b91c5fa9586209", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907118, "uuid": "73d9fea6-5b35-4b9b-aa19-1df365358200", "comment": "Malware payload (SnakeKeylogger)", "value": "057e3316e4023b430f7a843cb5af631d94b8722f48a7fa5e797e49f8b4fd78f709a18800b9e3a89a59be6a64d896bfbd", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907118, "uuid": "c1df7fda-2968-45b7-a19f-aeee33dd4730", "value": "7675A41316F4FE14E27D32318C775419C6EDA6368338F0697D69338ACA6F9104FA269E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907118, "uuid": "a08cc19b-a80d-42bd-9be4-ac120bd1058d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907118, "uuid": "d60914cb-db4c-40ac-9aa5-ef2082d59ea1", "value": "12288:XsINy8UQc8W3bIhZJxOCT16FML2aBcfrZhLK8BJ0fAaQ0rpHUHWZxMer:8IIt8WLU916y5Bc7KCJwAaQ0rpHU4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907118, "uuid": "c8d9cf0c-8814-4a0f-9715-fc9326f440c1", "value": 1628672, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907118, "uuid": "5c3a07d3-43de-4a66-8eff-0fdbc0cbb9cc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907118, "uuid": "e63b0ad2-f93d-4753-9ab0-a47acdb799dd", "value": "SOA - STEIGENS-40194648422.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae02297-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906966, "uuid": "bae380c9-bb85-4c90-aa4f-1f8daa0564fe", "comment": "Malware payload (AgentTesla)", "value": "6adecd32fe3b22bd519340aac49552ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906966, "uuid": "41fda36f-6369-4756-a483-735fbeb51768", "comment": "Malware payload (AgentTesla)", "value": "6be2eabe49606c356a5e8a8e3a72d1092eccb5554aa28f4956ab0e338f46757c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906966, "uuid": "fcd0aa4d-2d9b-4639-a537-f9b67637bbaf", "comment": "Malware payload (AgentTesla)", "value": "3108a005709df67482a419ffc07c499d9ceb6496", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906966, "uuid": "b6177559-ba57-42a1-8d73-8e01620993f8", "comment": "Malware payload (AgentTesla)", "value": "582a63b12b0dc1c907526411a4423563afc13d31dda317e14e18b7958bb7b776aa67fc8d290a2e0086855b178ed43fb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906966, "uuid": "6c4b18cf-2392-468a-bb60-4d372984a4ae", "value": "DFF40158B5A44C17CF2DB0FA40D3686C8F7095A3F761EB9A9FCE90E921C67C868149C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906966, "uuid": "c8402741-ee48-4db8-9be9-c7c4dca83396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906966, "uuid": "56320a89-d663-41c8-bf5a-363842c56c58", "value": "12288:g6esVzhSfzo4gDK7fBTkMX0jtv+ILzixg90hZlI6wydEsaSwAKWXkYVw155ih7/7:fIaK7fBTk9jtrLOfhZpwjscSzVz7/CtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906966, "uuid": "0e8d757c-c26f-4132-a96d-54cd1eb327ca", "value": 778752, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906966, "uuid": "fb12af51-97dc-49cf-b57b-7b8e74f47e96", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906966, "uuid": "02eec50c-a0cc-4a22-bd04-e074a5ec10ce", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee60a51b-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615907079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907079, "uuid": "2342e6e8-3568-455f-a443-a57edffa03b1", "comment": "Malware payload (SnakeKeylogger)", "value": "57a1b05686b2997c98c87099103d8faf", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907079, "uuid": "2558fd92-23eb-43ae-a8dd-cf9659619560", "comment": "Malware payload (SnakeKeylogger)", "value": "6c404683f0d9d7f41ac518a69c1166d4ba35cdad7ceef504eb8656274fdda19e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907079, "uuid": "6359a521-3346-4129-9eef-28c1050c8f34", "comment": "Malware payload (SnakeKeylogger)", "value": "e8396b2f42904bf4df93718c75db1d590d3beae5", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907079, "uuid": "91f10e07-9f84-4843-b262-ed044d7303e6", "comment": "Malware payload (SnakeKeylogger)", "value": "c6e270037ff2fc1131c0825561c8902677c0ad683e6f9cda92cffa528d26989b57f2dd7708e1da45451b9f3de1d0a30e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907079, "uuid": "db69d1d1-21ad-45d3-98a1-8d79e2e13755", "value": "97F401D2F11045EDFC6E1B32652B4EA659931CBDE6B5D11C60F936223BF70A3002A1AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907079, "uuid": "e84ac1aa-5bfb-46e3-abeb-b83efc37c903", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907079, "uuid": "2803832b-fbd0-4cb6-a1fe-7651c4dcf6e7", "value": "12288:3GW0xmfy3xCwkrtf0jLMA2pcXUMA3Tto1l45zECIThatylN3qaW5lRG0arm1y4G6:IxIyBTkR0cLN93TtZACIhatylRqaW5jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907079, "uuid": "947cce14-f6ad-4e9e-8c07-a77d7b338fd3", "value": 740454, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907079, "uuid": "07a78b39-6ab6-47a5-a0a4-4d845d830f14", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907079, "uuid": "1e35794b-a05a-4a39-8d2e-4f690c4054b8", "value": "s44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b03161-867c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615915474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915474, "uuid": "91bec1b4-7e18-4aea-8634-d19d0b4e1cb5", "comment": "Malware payload", "value": "a724701975a85f626d29fb4a0f9b0e54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915474, "uuid": "156d1b8f-aaec-41c1-9664-f5fdd5454752", "comment": "Malware payload", "value": "6c5a2ba992a2d8927009924063c25c2b2cefad11a5b00a6d827304794c3de955", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915474, "uuid": "c080b896-8a53-4fe1-86ac-d46246bf3f59", "comment": "Malware payload", "value": "31099f34e3746859434b47d9f12ff861f164014d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915474, "uuid": "f282e51b-3665-423a-be2f-af5e63cf247c", "comment": "Malware payload", "value": "0fed65adfd85a8df0c25f6a89468ec890bc79d30e6b034507bf69180bff1efc4cd2470670f3c52a04c387d8a22d70ccb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915474, "uuid": "7cd503d2-47ef-48a8-957c-e7dcbed3825b", "value": "F773F113DE529B42E56446BD7D8B1FEC7F01242998D366EF0A900B4B3E652370A1C5ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915474, "uuid": "5dd64ded-4965-45ff-8448-8b1e238efdfe", "value": "1536:EHjDu2wyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBmILfxv:EHjDuDZ1k8g05oyDJmipk4vykYARfWBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615915474, "uuid": "a162c61e-2166-4bb7-80fe-09a8a3108b62", "value": 77779, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615915474, "uuid": "f2bdf015-c0d8-4530-bd73-47b9b8909695", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915474, "uuid": "9336b9ba-37f8-4c67-a360-a7ec152389da", "value": "6c5a2ba992a2d8927009924063c25c2b2cefad11a5b00a6d827304794c3de955.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fa8ebb-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615922425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922425, "uuid": "df60c850-b2a7-4ed9-a2f1-1b205b62f930", "comment": "Malware payload (Formbook)", "value": "7469708eedb10550f30b0a3470ff04f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922425, "uuid": "bb54dcf5-6952-48d9-9873-6da61ff22b09", "comment": "Malware payload (Formbook)", "value": "6c8d9b097832fec5088306fabfeb26cf5aa0c67153134f4c5e356cee935f871e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922425, "uuid": "82ce9d95-2c23-498d-9abf-c8c20b8fac4e", "comment": "Malware payload (Formbook)", "value": "732b48df7f2d5e1a3ae00c61fa036ec7435582a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922425, "uuid": "af29a44b-71f8-4e2b-b973-f4b868b6c188", "comment": "Malware payload (Formbook)", "value": "65d525d586b330cbe906d3276052976bfa6060ea7d66c3e5b1e230967989c14d7108734eaa0f449c87e09bf63ece3b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922425, "uuid": "1659b2a3-58d0-435e-b1cc-94bf176e84f2", "value": "5D241212A6F2C0FFDAF717B28EBB6AEDC3B5991049111D0BCF592F769A600C3821D156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922425, "uuid": "634dcf1c-48c7-47b5-b1ad-334fee31f67c", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922425, "uuid": "a0f90859-54f8-4eb7-a29f-03bbc814495f", "value": "6144:UTqjFEjP4LG2U1lSXCoZ7TRuLspZdCdh3n4dfE5y:0PjKU1l8kgpZdCdh3n4dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922425, "uuid": "ce7e4ee4-777c-4999-92b6-2555cb89c14f", "value": 217473, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922425, "uuid": "aaa8c5ff-93b8-44c8-8366-0c620d784434", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922425, "uuid": "721c87e8-2323-4c38-aae0-a7fa03da27a5", "value": "7469708eedb10550f30b0a3470ff04f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c15084e-862e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882004, "uuid": "9134a448-fed2-4b0a-93a3-80d2357e6cb1", "comment": "Malware payload", "value": "cbc4f6ee4388e7d36dfae1b4f96204d8", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882004, "uuid": "ea65563d-b6a2-41db-8ade-c9c5ee56a786", "comment": "Malware payload", "value": "6cdede4798ee4fdf130faebafff357482411de8dd51b83b3aa5faaba4a019b2e", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882004, "uuid": "75fd3007-0ebc-4bbc-a3d6-4c8fc16d0775", "comment": "Malware payload", "value": "a0466665977023268b56686023b27bd737fce457", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882004, "uuid": "a026f65b-aaea-4f34-a36e-183cb4b18c18", "comment": "Malware payload", "value": "89cc2efe69391c268c576ee5e8fe17d7856200924d42c8bda2b7fbf2db903fc892cfa3d41d2e2fc2facaa871036a0361", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882004, "uuid": "25fda3cf-fac8-4ffb-bf21-9b69def57660", "value": "AD73B00EE660A87AC375743953025DE25E4C6056D983B12E26A47F086EEE1D32FDF1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882004, "uuid": "685cb301-c69b-4f42-b9af-3331d565ecad", "value": "1536:OaFFy8p4ryW1tTSuecMvQoBq30f6tmgH4AwU3g5YlXhVpZQ+pNh:3FFD4h1tSBff6tw3Y9Q+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882004, "uuid": "9f9d2bfd-5e03-4c1c-b575-a19c8fcf29ba", "value": 79803, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882004, "uuid": "ad7d9eb2-a56a-44b1-8aa6-f2a5470ab3a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882004, "uuid": "e8b3ccd4-d2a2-4009-9814-1e447b9150b0", "value": "notif_949.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b0dd37-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615923228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923228, "uuid": "ccb1b2b4-83c0-44c7-a404-be2849d93dd3", "comment": "Malware payload (Loki)", "value": "8e32f64fb94c8c4c0b9c48d44a140787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923228, "uuid": "47219d89-82c4-4b80-8812-44d43121a5e8", "comment": "Malware payload (Loki)", "value": "6d11a100db872455c9b387d98a59c00b057a644c445c93d490e464bbbaab9c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923228, "uuid": "51586536-7815-409f-8b3b-ef4ebe21dff6", "comment": "Malware payload (Loki)", "value": "b13574c4102154aead0484c492e73dc1e85b5abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923228, "uuid": "b24c6ce0-787c-42d7-a4ed-2d74a25d95be", "comment": "Malware payload (Loki)", "value": "0783c1c01e591552e62f3d06bf53231b50221f9a94928548e391825f1ed56c9f608b53794c2cf1b04abe748ce54a9579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923228, "uuid": "94e9d89e-86d7-4f73-af45-b62836cb249b", "value": "672517A1E7409A70F07A73794432537252BEAD0E9A65D67D3D84BA8A2C713C240F3DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923228, "uuid": "dbe04e90-62b4-434d-bd9c-e5baa4f8c2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923228, "uuid": "6fc25231-168d-475e-a776-2cac8204d54a", "value": "12288:1EjSXK1Ld3T15bMTuDt+Ow+Lpnr413dAA:pgLd3T1ZMT4PLytA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923228, "uuid": "f28ecce7-18a2-45ef-8db8-24f67401dad7", "value": 1036800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923228, "uuid": "2592ff86-8881-4c77-abc7-ca7888087e1f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923228, "uuid": "12345d2c-f702-4151-b758-e9720e3c35d4", "value": "8e32f64fb94c8c4c0b9c48d44a140787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24df7313-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615875818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875818, "uuid": "f7113445-809b-486b-ad95-badd80884e49", "comment": "Malware payload (TrickBot)", "value": "37a413c2a0987f55a8823a245bce841e", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875818, "uuid": "b2e300b9-4d0c-4473-a88a-35791eaf54fd", "comment": "Malware payload (TrickBot)", "value": "6e635ef7a6cb44bcfa67df2c95ea9066e37ec2e15a118a80ee7b245f5b9d8130", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875818, "uuid": "d3f78660-a7a1-42bc-88aa-523a4b02af74", "comment": "Malware payload (TrickBot)", "value": "a0932d84342f576b7286a20e7b6f5502bfebb816", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875818, "uuid": "68709409-8133-4ab9-b4fd-26abf714f5bd", "comment": "Malware payload (TrickBot)", "value": "56d10b1cfd57116a45f01ace0cbcb9a06d49eb3b07bda3c5bdb97a8459fab10ac186b530456d51922622790957985b38", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875818, "uuid": "9d554083-f1c4-44f1-b664-5f314a81688a", "value": "38E3010E1A51BC22C798033894A7C7D39706717FF3B2E95AB94CD8362F60BE56E1D14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875818, "uuid": "39006420-e6b3-4e6b-8c1d-1950a3043489", "value": "3072:oL9pupSzxNEBBD+Os7/xxkKCtRbsYO1entseoXX8:oLPGSzx0dmxk7RbsYsKtseoXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615875818, "uuid": "1bc7de50-c678-4647-81b3-1312f198b82e", "value": 153311, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615875818, "uuid": "815f37ed-c45b-4033-8d9e-205fe3eb273b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875818, "uuid": "6bde0262-05b5-41ca-8204-6ec59249f1d6", "value": "case_112809007.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1d2ffd-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867486, "uuid": "10c42952-3538-42cb-92ed-2bf486579525", "comment": "Malware payload", "value": "7a681936cd2d1120be10991b89776c65", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867486, "uuid": "d0e00ad3-f51c-4f93-9771-7c1d5aa24160", "comment": "Malware payload", "value": "6e67e32cd54565dcf369f52a0617a7c55f0446a4ed1fbf7878f98512e278ccaa", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867486, "uuid": "038f94ca-3c1a-4e52-a292-fb6586dd254a", "comment": "Malware payload", "value": "99afccb9ef18e909d576364ce201ac965188f8bd", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867486, "uuid": "66206b73-4782-48a7-998b-c741e77884ec", "comment": "Malware payload", "value": "44917181714f5716893533da274d76b2cafa60aa6e445c7634352787c470377ead82aacf29e451875a8a4a2d9ca046bb", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867486, "uuid": "705377c4-9c78-48ca-95a5-c050f185ccb7", "value": "2363E16D91106868C33DB13D92465CE1290560678CC3F50E36B4BF86AEEA2C36FDF5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867486, "uuid": "7714acdf-a4c4-47b4-b9e3-48aad77008ae", "value": "1536:fQf/NU57ZpVYBOoxXxdbKHF7Z6V3Jr+W+v+LNDBm:fQf/25NNoXdWl1grxNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867486, "uuid": "4a9dc58c-0c89-4c57-9ede-d83a80efe415", "value": 72067, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867486, "uuid": "3227161f-61bf-4513-9d54-0924ea3b2adb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867486, "uuid": "7274a5b1-d982-4c3f-845a-72135ab39a8e", "value": "modalita_2856.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb53f98-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890117, "uuid": "c36e3d21-a158-4264-ab8d-8e2f5425ca46", "comment": "Malware payload (Formbook)", "value": "1f88d865877a56698964e7b6aec10944", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890117, "uuid": "2b7df298-8abc-4e7c-9944-1a360915c53a", "comment": "Malware payload (Formbook)", "value": "703170d16b28086934737a474038f62654f595f1f5b30b0115806187022d1df6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890117, "uuid": "53280055-09bd-4466-b282-8af1a8ab1c20", "comment": "Malware payload (Formbook)", "value": "f426763eaba66a002762a659872d503bf36f4de2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890117, "uuid": "86ae7082-7d30-4ca4-9c38-12814bdf249e", "comment": "Malware payload (Formbook)", "value": "50f9f075bb004e805d76b4cd8b3af0c90ecf54a862f1c17aac9d96663e9cbb5238abd9dcb3eb8b50f2237ac59b000769", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890117, "uuid": "5ccf458d-88cf-4e16-ab8d-b63f9ff3cc1d", "value": "35257A21F694AB70F03973764432033183FDAD069626E6BE7D4871DA4975AC186F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890117, "uuid": "af6707a4-6174-438c-b218-7719e97dc8cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890117, "uuid": "c8b00217-0f68-477c-bc82-52c3c10d3bed", "value": "12288:dxfouKlSESIdRBG9+93je32cCa/AC5lDd+/Dcl7+CRS8zdzd1:dCaIdRBjdsAC5ZdAm7Nlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890117, "uuid": "36b53657-55ec-4420-b502-625205fecc5a", "value": 1040384, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890117, "uuid": "94c31807-ec5c-4b6f-8662-26e0bd9ed1b9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890117, "uuid": "4e4832a8-cd9a-4087-b7aa-e9a1caf52db8", "value": "Receipt_007876.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8909e92a-862e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615881999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881999, "uuid": "48c8b56e-626d-4491-b5a8-7277cfd2fd06", "comment": "Malware payload", "value": "3fcc54532401fc7b6857ead864e7f103", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881999, "uuid": "270f8604-ffaa-4950-95a5-9bc10359d09f", "comment": "Malware payload", "value": "7126db94fed08151cc8b631d78da3dbb1546bad163057c2d5ab2cd4d9e767b99", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881999, "uuid": "1ecc1747-c5f7-4b88-aace-a2ff2c249de4", "comment": "Malware payload", "value": "2cff0e539baaf07eff71a5155d02105e7c595bd3", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615881999, "uuid": "00ae36b4-ce9c-4637-aa3c-2ff4de302cd2", "comment": "Malware payload", "value": "33a3cce707ca3457204a2415d13a67153df3edcdbf703bfa50d883da95474588ad6a38729c897c925006560fdaabc812", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615881999, "uuid": "f326e10c-e0f8-4a56-9bba-af69e86c101f", "value": "86738D5EE250B5B9C2B9703CA30598D14A49205BE483B51F32E47E4839EF1D72BDF6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615881999, "uuid": "3206d117-8389-4218-8272-5d3b9b716b0c", "value": "1536:RRewSraA71eyixEzTfobwRMU0S/wIN5KXVNt/5bHPGWnigq:7ewSrtBzTfoMmY/wIN5eTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615881999, "uuid": "dbdfa388-3916-4c53-ba23-b63a56367623", "value": 75505, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615881999, "uuid": "72c9f08a-f4c4-4c8f-a7bb-2e8eaabf18f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615881999, "uuid": "efa740fd-d8df-4385-a2bd-0222528435c9", "value": "dettagli_2740.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc746d5f-861b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615874032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874032, "uuid": "7192f8c8-d5df-410a-a9e0-ab12f7c21539", "comment": "Malware payload (Gozi)", "value": "3618bef0de6d8b724d4c43725984c16a", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874032, "uuid": "cf52375f-c849-4a22-912a-f1da6fa80fcb", "comment": "Malware payload (Gozi)", "value": "71773692fafadb64435f951a44fcc564ebabcc456ef73eaff0561129ef185eb4", "object_relation": "sha256", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874032, "uuid": "59b468c2-f280-4175-b2bf-2e1dfbd5029b", "comment": "Malware payload (Gozi)", "value": "ba9997228aa74dcdc6b138e599fb14df2a9c275f", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874032, "uuid": "10884f5c-3a35-455d-be6e-60f1bc9e2570", "comment": "Malware payload (Gozi)", "value": "80161d3ebd89ba352015d180edf1166a056013e5494e27afe2a944c732b808f5b7e6a130a2067947b355633d6d9b618b", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874032, "uuid": "7ce8129d-876a-417c-892f-7ebac06afac7", "value": "E79312A3FF7F1BED7ACB91F6040A59B83D3BC3B93B9756109C1BB10448199492388768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874032, "uuid": "9423bcd7-1c97-42d6-a835-9aec932866c2", "value": "1536:CLIO7ezy7CnJn89G1lwOP1DSkqD+HYMlMxLRDjWY5/AGrxIenAE++GILNLYF:CLH6z0CJn89GfPxSkqDLMluFDjWYeenO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615874032, "uuid": "7cd1682b-08c0-4501-b176-cf4aceed9aaa", "value": 89549, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615874032, "uuid": "b59fedfa-0cd6-4967-a5a4-b1109c56b5f0", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874032, "uuid": "5c6a9a10-e112-49e9-bc28-6c91c55d6c5c", "value": "request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a684e184-8622-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615876894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876894, "uuid": "2db086d9-4026-46dc-bcf6-c510faca91c5", "comment": "Malware payload", "value": "ff427ed569164622f3baf251249cc2a6", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876894, "uuid": "9f98a5b3-c2b9-44f6-b2cd-d43abd08503c", "comment": "Malware payload", "value": "71fd7e3b8fed9969f597629a17323c62b2a4aa630a7e98e5e7a61ab4862da65a", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876894, "uuid": "72441117-10ac-4192-8529-de67eb5dfdf9", "comment": "Malware payload", "value": "3473b3d537ff1f0478e6822680df066cccb6e902", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876894, "uuid": "ce22e42b-048b-49a4-bcfa-611bc853801f", "comment": "Malware payload", "value": "ffd901a2856207887ff4f8cea2d4dab8bb4c8b5cdccac7c798a5d3846b9644c04a24aa6fe7da4e7ad458d36a0a1b2b5d", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876894, "uuid": "187ec017-1dff-4dcb-b45e-63de66594245", "value": "02530220EEE40C0C5E0C715FBD4B3582816ABB6A3727CDC3DCD818682563CB3E698C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876894, "uuid": "c5946462-d36f-4b9c-9dac-46523e2d0e62", "value": "1536:oBRGDveja+9DzXlAEzd06PzB1wy7SOLGsfuhUKdm:wGyF1pL7B1L+th4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876894, "uuid": "9c353e8e-7ae4-448b-9547-fc4882a88be8", "value": 63013, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876894, "uuid": "10b6a8b4-d026-4ade-b78b-18ff385c4403", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876894, "uuid": "242ac612-5199-4812-b9da-a41c39aa4ceb", "value": "modal_1176.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244f1f58-8626-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615878394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615878394, "uuid": "6b424eea-9717-4e6a-9bfb-6a7ae1aeb820", "comment": "Malware payload (Loki)", "value": "63f5271cde0759eb9198be3d52588f06", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615878394, "uuid": "ee985968-7610-49ce-82e6-13d271d708fd", "comment": "Malware payload (Loki)", "value": "7259e0bb5cfcb5b2cfdde68c8c5a426f290d1984d6a165bac5df7248ee3a5abc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615878394, "uuid": "9a0972d4-e70e-431f-943f-5175d7128946", "comment": "Malware payload (Loki)", "value": "377a7097abbbb15be0b98cd451b7f018b910df67", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615878394, "uuid": "8c4aa9f8-9a92-49b2-a145-aeb80efe83ba", "comment": "Malware payload (Loki)", "value": "8321a8e5c7a910cdb168dd1012d9bc4dd8ccf223387699269f650524434fb09ec1f758fddc027cd8d89e412f306063e5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615878394, "uuid": "7b7960ca-ea5e-49b0-ab2d-ea4ec0551c2b", "value": "5755411316F4FE24D27D7270DC37500986ECA1729338B469BD5E33868A6FA414F636AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615878394, "uuid": "4d24cbc1-7461-46f9-b944-bff549abeb9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615878394, "uuid": "4687d54f-cacc-4af0-b582-7a5169d1f61c", "value": "12288:lrJXOtIh0RToVGvClD1UyB/mumJ8hdMk5y+UB4pfNgwuZ/JVUG47NFBk/4f:PUyB+umSgBhweUG4/CAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615878394, "uuid": "6ccc6ae6-05f3-4787-ae94-25f9848b3412", "value": 1355264, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615878394, "uuid": "23add760-d7d3-4b9b-b304-32c8eb824a38", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615878394, "uuid": "0c4a7de1-8829-4b6c-8d09-c47a413e48c7", "value": "PO 210316-012A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3517167-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615876567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876567, "uuid": "7a2104d4-1536-4e9b-9de4-911c4668f985", "comment": "Malware payload (Loki)", "value": "4d1d2cc11cedca25cda086055d74ffe2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876567, "uuid": "e8a79add-8a8a-4df7-b124-ec378a494cfe", "comment": "Malware payload (Loki)", "value": "725d270c12d25983399645697289053b183cbb8a7e0a5613652f73af8d690e7c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876567, "uuid": "d0d72e81-dd5b-4273-9e6a-da89bfd6eeb4", "comment": "Malware payload (Loki)", "value": "925ebf7b4a2b95aabba03827c0508c0c4c9c33b0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876567, "uuid": "b8179cdd-8430-4d21-8f64-626c2e8a0a09", "comment": "Malware payload (Loki)", "value": "50c5784e1557815cbe489ca6f714041b6171b9fa71c7fb859903465f67fe398f9f92dbc4e18e2c17c246e5156b27f337", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876567, "uuid": "56057778-e6d0-4302-b68e-e870cd6d31af", "value": "97B523C7E1A2A74AD3699FF5502EA69A211FDD2174BD08772B0CF369F5B270C30C6219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876567, "uuid": "3e80b651-b09a-4d68-8b4e-e7b5467945a6", "value": "49152:MAqETvmysFjC42nAyiDVOMicp4yKmFGXTaRLEZpyP+8fPU7a2Y1aq9:M2T+yyx2nArLvK4KkYpYfM70aq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876567, "uuid": "32ba46fc-1c08-49b3-b837-ae621a366a44", "value": 2462208, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876567, "uuid": "30642246-cb4d-40e4-9477-b7597a97597e", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876567, "uuid": "ad91c759-d5b5-4c9e-b948-fc0af3874d66", "value": "TT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943701a3-8659-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615900486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900486, "uuid": "3567fd7c-42b5-4592-af8f-154ea4fa3d77", "comment": "Malware payload (Formbook)", "value": "e18d232bfacac5dced447c9b6e9c4a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900486, "uuid": "6b894865-d568-40e2-aeb6-382d183498e4", "comment": "Malware payload (Formbook)", "value": "727bc43e3d9cdf3e79c2232cf3f647bdf94ad2012c31403434c17e5bbeb3c339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900486, "uuid": "e39cd4c2-82c8-44a2-9e40-77184066eed9", "comment": "Malware payload (Formbook)", "value": "b33a665b46c4b5104251d1c4583395848adc3b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900486, "uuid": "64068b1c-cc66-4358-87bc-24e9840c2aac", "comment": "Malware payload (Formbook)", "value": "f0dbbbb74f232a0429082e26f714dbe8263753d8cb5375155ea343eb184fa2a3195b770044fb21cd6c62bb89e694aa30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900486, "uuid": "c659717d-85af-4799-91c0-d0eb48964d4a", "value": "D2241207B3C1CCB7D13228F10778EB3EFAB6C31459251A874B884FF66E6294558197AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900486, "uuid": "c51094c2-8ebb-40b8-88d8-ecc112569afa", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900486, "uuid": "4dbc6022-d084-4358-93ab-d9a210064b9f", "value": "3072:s3jqjLX1DLPceGPg+YiQRvHIJ68nsScvT80W2wkOn/DwY0UAya+XqP0lyMUluzhn:sTqjFJMsiQpOcxtan/Dw7gLyMUXXbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900486, "uuid": "0441c57a-cd2f-404a-9d82-6fd992659a67", "value": 218376, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900486, "uuid": "a4d2d6d9-151c-4fca-aca3-249fe123d37f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900486, "uuid": "61760413-728f-411e-a721-88336855c9bc", "value": "TNT EXPRESS SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8353948-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1615922853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922853, "uuid": "86f2da9c-f776-4080-a051-fa72a25f3676", "comment": "Malware payload (IcedID)", "value": "c2222883c0f4a83895e5c46a05ab6e9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922853, "uuid": "2270baa5-22dd-4dc8-b072-ca8b899c3a79", "comment": "Malware payload (IcedID)", "value": "73019e744c4441a06d82f8d0936cf79d94413854140f80f551b9a06579b5e987", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922853, "uuid": "476b9e5d-99d8-4681-9284-2f8ced92a658", "comment": "Malware payload (IcedID)", "value": "74d5110fc090cf58bb60fac8d6bf6b6a6527cceb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922853, "uuid": "81c90362-2a59-41a0-9f72-018c9f959f15", "comment": "Malware payload (IcedID)", "value": "25046dee3a52aad2b49bed5fbb1e5223e4470b55dd98f129a6b5eb68800073cc13be1768038fce8cc9da200ce983d196", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922853, "uuid": "d64c36a7-2c47-46c3-a896-09e9a14a3c45", "value": "A9F3CCA4BA97476EC663533E4E5F223C8B7B3FF4399902679449B4B2231C9C493E7109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922853, "uuid": "33e8b3e5-2cf2-409d-8656-5ac7d50554f6", "value": "015f7aaddd9f464d8fe721bf20f7b501", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922853, "uuid": "ceb73deb-bd07-4c83-9609-8e7aa4497e33", "value": "1536:Dvf1BPhZCGp+AK4zLl9E1Y3wvaowg6Sla6JwLfyUTuUgylQ3JBx6Ro:DvfnuGp+AK4zLl9E1Y3wvam7Ug1BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922853, "uuid": "d7666213-82a3-4ab9-afb2-e32e097cd30c", "value": 157696, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922853, "uuid": "97a061de-d7c5-4e18-b79e-51af063ada6f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922853, "uuid": "f34020b6-4997-4887-aad4-e37179339eae", "value": "c2222883c0f4a83895e5c46a05ab6e9e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb49491-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615921737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921737, "uuid": "472fc8c8-a4dd-415e-a773-561a750fcd2d", "comment": "Malware payload (Formbook)", "value": "135c94b81172f08d8cb273ef52f635a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921737, "uuid": "5c782439-e070-49b7-948f-27a8a12e04ea", "comment": "Malware payload (Formbook)", "value": "730b276576659ea2bc17aee5e92f2cc5b9aecf9ade5f03816bde0023a783b545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921737, "uuid": "d7f56b91-77de-4697-9c09-0f6b4a85f0e3", "comment": "Malware payload (Formbook)", "value": "af6ee16850812a9b3cf76a35e22645253dddbe0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921737, "uuid": "fd3c86e2-a9df-460c-bd64-3a340eaaaefc", "comment": "Malware payload (Formbook)", "value": "c71edd3c835b86b23095cee495d3853289b183c5b9a6509e8548edf22397d0ed690f4dd537c67bf8d3a12c194f57d23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921737, "uuid": "ed10fed7-08a9-4be4-89a3-790b126e17a1", "value": "A015028432506E4FC26E7F764593281C9B701A73EA6BE3076CCB16DC568EBC687443A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921737, "uuid": "798debda-5f70-4943-8e53-56f7c1d610d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921737, "uuid": "e5241cd2-e64a-418a-8662-359b85bf4643", "value": "12288:SKkrgK/Jkby92zDX0N14vcIqOdaRrzGFg/95nllf17hU3LMjq0zzN/nasGe1hGhd:SKkz/iby2zVsFR7llfc7MtzJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921737, "uuid": "af8ff5a8-60a1-43c0-bb71-fc98051912a9", "value": 890880, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921737, "uuid": "527f6233-1297-4d7d-9a88-5c37bbd9aec9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921737, "uuid": "c0cd7464-d36c-4155-9d41-ce723e74df88", "value": "135c94b81172f08d8cb273ef52f635a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b94d00-861a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615873598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873598, "uuid": "a3a7a52e-caaf-4284-9902-20421066d87d", "comment": "Malware payload", "value": "1f65988952e39f9740bea36c288912ab", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873598, "uuid": "022c2535-8cc1-4daa-a6f7-d237a216a497", "comment": "Malware payload", "value": "73897b7358424e5bca8b71830a8a71c0fae52315966ded7b16554857292a18d5", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873598, "uuid": "f1d11272-8a95-4299-aa82-9aa05281719b", "comment": "Malware payload", "value": "f9814a8f888cc4c76ac6899eb873de164238fdc1", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873598, "uuid": "a1009ed3-3023-4343-85e4-0f3b6da025c3", "comment": "Malware payload", "value": "f4d8e9ea6b9b015eccd2d8476fe48726ad5c01a89ebd7cd0b393b75f2a1416a140fb8f4cf7f45d63a505ef9d6800141a", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873598, "uuid": "3f821af8-019f-43c6-af68-ad550272b54d", "value": "C95302989836FD62C2A04430CDE1B785F05EC752E9B9B03E560E267AD7134E6335E43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873598, "uuid": "336b00b6-57f7-4fe1-9fcc-3341c63fe08c", "value": "1536:eCE6rdVB9UXeS9dsAtYN54793oVpYqu1NanwBmy98HjMO7Mplw2UX:eCBZVB9EeS9dsA8Ktqu1rz817MplNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615873598, "uuid": "90ed4a6e-b522-45a8-840d-e527ea576b36", "value": 61133, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615873598, "uuid": "10bc1358-0f7a-4a99-9d61-af29c76d395e", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873598, "uuid": "6d9022d8-d292-4a56-917f-cfbe9684fe9d", "value": "modal_718.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9612251c-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867418, "uuid": "9203cbd4-8391-428e-ba06-19c4c9d97f4d", "comment": "Malware payload", "value": "304b72723acc48b90991175f621f8267", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867418, "uuid": "0687b18d-a52e-4418-9763-971b28ebaa2e", "comment": "Malware payload", "value": "74ba9b3e805df2f9f9f858142fe24ca8f007eef8b3acc2a30225e9952de093a6", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867418, "uuid": "42389623-2ae2-4c66-b031-3430e96ba930", "comment": "Malware payload", "value": "8171dbb0ffe271dfe24020e149ea6ea6492ca13a", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867418, "uuid": "36942023-31f7-4d83-9412-f5d4beb97edf", "comment": "Malware payload", "value": "0985876ef569aa5aa613c037f71db923f9c29d7dee9a19ee5fde915d95baae712cfc61189813ac89ee803db6f290abc2", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867418, "uuid": "c58f84eb-9883-4376-9289-a0df74e869cb", "value": "D76302F0A487CA03BBDAC08AB662976FB41D715E2D406771253FE862753C90EEA71748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867418, "uuid": "d519c42e-aee5-482a-aab9-0d3251e855fb", "value": "1536:AmCsruiGAf9rEYMhRquqgz4UkUdeTEN/HQU9S0yT0GT:Am/rzGI9rEBik3kUEE9HQUWTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867418, "uuid": "0fa14b26-5ac1-449e-a2f6-50e12c90564a", "value": 69557, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867418, "uuid": "41037bdb-e18e-4bd6-9a95-390283b51ca1", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867418, "uuid": "c56b6d2f-7ff6-41ec-ae51-ef0d5082d0e4", "value": "attiv_750.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04060593-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1615918283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918283, "uuid": "1edfdca2-2314-4f83-9747-496bf4cf6846", "comment": "Malware payload (Smoke Loader)", "value": "c5779a1c9ccae2a5e09ad3d078c84284", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918283, "uuid": "d74355f5-43eb-4871-8e76-d8aacf57e3d5", "comment": "Malware payload (Smoke Loader)", "value": "74e5bf86405ad3d894b95c70d21d75dbde5233967254ec7048ed283f0a719da6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918283, "uuid": "f53c46b9-23b3-4685-b063-ea555e4d4445", "comment": "Malware payload (Smoke Loader)", "value": "549a4740f0c502ebbb4db2f31c730b79046049da", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918283, "uuid": "f002cea7-e110-4418-bef2-4da0c04a63f2", "comment": "Malware payload (Smoke Loader)", "value": "1dd57f1195be2c4a146b93d47eb30a7d4579f12743f5706fb68fb689ff9d0800ad6bf42623ad967b4c3262d893170eea", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918283, "uuid": "464831fa-8d84-4f02-9647-5c8643d171c4", "value": "32547C30E7A1C134F4F305B546BAA6B8AA357D31173980CB63C06A9F56346E6ED31B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918283, "uuid": "b248f8d7-14a1-4f77-8a00-5828a3db1978", "value": "4b91c14eb0915fdca34ac1a2852aef0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918283, "uuid": "20d22a29-79d4-4a38-8032-a8b28df8a6d0", "value": "6144:niaemYubdgW4wXINkh9neO7dJhRc7yPPz/XbQ+ISMMMMiMMZv:nmmYuhgW7YNkh9eazh6700+fMMMMiMMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918283, "uuid": "41dc18e5-19dd-4868-82ad-4cc55a5b0f1a", "value": 293888, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918283, "uuid": "9f8832fd-e69f-46ad-b4de-c581d73fca78", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918283, "uuid": "14c1c3b6-2441-4743-9ac9-15d09937deaa", "value": "c5779a1c9ccae2a5e09ad3d078c84284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb66b61-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918591, "uuid": "2458e6c8-0249-4613-9847-d503fc040962", "comment": "Malware payload", "value": "85cfbe65d6596fa55054c3c86a369798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918591, "uuid": "b52b0320-7e1a-43bc-b88e-f4821c67ea06", "comment": "Malware payload", "value": "765c74bca7263290a6c9018b1a90adaef95239b3fdcf45cb5e0d45bd70f03f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918591, "uuid": "bbf9f1ab-450c-41c8-966b-25e7c1e16d7d", "comment": "Malware payload", "value": "98f9a4928c6feef818d547c3a4b2992b2aabe809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918591, "uuid": "688d447d-e1ec-4ab0-b2da-134a0fad42d7", "comment": "Malware payload", "value": "3324031a26ee524d84213609615d179368bd0e8c1366769534e752e7f25feb4cba020519aca01e125ef9105c8d7bd91f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918591, "uuid": "5246fbe8-47b9-4ce2-bd35-16953474e94c", "value": "67C1B64177D8877AF4BA17345FB35B1133B2F341A929C70D5AC4121DAEB2708D9627A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918591, "uuid": "245c5680-7f17-4e28-a3ed-69235a6dfe8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918591, "uuid": "624958a2-3b88-4e2d-9c48-afa25407d9b2", "value": "96:OwwRFzOxaSd3tQfVM6rqRUR4/ub3Z/RuXh1a2FizNt:AsZpp6rqRURWuF/RuXhLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918591, "uuid": "eb0840b0-000d-413e-a78e-8e4ac40664ce", "value": 6144, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918591, "uuid": "8ecbcc55-c854-43c5-a054-47422f6c96d9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918591, "uuid": "ae696adc-b9c9-46e1-894b-16a197e45087", "value": "85cfbe65d6596fa55054c3c86a369798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a82c709-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876310, "uuid": "e30a986d-2d93-4ffb-8260-567fb9d97087", "comment": "Malware payload (Formbook)", "value": "9e84188eb3eeac21ab9b0464f92a39e0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876310, "uuid": "87728f20-1f48-4fcd-9dfd-29d9e5d1edd4", "comment": "Malware payload (Formbook)", "value": "770710adcc9c97316e0f43dcc99ef1561dfe8ec086a1514d4c3d7d0d90b24181", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876310, "uuid": "7aaad9e5-c211-4387-ae42-31cc36eae15d", "comment": "Malware payload (Formbook)", "value": "982151fe5f339f23c013a716e1b64fd53226c3b7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876310, "uuid": "c381f997-b369-464b-a6d9-ff213ed59a0a", "comment": "Malware payload (Formbook)", "value": "d256ce060db16bb3d9ec1d1dcccd1717f79c6727c71d5eb4ed36fdc1c6fe2faf75a3bcffdf1089d28d0f82f2e929c0dd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876310, "uuid": "9d2d47cc-6423-4e3c-a274-fe0760ba2fbd", "value": "6365611316F5FE24D27D7230DC37501986ECA1729338B469BD5E33868A6FA414F632AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876310, "uuid": "a55bfc8e-9388-4d6f-801b-0c4af6c053a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876310, "uuid": "158e7761-f3bb-41be-8ace-ab66906e1c2f", "value": "12288:F2mXOtIh0RToVGvChr5juAyB/AuwM8hdMH5yLU5MvWRZPOEFMvr+2YShbFfStik7:tjuAyBIuw0z5pPwCZShbF6iwzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876310, "uuid": "76875eb4-4a74-49a0-a5d1-56fb1e6459ff", "value": 1449984, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876310, "uuid": "70a69ec3-23ac-4659-81b2-1093fcc52937", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876310, "uuid": "439c3ece-e2c0-4d42-9894-18f4dee3e5f7", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c194d6de-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876510, "uuid": "5dc5cc9e-12e5-4b0b-81a3-2d4b41f98eef", "comment": "Malware payload (Formbook)", "value": "d2f6eb93df5ee7b6a620e46183ea951d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876510, "uuid": "128fff58-81c0-4f0b-a3ac-4dee424f1bf5", "comment": "Malware payload (Formbook)", "value": "77493fa5a03c5c608dced0e134b3093ee9b5568719e13de91885eb419acaa096", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876510, "uuid": "2f4c26a1-7770-4a5f-80a6-cb088f855ac1", "comment": "Malware payload (Formbook)", "value": "699fc600563ec1e708f8a05c9a52b54128ef4e0f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876510, "uuid": "560aa60b-f5b9-4896-9c52-423666f420a2", "comment": "Malware payload (Formbook)", "value": "38195c24a52266b91a13d9a4e3b058c1b33479ffcbb582f9e4442d0b793e6930e660f02f677a91e297fa2bc204aa0fbf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876510, "uuid": "3402d806-4812-4807-88b4-757e7f0dfec2", "value": "6BC5336E368ACB0BDA3F29F924D8862C001DDD65216B0C05BBF5366BAA7353137D171D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876510, "uuid": "a63fed30-e50f-4480-aaf5-37976ad24c14", "value": "49152:YuoSXc6b6TtFn/kNnyzugghX0F52IIXMM084sFDS+54GkB4Sdd2ck36rvd7f1jH:OSPb2haK52IoRXNkB4SdsV36BD1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876510, "uuid": "b1c4ff82-3c96-4560-a0b4-150ca5b45b24", "value": 2648576, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876510, "uuid": "78c81af7-fbac-405b-8e14-0ae6a7255bd3", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876510, "uuid": "c21490b2-f428-4654-a992-7e6c7129b8dd", "value": "NEW ORDER QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958a3dc6-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906930, "uuid": "8248fb2b-52d7-4621-8847-48f8c0d46043", "comment": "Malware payload (AgentTesla)", "value": "b428a87ad33eab549f78f7a87e19513d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906930, "uuid": "a7450fce-60c0-4f92-825d-9c744a72c7d0", "comment": "Malware payload (AgentTesla)", "value": "77b7fa693aefa1434f24ac4013ba7e3221d1f951e3d1afaaa22399ae002ec8cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906930, "uuid": "444ada3c-9f0f-4ed0-965f-bcc59c8f0b6a", "comment": "Malware payload (AgentTesla)", "value": "87697831e852a176eab1305d1453be41b1df2653", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906930, "uuid": "de0fb6f7-2223-4575-9ab4-89674350f864", "comment": "Malware payload (AgentTesla)", "value": "af39ddbaa5f8e074634d859ede5b776996b477a639b0bca5d3298645b72d8806ff03e3b240b4bc71ab120597993a5223", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906930, "uuid": "0a6f07f4-b75e-4011-a20a-be70c7be5011", "value": "0305015A65A99E57CADCB0FA00C3916C5F706463E671D38B6CD539EA42C2BC83D04ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906930, "uuid": "d84bb0e5-93ee-4ca8-936a-b5ffd93f3799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906930, "uuid": "8df72dca-98e7-404b-be6d-714caa4e1dc1", "value": "12288:v/esjVTwF3T88uRLy3zBFflkQQhJvKfUUJkEeUffJEK60ySMPTwPsFfFc6V:nv/Rm3FIQQhdKfD68fJEKQLNHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906930, "uuid": "f8eed60f-6e32-4b32-a2a5-454ec74ff328", "value": 812032, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906930, "uuid": "ec2578c2-043c-4608-b01f-741d81c14413", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906930, "uuid": "b4983d44-c44e-4d1c-acfb-db9bfd9863fb", "value": "Purchase _Order-EndUer#99849959.Pdff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc7d7e1-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1615921544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921544, "uuid": "b2d15a21-8b99-47d3-a75d-62483152b524", "comment": "Malware payload (ArkeiStealer)", "value": "1ac3e6712b8628681306062099ae31be", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921544, "uuid": "2b1f9b1d-ac38-496d-a3b9-d564b83be25b", "comment": "Malware payload (ArkeiStealer)", "value": "77e169d522ad8577df2f250338c634d13b85525d20dbe185b3a4bf08e0ce9e81", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921544, "uuid": "b48a772b-5e6e-4825-8458-ec4275234c57", "comment": "Malware payload (ArkeiStealer)", "value": "29d477a142e34c6c42453f85521cb46e7da92fc6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921544, "uuid": "51d0cff0-fff6-4eed-98f6-3a3c76eef113", "comment": "Malware payload (ArkeiStealer)", "value": "650e3069dbed3e0ccf4c3d9df91043de1bb3946d4a0dee9e099dca435d5a8a334cecfb871ea545cfd6bf6c1c58ea42f3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921544, "uuid": "c177e4bd-2021-45b9-9726-2c072a2bb895", "value": "58D4D001A760D024F0B305B586B68DE9FA357E719F3495CFA7C02A9A16386E5ED33B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921544, "uuid": "93b4d1a1-bc9e-4806-a7af-e3a1bcb290c1", "value": "95b1a81d545c603a5a65a17dc8240c82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921544, "uuid": "90da2adb-e152-42e9-8d2a-897b400c1e2d", "value": "12288:5gGMvBxpIVIMsMPPuUPGfMQd1hEq+j/XL2DbRQK5tRRqaL8cWDWBveI:5grvMxmYQ7d13+jzkbRQWfmRDWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921544, "uuid": "b6c68e55-1b1d-45c5-b685-44c8344c514a", "value": 646144, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921544, "uuid": "2899cefd-56a1-4070-bae2-4fd9807f2277", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921544, "uuid": "6523b9d9-e93d-4b37-9e8a-55af8b4d9c34", "value": "1ac3e6712b8628681306062099ae31be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0372f3-8669-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615907127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907127, "uuid": "35cf44e9-6b58-4f2f-b804-fec0c8695b27", "comment": "Malware payload (SnakeKeylogger)", "value": "71104f3306ecca14d0b9c333b3464adb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907127, "uuid": "e839195c-e82d-429f-a752-4c320ca889e2", "comment": "Malware payload (SnakeKeylogger)", "value": "784bfb03ca8a4413d0111c41431cee412b1a345798b9c786a1a8a3262a5a07af", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907127, "uuid": "38055c0f-d93d-478c-a87b-db71456ea9f5", "comment": "Malware payload (SnakeKeylogger)", "value": "4eae1fe4d1d3d1b8993465afe8da6df5e61a436d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907127, "uuid": "b19770cb-3772-4c47-8545-130e7df64b14", "comment": "Malware payload (SnakeKeylogger)", "value": "85ac26e688ae1b890dcc4cb59b2fd9ced6453dfe88c74b9f91483d0d76d9d7fd63a8ac0b70d696a374e80d2079729a94", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907127, "uuid": "5866e526-5f94-4237-a23c-3602723589aa", "value": "7B15E0343EFF6019F173AF764EE4759689AFFA633707D41E10A1138A4623A81DD8163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907127, "uuid": "587ac267-801e-40b7-88bc-78da13a99293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907127, "uuid": "af6b0552-2f64-4289-9319-e0a302e92f1c", "value": "24576:1TOmkWrYH4RZ9sRzK5Z1v8z2pbgu+EGoazhAt:VkuYH4RZCNK9v8z5u+X3h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907127, "uuid": "1e742244-fb3e-4ee5-99c7-deabb83ba423", "value": 910336, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907127, "uuid": "25c31cd4-9384-4c4a-b13c-48c7a36adc99", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907127, "uuid": "4378c381-21ac-4f6c-8c6c-6c99af7f8946", "value": "Swift copy_pdf_______________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cee03b-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615876218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876218, "uuid": "a6a1f553-959b-40bd-a812-6e2b110a2912", "comment": "Malware payload (AgentTesla)", "value": "da05d11831b99295da1b3fd0287b0aca", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876218, "uuid": "c4d1083d-35ad-4cb8-9b86-b3216b58236d", "comment": "Malware payload (AgentTesla)", "value": "7adc9d4bba9cc9e033291a9da253ba1c8664858233dc326f3c20bd5d0a80c96b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876218, "uuid": "95ec7108-5002-436d-93c1-76b247e208de", "comment": "Malware payload (AgentTesla)", "value": "ea9f300e4b8cc6b0364f7863c6673cb5ceaf0f09", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876218, "uuid": "c931ab28-6fd6-4007-8f53-5f31f992803b", "comment": "Malware payload (AgentTesla)", "value": "01612b01d74bbab0a675158969d0076b57125ed9e230c3f9696c0f797061990e0f316b3919cde6fe97e7272f78af6e63", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876218, "uuid": "94389b30-ea52-486f-be05-2b0048f0aca4", "value": "A84533C174153703DAD2DDF04D16CAB32117F02B89E0F6BB93AE864C455EC6A58FBA86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876218, "uuid": "fb7edeee-ed9c-4311-b721-0711e2364bc8", "value": "24576:u1zX2I2jos4RPXhtfGYoF66DkspcBF2cSCX/9PgnEo3XBRW:u1zGI2jFoXXft+ohPSCX/9PBonLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876218, "uuid": "b00b43b3-74fd-4e8b-9f26-690ee9c9f091", "value": 1229143, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876218, "uuid": "474445c1-35a9-4962-8221-f52fd280f291", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876218, "uuid": "f66b2120-25c2-4d5d-97a7-55106f79e369", "value": "QU0TA0076000000.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fb8f98-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615923109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923109, "uuid": "cd0f586e-82ab-49f3-881b-4f74f45493c2", "comment": "Malware payload", "value": "0ad53ec0a692773cfb34126a7971cdad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923109, "uuid": "e8dc36f3-70d3-4457-9e16-4e0a4645a188", "comment": "Malware payload", "value": "7c3ec59724f79c69f7bb889f8dac9e89a45ad3629a25c954c26905b5b953e3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923109, "uuid": "9a98e036-334e-472c-b0f9-b7f8ea73c4b2", "comment": "Malware payload", "value": "5da4e621c4d0805578b1a5fb45df5f655a80cb97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923109, "uuid": "ca7a20f2-12f6-4535-b479-31cd0db97b10", "comment": "Malware payload", "value": "bace5288df956a5c8ead4d397e4f373a4a52a2945b68270686be385d66ddf75a10b3c2bd57d00b27c9b5543d7759b2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923109, "uuid": "4474b1c8-1e08-4c84-8694-123908ddfd38", "value": "0754AD11B3E0C072D05224714569C7B15E7FB4726BB66ACBFFC41A781F263E19A7A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923109, "uuid": "9986d6db-96b3-4bd2-9f5b-bfe6116a2dc4", "value": "78e1090e1c813f9aa5a8587e37930006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923109, "uuid": "1f1e93f8-56c9-4fee-bb27-d7e8eb7cc08d", "value": "6144:0VFpxInAT4UhS5yTLOz5vhwf5z/eSdGLLR3:SpxD0UhOSZvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923109, "uuid": "34afd1f4-32b1-44cd-9df6-8b5b6df5039a", "value": 289280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923109, "uuid": "1e883bce-3ecd-43d8-9619-790edd4cf786", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923109, "uuid": "4a60ecaf-393f-4b8f-8b24-6d7622ce2387", "value": "0ad53ec0a692773cfb34126a7971cdad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07a3e16-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615922062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922062, "uuid": "40dfa41c-a66f-4fa1-902f-5ce4c0332ad1", "comment": "Malware payload (Formbook)", "value": "93855fc9adad9473b2063646abb132d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922062, "uuid": "610aad20-ff34-4e29-98a3-d1f4ba497c23", "comment": "Malware payload (Formbook)", "value": "7c48cc2067df2dcf60bf4922311e2da6b85bd7b1982b98a257d5a2fa7d00cf2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922062, "uuid": "bd2a55b7-effc-4e5a-ae10-9be7ceb6b842", "comment": "Malware payload (Formbook)", "value": "81fabe36e8d1bd32b650bb38ced22ede88739ced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922062, "uuid": "e88dbdb8-2891-4bae-b13f-64d2f1719c60", "comment": "Malware payload (Formbook)", "value": "a4839246847e14dfdd79275c68075a3bdedcbabd0ed96bd59daf69942e6af98be4c05743df6e3bcd362b711f48e7f437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922062, "uuid": "54295ffe-fad8-440a-a4ed-e8485f32b412", "value": "8E159B65AE12D631D860C5B7830782372DA81F4A3E10F9F93F74B7C606B7A53B6D1262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922062, "uuid": "ecbf4e94-06fd-49bf-9458-51f63a782860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922062, "uuid": "66c274c6-e62a-456b-8372-e22118545dab", "value": "12288:p/kB1EF8l/hfl3VnW1xU6pSlyxofh8n+lsKGH5OWYjhglMBmWhNCfBih+Gis:CB26/tl1WFKyJKsKi5OWMglYCpX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922062, "uuid": "14e94e78-8c65-4944-a427-c54ee66757b4", "value": 893952, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922062, "uuid": "cd3120aa-5a3f-441f-b800-96a4a50243ea", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922062, "uuid": "0ff27906-67ff-4c87-8d7c-0467f53f76ee", "value": "93855fc9adad9473b2063646abb132d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c21931d-8669-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615907156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907156, "uuid": "299cc5c0-7689-44dd-a9f3-5c34dc5dfdd5", "comment": "Malware payload (AgentTesla)", "value": "edccc59b076c0fc076cf74aaf546945a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907156, "uuid": "8685a8fe-a1a6-44b9-bed2-8802bdcda2e3", "comment": "Malware payload (AgentTesla)", "value": "7c6d3861bbf68bbb058925e888115864a1c3727fd6f3702d9eeb8adca304d505", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907156, "uuid": "1eb55e33-02ed-41bc-b6f5-db992961fd37", "comment": "Malware payload (AgentTesla)", "value": "a52e2d72c524e7dac0a6bdc728d778303ee34b3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907156, "uuid": "93e0e383-ede7-4123-9100-ef89c4b7a5fd", "comment": "Malware payload (AgentTesla)", "value": "f838d1031d0f59081a26ddf8f864bf0a42b6db16ad701eab6d72960f21b6805cb395f4d3d8238453d8a1e268152afb8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907156, "uuid": "b51473d9-69c6-4f81-a9cf-b68278504b15", "value": "02358B21E6A4AB74F03973754432133083FDAD069625E7BE7D8471DA09B5AC486F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907156, "uuid": "a22ee851-25be-4f35-8e71-d4a334f43123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907156, "uuid": "4a380183-9857-4c53-8809-6952e17b6ef8", "value": "12288:7U4j1KhQvglDZcdInD/Ys9spBxmQ0MfsCkl7XYbQKV1:8QvglDZcdIn04avmQ0mkdXKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907156, "uuid": "75b58d68-21c1-451c-9e92-607c87ece56a", "value": 1062912, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907156, "uuid": "0e9c7c2b-ab7d-4604-bfbc-05eb8976bc53", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907156, "uuid": "fd77c5ef-5766-4ab9-b3c9-e4bec33589c1", "value": "Z2YtRnoxRhFt3lk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3348118-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922093, "uuid": "06d1c98c-7f49-4107-9417-f8af421c6ec7", "comment": "Malware payload (AgentTesla)", "value": "28e9c5e8c8910569e48a5e2ae4effa8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922093, "uuid": "6f6b9e3b-97e4-418a-a1ad-672b83ba75aa", "comment": "Malware payload (AgentTesla)", "value": "7ccb9af5b2d8fc84fe5978e6890f10f6acd33bf6cd139d5eb9b54cacea71258a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922093, "uuid": "b5fa54e7-c3f4-4bb0-87ef-7940377d7cc6", "comment": "Malware payload (AgentTesla)", "value": "b2e8cd650c5ce33843d27cb6bcee24716627f38f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922093, "uuid": "72d049bb-70f3-43c6-b3c2-0dcd666b5730", "comment": "Malware payload (AgentTesla)", "value": "e303493c13edf133c445ae8ff74ae4437bbf43ac9c7baf5b91fd815b882bee274487f1915b1a048e8ecb0cb5ec288fb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922093, "uuid": "43e96dc2-b45d-4cc7-a137-8eaa7e98ae58", "value": "B225CF341BEEE059F3739D7466E0FA9989AFBE731A0B401600B5776E473A744AC43236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922093, "uuid": "eb3acc77-6230-4365-a4e7-69a485a63c65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922093, "uuid": "a08172a3-e407-405d-bee7-37b0b1f76829", "value": "24576:d1dDbQ1SzCle/esrVK90XSpKu6BPxbIKvQs:dbQv+rO0CpKF5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922093, "uuid": "9dd0511e-5913-4da6-892d-c7023ed96832", "value": 1020928, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922093, "uuid": "33b17a0d-449a-4cb3-97a4-ccec3e1b5077", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922093, "uuid": "7dfd21c0-d757-4d68-b2ed-63cd3c5d203b", "value": "28e9c5e8c8910569e48a5e2ae4effa8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec2faea-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1615923374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923374, "uuid": "19016247-d711-427e-9d5f-f4885d36517d", "comment": "Malware payload (DanaBot)", "value": "37818924100e50f5b5aa810f5da5a48d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923374, "uuid": "55b9a208-69e4-4cd2-8725-c9afc3b0e164", "comment": "Malware payload (DanaBot)", "value": "7ceb6d9e04042cd53b9c374e69cbf22e05edff6571a01610b844963d881e1057", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923374, "uuid": "4726a678-4024-460b-ac66-9c23eae23d0b", "comment": "Malware payload (DanaBot)", "value": "1e3623d872307be294a5c25bafb371f558c9d242", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923374, "uuid": "01ae42c9-8380-473a-979b-58dabbef708c", "comment": "Malware payload (DanaBot)", "value": "2ded90048591c6889479939c4b64f3ff14378f1a3d4ecb0b70b2788b808e9b87ae7420499565e58444b6bd53259be5a4", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923374, "uuid": "0fdf9671-894a-42c4-916d-bba100d79c36", "value": "4F563351B2C0C2B1C14614F66152E7BC5A36B13B2F59A8C77BC45F385E26BE2933A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923374, "uuid": "cea5c169-bc73-44b1-8257-9d2ac3d12458", "value": "78e1090e1c813f9aa5a8587e37930006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923374, "uuid": "e744ad09-d943-464f-8e42-79577fb7ca6f", "value": "98304:d3PBgRF9ZXHz1iAeuXFO//NNPV81u5+GZwc9w9pIYwamX4pFjJyQgtY7YHmv3p9p:d3grZXJitNNPWnswc9w9pWujJyWJ3p5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923374, "uuid": "a113cf92-e234-43d0-aa02-28768ac4b51f", "value": 6219776, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923374, "uuid": "fc591818-f144-4777-aa3e-b597b650e292", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923374, "uuid": "df253cad-015f-43a9-ba52-1b4b874693aa", "value": "37818924100e50f5b5aa810f5da5a48d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a07954-86a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615933905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933905, "uuid": "0009988c-1b30-4e33-9fa1-55053a1db4ba", "comment": "Malware payload (SilentBuilder)", "value": "588fb133bfd87fb942718927a841a5b6", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933905, "uuid": "42c877b9-df25-4cb8-a941-b1e9578aef4b", "comment": "Malware payload (SilentBuilder)", "value": "7dddf06f86321070a6a0ec15fbcca4b1941fc2f8f3e2717d2cc96b8f5577102b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933905, "uuid": "855b4aec-cbc4-4c81-923b-2bb135aa0948", "comment": "Malware payload (SilentBuilder)", "value": "cc594fc3cb444b3b08a29caaccee008af9ef5d03", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933905, "uuid": "c41935ca-9149-46a4-a977-8c6e0e6e61af", "comment": "Malware payload (SilentBuilder)", "value": "96471b241fdf1ac11364b2a8d1414590eedde37fab8b7e804407b12f5ba9f4dd2490be90ceb8e9fb1a667ac9474df64f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933905, "uuid": "7c1e010f-aa0e-4aed-aab1-6edf77b6cfb7", "value": "A0349D57A9458E03E918C3B9BF634E6E631BAE145A9633C7312E7E5B3FB41900C4B11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933905, "uuid": "fd49756c-9dd0-455f-93d6-e1d1a72a0aa0", "value": "6144:eKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgJ2IS7FgiJsJ4BR5043yVuBCMmnqLsCA:UzGiK4504Sy/mnqoCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615933905, "uuid": "a776f174-24ea-4b94-a1a4-36b0bdcdaeda", "value": 237056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615933905, "uuid": "be08a14a-c69b-4959-8366-f33b0befee33", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933905, "uuid": "26c7f8de-feee-412b-a171-cbc351d09fd4", "value": "SecuriteInfo.com.Exploit.Siggen3.15421.7886.28520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2e19d8-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615906705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906705, "uuid": "dc2c4f73-ad6d-4460-ab39-f0c27cb5dfe6", "comment": "Malware payload (SilentBuilder)", "value": "f1f5080d2f0e912f088bec8f4884b149", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906705, "uuid": "ea30acd0-bb61-4375-aeec-abf222e0dda9", "comment": "Malware payload (SilentBuilder)", "value": "7f087db7872a5d7dc25fa17a95ba5c672caae2f41edb4f4a13e6745966885454", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906705, "uuid": "e1920524-b9fb-483f-afb8-575f4f9f62d2", "comment": "Malware payload (SilentBuilder)", "value": "82ce00847899ed2f247103e6046b108c90d61e7d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906705, "uuid": "d30d2995-610d-471c-9116-e9b325378e6b", "comment": "Malware payload (SilentBuilder)", "value": "8ef6150bd91d118e30ee0673cc2749d242b87fe33f4551eaedc5cdf645dd0049844a9743c669ab0dea045816c242127b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906705, "uuid": "99dc7a8a-c0d1-4b03-b9a6-5b6288abbf45", "value": "3ED39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906705, "uuid": "27bcc0fd-749c-4c68-87e7-e687900259a0", "value": "768:sKdUd4TaBosDwW+u7p1CPVCmgUrNaQTZipEmhPYbWKYvdJkyyLefR2bMym1qIZih:skUd4TaBoCf72ha3CbWzagJy42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906705, "uuid": "1510a478-a800-4239-9dd3-8f639fe6173a", "value": 141312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906705, "uuid": "cf880772-c0a0-4397-a2cd-26e74da74c78", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906705, "uuid": "5c125676-5eef-4cdc-a4aa-2d386cbe3d18", "value": "document-702744930 2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d07238-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615893851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893851, "uuid": "b1d0089d-f161-491d-bbe9-3228399ca33a", "comment": "Malware payload", "value": "07f469eab2cdd84a90b608e27fa8d2c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893851, "uuid": "28bae1f5-58f8-4766-b4cf-7e401aaec426", "comment": "Malware payload", "value": "7fc373cc85462599db67ba4ea4b6c02c6970c4f412b27b8fdd2f97169a495720", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893851, "uuid": "b9e53fc3-d420-4322-9f24-2d418f9128c4", "comment": "Malware payload", "value": "db0e00568ea3d82b9a50ba8b86b37357e8b3c431", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893851, "uuid": "89dcccc4-7e29-4e66-b3c0-b07b51f94970", "comment": "Malware payload", "value": "e1e3082f6b2b6b37261354400eeedbdbe1cb4c76349d46edfba718dfa030e88d3084c92a12903e38ed1bc78fb3a4c482", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893851, "uuid": "f463791e-61e6-462b-893f-2279d4548cf0", "value": "507423DF83E268D3D5BF6206C690AA39462134C752360D5E87B124473F8D662A8FC67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893851, "uuid": "c1919d1e-46ba-4db6-b812-6519e04ee0e7", "value": "6144:Hk1jhaFqUw8JBJMUevsbuOCmr52iflC4rxBtms3i1yhQLLScVPF:HkiFqjkCZvsbu7mrEifsixB5y1BLScpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893851, "uuid": "7e2bf25a-5111-43ee-a280-42e4f11a0977", "value": 368425, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893851, "uuid": "53fa694a-6749-4f34-9df0-74900bd5563a", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893851, "uuid": "ca333cb5-f4da-4e4f-9d1e-8d141abfdca7", "value": "bestellen pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcee669-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615891620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891620, "uuid": "8b15b76d-7c66-489c-8c18-f6831b450e5f", "comment": "Malware payload (Formbook)", "value": "95b28ac8e6b05687f63c69814f7926e6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891620, "uuid": "ffde9d26-0c33-4aa3-a692-b651257dc07a", "comment": "Malware payload (Formbook)", "value": "818394d82d92e8a84de4e818eac65bbd15cdfafacdec28c7a73a91f5848c03c4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891620, "uuid": "6ec2049d-c798-4340-bd12-f1c49d69a4d9", "comment": "Malware payload (Formbook)", "value": "d687d0f815e72629d4f1bb41e4e66b71389ab2fd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891620, "uuid": "0623d6ca-4875-4b5c-88f6-62d537347fd0", "comment": "Malware payload (Formbook)", "value": "39a26ca886f6c6ef04cf7ed03cbf6176b362d6855d6f9503daec45d40e5a04d9c79ed13bec87c45cc61a5319f467e94b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891620, "uuid": "def42c66-f940-4351-ad15-ca0ba0a95a9c", "value": "6165611316F4FE24D27D7230DC37500986ECA1729338B569BD5E33868A6FA414F636AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891620, "uuid": "dc321b15-65c8-4d92-a4fe-0e620023e87f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891620, "uuid": "534ac4db-124b-4378-b2ef-b26c6c208ca1", "value": "12288:NrgXOtIh0RToVG7CB76l9yB//xqT8hdMV5yXUVu5amPlSRu3Y4VBIvacTRKGV92:dl9yBXxqV3VSH94u/IvRIGVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891620, "uuid": "8a0d2386-bd0c-484a-86e5-24a5f3212193", "value": 1420800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891620, "uuid": "589d45bf-65f6-4e39-8232-6a0ddf9ca7dd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891620, "uuid": "4524794f-7563-4d6e-8045-9bf775b9bce9", "value": "Shipping Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c158936a-8667-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906574, "uuid": "155f6b6d-1c72-4201-bb8f-461a84636038", "comment": "Malware payload (AgentTesla)", "value": "88577509dc555deddf0df5054eba351e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906574, "uuid": "f3047e2b-524d-4063-a856-4d1a1dcc06dd", "comment": "Malware payload (AgentTesla)", "value": "82ce655e59a38e2b2cfd54a152c963b6854cdc0e1e2bd9d83c32f3c989268ed5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906574, "uuid": "03b8a456-ee45-49b5-8982-c229e1886ba6", "comment": "Malware payload (AgentTesla)", "value": "d81997ac7f6e1fc7ae02dab2b666fa45d5a13cd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906574, "uuid": "421fba85-984d-4b29-bdc6-1de5ee8ce6c4", "comment": "Malware payload (AgentTesla)", "value": "db6f945054eeee6026a7486a72f5b0ac6fb7a16d25e05b96d153ee08621c3af26cfae140da65c69933426dd14a7386d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906574, "uuid": "badd4802-e400-4f20-a76d-a9f3c571347f", "value": "07257A21E694AB70F03D73754432133083FEAD0A9625E6BD7D8871DA49B56C182F7EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906574, "uuid": "9f1ab146-0dfc-4c16-a483-38ba68167384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906574, "uuid": "7e3a2154-6760-4646-9d22-83f98d851144", "value": "12288:WPXnKgiAH/CoiaGapCIZPQsTlWAOm4lxWpdZ1:UiAH/CoiVsTlWAn4lx2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906574, "uuid": "ddfa9e74-4b47-428c-ad51-6a0ef2d28e15", "value": 1057280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906574, "uuid": "5530245e-e4ed-44a4-be6c-7f43308e2c18", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906574, "uuid": "8002db9b-31ba-4393-bda0-fbc01280c5b7", "value": "3ozaNueWcHzTP8s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd3cd9e-8638-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615886459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886459, "uuid": "eb0bf63f-6a84-4d97-9883-77ad94b22c49", "comment": "Malware payload (SnakeKeylogger)", "value": "f2c7de209abfde242c97dc0473bf87c3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886459, "uuid": "22ac9d50-e0f6-439c-9128-2e5f11a3334a", "comment": "Malware payload (SnakeKeylogger)", "value": "83b1b50d9b5f223d99ee4e6472e11e9769a564621b3dce20d68f27ac9add58ad", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886459, "uuid": "363c5de2-508d-4124-9066-2669fe63abd5", "comment": "Malware payload (SnakeKeylogger)", "value": "1a6bd2b4cb1e9cf9c17faaa5c25f34f633673da1", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886459, "uuid": "f89c446d-56c0-4d90-93fc-d2bdfca699f9", "comment": "Malware payload (SnakeKeylogger)", "value": "eef5007e467ddd58f8d2dd288d065e03ea62b98007cc07cb496b68a09d2e6a4fa4cb7b18bd1b7554984cfa3b6aa7ec5e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886459, "uuid": "e7e5870e-901a-4ede-ac4a-d64674a58b1e", "value": "4F558C02F244AEB4F02B37B2447A833052FD6D4E8221D67D3E4A765A45B63C115F7EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886459, "uuid": "3a54629c-9d46-40b6-b32b-402a2447c045", "value": "12288:YUggzKJu6n63GROqsvjRZgTPEonocf+iuGbRmjsSBJo5PNwH9Gq/Io5FLB1CSiyJ:Iv63GROqiQnN+JGNqywdGeI0FLTCd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615886459, "uuid": "3b95bbe7-636e-4ebd-af2a-257970986c46", "value": 1339392, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615886459, "uuid": "6e3e93c4-67ea-4d7c-b65d-20e0059e78e7", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886459, "uuid": "24fbc2c2-e328-4c7d-ac01-b4bb9d89aa58", "value": "DHL_9073782912,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc2c2c9-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615891237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891237, "uuid": "e739914d-7e4b-4ab8-95ec-4e9191d10cd6", "comment": "Malware payload", "value": "efec585ee323d53c0921e1506079d3cc", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891237, "uuid": "c8360521-584b-4c3c-9f46-935bd2317f71", "comment": "Malware payload", "value": "83c4253c3f9a4b92ac87dae414ec7629695d692b6e6f9903c44a5040e13657e8", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891237, "uuid": "1a02b4ed-a0b8-4634-826a-f294e23fd006", "comment": "Malware payload", "value": "d10aa98961d789b0c4ca8a9224f45e1ed0d8ade0", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891237, "uuid": "a11164c4-1f3c-4b24-a6ec-fc20a6b1b997", "comment": "Malware payload", "value": "1605bf3ec30b93a75cfe6b9534746091812720a3f3a9d40042f3c40a77555b66bc77df675388f7cf169bdb8e721d4782", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891237, "uuid": "a7334178-705f-4fb3-a23e-409cca9be9fe", "value": "E443023FB42F476437656671643A83A6A6F44F69CEC0D33A7F44D9BAA4050A4F1C89C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891237, "uuid": "07718d11-94d0-4165-85c4-1a0ab17beb80", "value": "1536:cs7WMdhp9hbpoXSUHeU1J8GPw97B/auvYB8:LdhNGvJPPwrZYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891237, "uuid": "4c11160f-7d4e-4ea8-bf9a-95d367dc5a5a", "value": 56266, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891237, "uuid": "36113392-999a-4e83-a127-a6037362f2f8", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891237, "uuid": "b178258d-2757-4eef-a504-97e8f1730ccc", "value": "tipo_2379.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d18a83f-867f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615916714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916714, "uuid": "e6a0c243-ef3a-4a6d-b65b-7258b79dae20", "comment": "Malware payload (SilentBuilder)", "value": "5013847cb7cbeb093fcf53ce8a809037", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916714, "uuid": "04ae7648-9028-4522-8a51-44ffd3a8e7f2", "comment": "Malware payload (SilentBuilder)", "value": "841615622648b44a493c3ac9ecae5da6975a0b80663284fdb3b62f5bbe50a251", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916714, "uuid": "3954e700-ddc6-4281-af51-4c6e0b10539b", "comment": "Malware payload (SilentBuilder)", "value": "5a23caea6d0ab9d7a5276a57f4c8111c0c3703d0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916714, "uuid": "23704d23-9a64-47d3-a7c3-73669c14afd9", "comment": "Malware payload (SilentBuilder)", "value": "f73215f318fd12bc4dafbc07de76af1b19eedfe274ffea37b078a44cc24fd15219a1f8de219ac5f1d1a4a653bb79b7d3", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916714, "uuid": "348bc7de-bf31-4221-911e-16c8938fcfac", "value": "68349D57A9458E03E918C3B9BF634E6E631BAE145A9633C7312E7E5B3FB41900C4B11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916714, "uuid": "1dd6141e-1c87-465f-b482-2c3997a03a9a", "value": "6144:eKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgv2IS7FgiJsJ4BR5043yVuBCMmnqLsUr:WzGiK4504Sy/mnqoUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615916714, "uuid": "c4368d6c-3733-4bc8-911e-ddaf42d9fed5", "value": 237056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615916714, "uuid": "6fa77391-0448-4f33-b300-b9ac9e50da08", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916714, "uuid": "e865fe67-1aa5-42bc-8f4f-8b8bdbff2f6d", "value": "SecuriteInfo.com.Heur.7259.16621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c29fda-865b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615901408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901408, "uuid": "a129ed4a-0231-4105-bb30-66bb13d60955", "comment": "Malware payload (AgentTesla)", "value": "75e737df5f4df0cee65f2ce0074c7d4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901408, "uuid": "823cd906-cd15-4eb9-affe-8b14d53ea460", "comment": "Malware payload (AgentTesla)", "value": "8464be0f82abf43f88803ec5f9b9eba9f51ad2024e905fce90f804f42ab4da2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901408, "uuid": "0bc58f99-c637-44d3-ad41-1514e7363c65", "comment": "Malware payload (AgentTesla)", "value": "100fc7b51392494eb5538c6290d06121ec40d949", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901408, "uuid": "9fd8cd51-6c8f-413f-b30a-27caf90ff91d", "comment": "Malware payload (AgentTesla)", "value": "2b3a9fcd5af1f2e68d74ca68e44a7a05baf412a6f6ed5d0dd95a0809fe6cb1630271f0a7c4ab8abac56ac1da0395fea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901408, "uuid": "44a2e5c6-b91f-40d6-8d18-65e1b805801b", "value": "9D15BFBC7500BDCFCC57DE3689952C28AA206966E307D307E02725EE5E1EA97DE045F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901408, "uuid": "474b7940-dc48-4b68-88c2-1bc9907f61cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901408, "uuid": "a3e42676-f522-4302-b5dd-e9e669a1bf75", "value": "24576:E4/5s+na+DLqN2YEqFFI5Q9WKoOBfbpzTB9DQ:1s2a+XbhCFKQQKoUpzTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615901408, "uuid": "0b6ce921-e358-4ec8-adaa-9f96d63d9a9a", "value": 946176, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615901408, "uuid": "4330a34d-d315-4782-b99d-566f9977b652", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901408, "uuid": "6311524d-23a3-4ba0-95c2-b3eac81c1cd9", "value": "Z3bjoMZ31lRtUJM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173f5531-8622-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876654, "uuid": "486841e3-9603-4e0d-92eb-7f8841955730", "comment": "Malware payload (Formbook)", "value": "eac2ef115af4b60ec3bafc23e5f76594", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876654, "uuid": "41a7578d-e32a-4515-9d81-368119aba099", "comment": "Malware payload (Formbook)", "value": "84854be4ee8490d0496cb37b2adf670af9ae6ee388a0e7e0e709d54a99127bf0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876654, "uuid": "f3f8bac1-fa35-4783-a460-6883beba8089", "comment": "Malware payload (Formbook)", "value": "9ce634e172ff8bf5fc0a671557a5aff03fdbda89", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876654, "uuid": "1aa8fa34-6707-4ede-9f2a-89e0e1efd1d4", "comment": "Malware payload (Formbook)", "value": "ab8634e0fe7233d8987d8157c8d934f2b6257397ef7f94bc464d23a1bd10b6456e1d21ffbd1f0ea3a5189146151ccc5b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876654, "uuid": "b9076508-796b-4f92-8bb5-ac56bfa235d5", "value": "F3C5331BCD86DF83F0CA24F0876E517DA53A4D04EE05A94F378CB60B1A777E0A296316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876654, "uuid": "8454e089-e4e4-4f11-92cd-092f9ac57e59", "value": "49152:RwFivWFlFZlMZi/xOxsQlvg8ezTjuU2mbXX3kb0C4idktP2EKTTtUF8:lsvl/AJgPLnW0NidcPzKTpM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876654, "uuid": "80313d40-bf5c-4ffa-82a1-8ec3a3063ab1", "value": 2499584, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876654, "uuid": "65ab58d1-7b90-4ea7-bd14-c59e4d8eb258", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876654, "uuid": "16ed046d-9802-457c-9ba8-0483b0dfb64f", "value": "Shipping Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847b7431-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615923652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923652, "uuid": "707fac02-6a89-4641-a3d8-14f6582c8c3c", "comment": "Malware payload (Formbook)", "value": "7501030063afc2c2fe8045e59b2d8ad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923652, "uuid": "5d13be02-2e70-458e-8292-02bdbc622cd1", "comment": "Malware payload (Formbook)", "value": "850ba9cb8e16d04b40e1499ea65f614d760af29ed7f0892f99e10c88e1f80c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923652, "uuid": "fac8fa9b-13fd-4e76-9ad4-2fbeecb46bf5", "comment": "Malware payload (Formbook)", "value": "d65775d4733072640b863dcffe72e7184cb16950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923652, "uuid": "567be138-2642-4099-92f3-93f59457cd31", "comment": "Malware payload (Formbook)", "value": "54c23d5f96bbf21f1d53b3923f32d6491b3f075a41cce8f273d23c3ac877e40423de1973bc0ba14cf1d83001c0754e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923652, "uuid": "da379742-b049-424e-b32e-84a82b8743f4", "value": "881501693799E661D0BE973A0431520423F4EC11FA13E34E7EA635ED1DB6B84813B367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923652, "uuid": "8be643c4-ca69-4151-8b56-282a57d2f2be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923652, "uuid": "6d7a8587-3c2e-45a5-990a-dc44ace96a25", "value": "24576:JtHZi5UsPTbabYhxOtn1oLM4eyIL9aePCGENc7IkHSLdc:nHornabYaQ/jgtZIka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923652, "uuid": "42eb9437-e68e-4c96-b10b-a066c4c2c686", "value": 948736, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923652, "uuid": "6b2f09c9-eb58-4364-8e67-236c66ed0a80", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923652, "uuid": "b4c94f3d-c0fb-4f41-a2d7-27dac4f51d33", "value": "7501030063afc2c2fe8045e59b2d8ad3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f95706-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890951, "uuid": "5452cae3-f481-44ea-a92b-ec090681448c", "comment": "Malware payload (Formbook)", "value": "0e0f6f0e071d56bd3dac80d8ef637e8e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890951, "uuid": "63f31da2-49b6-4816-8217-95159ed2b481", "comment": "Malware payload (Formbook)", "value": "8700c8d26ecfb96b53a7f6da73e95f3477738309028be2b31c04ea49751444b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890951, "uuid": "09b1eced-e16b-4b85-8830-3e263a67ae5c", "comment": "Malware payload (Formbook)", "value": "11381206911bd08ee006cb35bc664c47e2586977", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890951, "uuid": "28e21d4a-b4d8-4f4e-b33f-9e5dce199dbb", "comment": "Malware payload (Formbook)", "value": "ca7e7839c0d3d3253140efc5dd0467311cfbc69af237cb04aa261751f76dd17e2149094cfb57691b56d1922aa1ddecea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890951, "uuid": "720ac1d4-fdaf-45ef-81d7-2a0c999e9919", "value": "8DC55A04F754AE96D5171B76C1A3852482E4DE6B2273F30F79D9BCE27A3238A4D4E4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890951, "uuid": "ace8d0e8-6d4b-4336-8b2f-75479452779d", "value": "49152:J7myfeqqD0jjxnqkaaFZp27enk6ymYIr7GrCKnY27RENq6+7U8LcjHWdr:J7myfB3ebDgJEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890951, "uuid": "da962780-742a-4d6d-92b3-9dac57b11a8a", "value": 2686976, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890951, "uuid": "44935cfb-86f7-4c9a-b052-3f1a34f4fb20", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890951, "uuid": "a79dc3bd-795c-402d-86e7-e42547d826b8", "value": "RFQ_38463846393646388368364834.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f088138b-8628-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615879595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879595, "uuid": "1a0b5f40-21da-44b1-8d8e-d21f99b8b779", "comment": "Malware payload (Dridex)", "value": "78d34e364d04faca6ab79114721dc6cb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879595, "uuid": "ad085818-e65a-4ab2-b991-2cd395b5715d", "comment": "Malware payload (Dridex)", "value": "878ff61223060fbebd3df2404fee35d394d627a197ada29fca9c6a9bf8ad9a89", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879595, "uuid": "005957d8-68c7-4fad-b93c-148bcfa7ea90", "comment": "Malware payload (Dridex)", "value": "9e1bec1dab6bc8126d9a7037b5c89235addff69d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879595, "uuid": "58e23385-5bcb-4517-b583-4f992817b0a0", "comment": "Malware payload (Dridex)", "value": "287fa03bc08fb242c3ce60f3cec298b2e55b629f506526f723154d6d8be3c0de7aee835d11f9498a13c8e8e9c18e76f3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879595, "uuid": "1e8fb8f4-98bb-4f46-953a-71d9251016aa", "value": "DA14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879595, "uuid": "3cfc21ed-cca7-4e96-a659-be8fa507d0cf", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879595, "uuid": "0dbe4e5f-5909-425f-859e-d0810e8cc5cb", "value": "3072:U1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ai78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879595, "uuid": "60d27aeb-e2e8-44c3-8535-e0a99dc35392", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879595, "uuid": "7703cf8e-9375-48d2-b4d6-e6bcbfe826b3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879595, "uuid": "09982bda-df59-4d86-acb9-57c3375ef8bd", "value": "878ff61223060fbebd3df2404fee35d394d627a197ada29fca9c6a9bf8ad9a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23981c42-86ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615935515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935515, "uuid": "dcb92311-0be5-411a-a244-fed6df704329", "comment": "Malware payload (Dridex)", "value": "d6ae4badf97e8ef8750da5e26e246fd1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935515, "uuid": "e5af60fe-078d-4dac-9bb9-0b8b4944a5a4", "comment": "Malware payload (Dridex)", "value": "88c4a2048f5589a9e02e8d57c04198ae71aaa3d43e5461407ab87284efbf24e2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935515, "uuid": "6c5521e5-58ae-4f15-ae32-4c4b64d8c822", "comment": "Malware payload (Dridex)", "value": "1e43fb8b543fa5e9e6cdcbe2b53272826b314640", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615935515, "uuid": "2492aea9-c034-4de5-b156-bbcb157fc290", "comment": "Malware payload (Dridex)", "value": "af7f43f736564af10fe002e818ab5ff39d52269c9e47f3f8ba0584346948e64469fa7dc9738531b65b8ddfaf402ad0f5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935515, "uuid": "fd6b8f61-a750-4709-9729-0cffd73c6e23", "value": "4514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935515, "uuid": "bec8a856-7dde-4e66-8741-2e22bf4b9aaa", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935515, "uuid": "bb760a28-6fcb-406f-880e-cf289575d125", "value": "3072:B1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:zi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615935515, "uuid": "4c38e368-cb7c-40a5-b548-ea6723e52dff", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615935515, "uuid": "09f61828-fbca-4982-a438-49525f0da878", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615935515, "uuid": "c4290996-1a86-44bb-84f0-360cfe611879", "value": "88c4a2048f5589a9e02e8d57c04198ae71aaa3d43e5461407ab87284efbf24e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae44227f-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922863, "uuid": "5224c923-6e98-4cfb-a9f3-b43d2d26cc2a", "comment": "Malware payload (AgentTesla)", "value": "d5b7821b99a3ee4edffaf2b348aae96b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922863, "uuid": "7aba6a5c-a739-4ddd-9816-19357ee2ffa5", "comment": "Malware payload (AgentTesla)", "value": "89e810454d187429db6d954bbeb681c28f8e3e39a9584df282b70786dbe46a07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922863, "uuid": "cd81376f-01b8-4d98-9ccb-e46c24fd9611", "comment": "Malware payload (AgentTesla)", "value": "668e8d6a1d8d21f65120313e181f0a34c6e626f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922863, "uuid": "7f973eb5-3a14-4897-bce8-15743174c190", "comment": "Malware payload (AgentTesla)", "value": "3f7302e6af2d86419b6a659c91829c9a49eb45ee9565796760772a5663185de5031afd31e6e97613a177b24e9a256bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922863, "uuid": "bdefaec4-b124-4b0e-a282-f96b43228939", "value": "9E257A22E6A4AB70F03D73750431133183FDAD429621EABD7E9971C918B56C186F3EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922863, "uuid": "1b0b4cc9-8b0c-4d45-955c-3f1eb475586c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922863, "uuid": "35dd7e03-7c68-47d9-a418-9cf346120d07", "value": "12288:D8FgWa6QBC5i1yg7m0uDQre/sw69a5/xWCE2qNj6Qs1:D8FgWaHj1y2qQreE8tqNj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922863, "uuid": "6a2a4216-0198-4c8f-99b5-f1c03b958695", "value": 1041920, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922863, "uuid": "1fd7f1fe-446e-46fa-8cff-b6cae0faeab4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922863, "uuid": "af6bb134-7769-4442-b69f-4ac886ef1439", "value": "d5b7821b99a3ee4edffaf2b348aae96b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afd2213-8678-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615913570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913570, "uuid": "4346656c-2b88-4896-95e2-90b5fa3cfa7f", "comment": "Malware payload (Gozi)", "value": "7f9056a0be01d4a37d28c87855516227", "object_relation": "md5", "Tag": [ { "name": "5513", "colour": "#31AFC0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913570, "uuid": "0b6bab5e-01ce-4c13-8cba-d3d4b67e3748", "comment": "Malware payload (Gozi)", "value": "8a87c11a8e4b004631d5420f059c51d6f868776354ad12a5e076695aabdc744d", "object_relation": "sha256", "Tag": [ { "name": "5513", "colour": "#31AFC0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913570, "uuid": "553a7199-6ede-4009-ad46-da2eb9832ce4", "comment": "Malware payload (Gozi)", "value": "ead6fc70906801d45e8490a302b5dcac10e75547", "object_relation": "sha1", "Tag": [ { "name": "5513", "colour": "#31AFC0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913570, "uuid": "bee2599d-af84-4132-acdd-ce85f6dcc419", "comment": "Malware payload (Gozi)", "value": "1916cb470cc5f36c675b2a39040003cbc05b23993fd0ed694f117b95edbd0720e56a0eac6ec66dd0d657a28f2584caf2", "object_relation": "sha3-384", "Tag": [ { "name": "5513", "colour": "#31AFC0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913570, "uuid": "04bf834a-61ac-469f-bb01-53397774fa5a", "value": "5426AE7F10515DAFF740B8761A3080036E8A625BE4DD94DDB80F90736F18FBA94AFA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913570, "uuid": "311157eb-a18e-4163-b126-cbfc07bbba82", "value": "49152:oVUg5AfUb76jl/PTV0maWj4qO4eiJbFFYRKFZW+sYzMtqrDpee26:o6gF2jxPpbaWjRnuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615913570, "uuid": "1e404f07-8c86-4b41-a873-93f4a954f17e", "value": 4505600, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615913570, "uuid": "a4eb005f-cf1d-49fd-80d4-69aa8e7c6343", "value": "application/msword", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913570, "uuid": "69e55a84-442e-4a03-8e3c-eb287eea4d05", "value": "z q l x c g.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17679ce0-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615890827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890827, "uuid": "8f76805c-dfaa-4e44-9cf3-481e3a91dac9", "comment": "Malware payload (Dridex)", "value": "1d10f1e60d8163a60769f5972e41d684", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890827, "uuid": "3cfd1db4-9a8e-4972-b6dc-6aada17a03c2", "comment": "Malware payload (Dridex)", "value": "8b2fde9e9fe5f01b0b317cc0bf0515d8dc67ec3c7d3827567398935177553223", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890827, "uuid": "08c69c8b-ed0a-49f1-8335-12eb6a901d1e", "comment": "Malware payload (Dridex)", "value": "64074b311f74a5721f1fac6eb31b8224687b8422", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890827, "uuid": "200ccde1-01a0-4cfd-8409-261eb4f77a17", "comment": "Malware payload (Dridex)", "value": "d80eb2c722c1f9a75b7d20ba5b693740d3cd6456dff3afccfa9914c1235ffa066b33d266af500691e95e75ca27ee927a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890827, "uuid": "b040524b-e7cd-43fa-8291-18fe6e3cd3c5", "value": "D214AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890827, "uuid": "140a9dfb-a79d-4f66-a1cb-a8335605b080", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890827, "uuid": "5e798a1c-2e5d-4243-a329-09965aa8f563", "value": "3072:X1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890827, "uuid": "9b69989e-eb92-47a7-aee0-f2492d6e85f8", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890827, "uuid": "ac5d6dbc-c2e7-4e99-94fc-9a736647fe04", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890827, "uuid": "d34cdb59-f8a8-4e5f-a5b4-4c036e9d9926", "value": "8b2fde9e9fe5f01b0b317cc0bf0515d8dc67ec3c7d3827567398935177553223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3a818d-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615923610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923610, "uuid": "c0970353-e59f-415a-ad8e-4f6a91f61f7b", "comment": "Malware payload (Formbook)", "value": "5db87cb7c962ba04dd978d30cb01c246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923610, "uuid": "a6a25ada-d74a-44fe-8a50-812f0a4bbeb0", "comment": "Malware payload (Formbook)", "value": "8c12d46d8842e4aea5c000fdea92abc49a86019f74a4a3d37e039a05c0b17c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923610, "uuid": "fecfcc75-2de6-4f49-8e44-6f4ddd2125ec", "comment": "Malware payload (Formbook)", "value": "08337d3d1e0059ca4370d7c62acd603810a147ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923610, "uuid": "eae7f545-50ca-44d6-a797-565cd142c2a4", "comment": "Malware payload (Formbook)", "value": "6844078cfee26e1acc6c5f9c551e25dc0882f484bfaf2f21520f00c70202ec2f736239825015f96a3dd7f2e8db7cc3ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923610, "uuid": "50915d4a-1a5d-44ab-a761-1c265b986549", "value": "9E24126EB5C18DFBE61B52B18DB2BB5EFAF7D11600109B4753618E2C1A2B6D9430E183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923610, "uuid": "6a465427-4d1f-4b95-899e-9c7d113f8eaa", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923610, "uuid": "7c187f07-7683-41a6-911e-95ebff5d1c4f", "value": "6144:sTqjFxBB1MGlnBeZ0lIRiCdhXZ7xQH+QkcY:s6BFlnBOieBRxtQkcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923610, "uuid": "1de4906b-6452-491c-ab26-50e28c93ccc4", "value": 217813, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923610, "uuid": "3b1eb0d6-2fa2-468f-ac78-9447afabe2d5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923610, "uuid": "98f9cba8-020d-4104-a96c-599e9773e4dc", "value": "5db87cb7c962ba04dd978d30cb01c246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca070ca8-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922480, "uuid": "9fe3bb1c-155a-4ce2-a695-606904e5a67a", "comment": "Malware payload (AgentTesla)", "value": "6d3104277427a281bf5ea950b81e7441", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922480, "uuid": "4d13b2e3-7583-4d73-953e-8297ccb12f90", "comment": "Malware payload (AgentTesla)", "value": "8c2eb36fc68b33fc269eaa5f42a303b63ee25bccdd99c0c424285aee9317d94c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922480, "uuid": "07daae45-8b4a-41ec-a7e8-5a4fe1fbaa05", "comment": "Malware payload (AgentTesla)", "value": "8e4544eae4f9f19884a19b9ceb26925fd885f4a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922480, "uuid": "ddaa249b-f7ff-4a77-861a-c92654094e99", "comment": "Malware payload (AgentTesla)", "value": "f3b93f05db1b3bfc3dbeaedbde233008f5fade93785acae5901d8ac689db7bbd7ea5e423ce30cedcb5af6aed4a24aad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922480, "uuid": "f6fa8490-296f-41c6-9308-e2dc864b9807", "value": "3225027623989AA1E4FD8B792425610447F1EE03D303EB8EBEE131DD1672BD08677623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922480, "uuid": "0940fa6b-d280-41d9-ac9d-86a97896193e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922480, "uuid": "73d3c1e0-c83e-4cc5-bc91-c544e7c9aaa3", "value": "24576:oRoY7L/Wh6l4drrXpRE3fIn9MfUGboTnWBWN:HQ6v5RagMfU1nWB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922480, "uuid": "059a9349-b3c5-4283-ad32-269c3a86b8d1", "value": 964096, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922480, "uuid": "fe024e4a-511a-46c8-8683-006ac2f43927", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922480, "uuid": "02b52f42-4a19-4067-a3ee-5821790a44a9", "value": "6d3104277427a281bf5ea950b81e7441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb0cae7-8659-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615900339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900339, "uuid": "6c1b49f7-5c6b-486c-8759-e597874d6da6", "comment": "Malware payload (AgentTesla)", "value": "1b0a30b9c1cd412188a76ad119a540bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900339, "uuid": "d0d216f2-033a-4f44-8c97-25caecee4093", "comment": "Malware payload (AgentTesla)", "value": "8d7cd3d4264ae7aebd4bfac92f94cf9a1155987a66da1b10c212a82bf075acde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900339, "uuid": "c90f03e4-686b-4885-a2a7-d2b845b7c2b9", "comment": "Malware payload (AgentTesla)", "value": "e37ddd5ba4d0331d0d7dc2c2dae3a1e1b7c1b24f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900339, "uuid": "32ee8a49-f4cb-4420-8c78-78e091b33dd1", "comment": "Malware payload (AgentTesla)", "value": "732baaa835fd363dabd0b87f0b02721eb95a45b63676459251af9efb720159eb4cedecf9623051d74db667ec7805d61b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900339, "uuid": "5d7c36fe-f9df-45d2-a6f2-5c63616adfd2", "value": "13F4019AB2688D27CA1DBDFD04D3912D8F709963E565F38B2CC560EA11C57CA3C04ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900339, "uuid": "16decbf4-7aea-4f21-a898-94f3880910d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900339, "uuid": "d7ab1fb8-fcda-464b-aee3-98fb192e6895", "value": "12288:+QesoSmlQXeGIMMCGXd4rPJQbMsBbQuFNJ27jZJ8CMssKvMKkMFndA0tZieSBK:3MPCZuMRX8ctkMbvnmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900339, "uuid": "f9c5b14d-f606-4afe-a3c9-37c8735bdc3d", "value": 789504, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900339, "uuid": "5ded4737-a7ca-4f20-9af1-3406679afdd4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900339, "uuid": "a081ff42-cbdc-4bdf-b3b8-30dac111dae7", "value": "urgent proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2d7664-862e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882009, "uuid": "a25cee08-add7-44b3-bef7-ef5bffa4c1e9", "comment": "Malware payload", "value": "524d27247148987a9201cd46080ea4dd", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882009, "uuid": "af0bd620-1566-4633-b404-b7e76ea4d0f8", "comment": "Malware payload", "value": "8d891e3da219b2daeb194c192c3649140b47fa493813e09c66bd8f29219d7ba2", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882009, "uuid": "93ffdc3c-70f4-455a-96b2-277bdf887e23", "comment": "Malware payload", "value": "e5e350f3a68917c6903adddc84f5ae57ec114967", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882009, "uuid": "a59f0af3-b198-4cc9-89a3-c78ce2d597fe", "comment": "Malware payload", "value": "e592b5e6b53ddd9478469b868dc7f13d4d87fb35bac1d8715604f6c7a52d8eeb40391b9c1fba1aa18b7212d2ca97484c", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882009, "uuid": "cc4864cb-fd4c-46ab-90d6-28d7722e0a3b", "value": "B85302E3263D8A1A90B4C67D24B2A134A5F6437814745DECBBEE7FA94B67F201442C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882009, "uuid": "ff71f47d-636f-41d8-9646-ba6585e71390", "value": "1536:9BRW5jpwM8rAB0Ify0d5I8hJ35vswLCBAmSyrojLw3Cy:9Cw5IR7TpvUzoLPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882009, "uuid": "de5a179e-60ba-4abf-b20c-fd8ad23a0c80", "value": 63590, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882009, "uuid": "9a002bd3-f907-4882-90ab-f293e8298e53", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882009, "uuid": "9f2ad6d2-0441-4c74-95e0-844c836f0242", "value": "dettagli_2188.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702bf5c8-863d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615888399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888399, "uuid": "f821ab5b-14aa-4bb2-94bc-35ac4eed82ff", "comment": "Malware payload (AgentTesla)", "value": "adf076d883afeb5bed4f9bde491b4be3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888399, "uuid": "3e37f185-f690-46aa-9f47-9f2846553cbd", "comment": "Malware payload (AgentTesla)", "value": "8e41b4c94191b04db8e0d240a7a76234c22cb075f8cddb1db5896d6e6246b5bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888399, "uuid": "d17ec8f4-d62c-4a28-a9f3-a780094809d1", "comment": "Malware payload (AgentTesla)", "value": "11ed41b233c6aea4b7bd355b4485a1787f5b040f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888399, "uuid": "dff13609-9031-4727-9b66-0d0b87848080", "comment": "Malware payload (AgentTesla)", "value": "f0e695e5a3364c7350425c48922b4ddcd651c9822c792412065c185438ecca597a3a3ea0aec463fd5ef738ef62f49cd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888399, "uuid": "5fab0c25-5e39-421e-a023-c1c73ee77a63", "value": "B4F37DA8E9D0CDD4CBCFC9D94A1D7A952023FAB9C6C36C964438F3F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888399, "uuid": "5df15d38-d124-4f45-b366-64329c9dfdc4", "value": "3072:Wv6qu4Zts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8eX:WvW4Zts6vVGt/2l8nxpKJTJznhdDT+8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615888399, "uuid": "84daaea5-ca70-43fa-ae2f-01abb661b71c", "value": 167474, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615888399, "uuid": "f44a3ca0-84bd-4608-bf3a-1cc1aa33eb0a", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888399, "uuid": "6bfc33b6-8362-45b5-8e6b-337da781dd39", "value": "order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63afe309-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894821, "uuid": "ce0cdbb1-d7f7-426d-bff8-948efb2cab75", "comment": "Malware payload", "value": "a101a6bc935a375b1eb062c844390067", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894821, "uuid": "d12e3199-7309-4ecf-b232-046fa2ebccf5", "comment": "Malware payload", "value": "8e5c82972394cff6ed36dcb0d8becaed4414716f3e34827069370e01043bc86d", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894821, "uuid": "340a33ea-0dc3-41f8-bedc-e6841aa8ce67", "comment": "Malware payload", "value": "0d9d6d5366d0f00e5e0ae249acd19140cf132975", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894821, "uuid": "8d6f46fb-1c9e-4e2f-af18-fad6ec9f8cbb", "comment": "Malware payload", "value": "a3cd702119c30d36bdac084ed1cac2aba106dfb0626e49018ace319bd4c7902331d9127ba78df746c8495885a2841e67", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894821, "uuid": "1421fe57-b488-48f7-b18e-d1e2cdea0385", "value": "2A63F19EB614B161CB64B63CC6013AE65D1E7446DC82E80E36806F14B9E29C717CF2FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894821, "uuid": "81feb6c1-84ea-4158-94b1-ad52fd556805", "value": "1536:zH7zT1HfKW/uNKY4D7qTRhlDxyFOX3T/Cag0yNR:X1/KldFhi4X2agdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894821, "uuid": "b644056b-ada5-4110-b69e-2c493c7f15ee", "value": 69011, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894821, "uuid": "e5c73553-7bf2-4633-8211-78640a61336b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894821, "uuid": "57b32536-c4bb-4743-8476-6baec85d491e", "value": "contri_2968.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e42e468-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615889121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889121, "uuid": "39a61432-0fa9-4893-afc5-4c8767e66a16", "comment": "Malware payload", "value": "cd76c360715ca503beb36aa1ac7b39f0", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889121, "uuid": "465506bd-2ea0-4e28-963a-6f4532bb8ac5", "comment": "Malware payload", "value": "8ea1f48cbf0fc2eea512c1938e2b0d0c73753e2a2ef7692277359f825ffb8054", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889121, "uuid": "1ee8adf2-922a-40d0-b913-0276dedb2138", "comment": "Malware payload", "value": "bfed6a480a669b9689f0f6adbf57cee2e6037f0b", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889121, "uuid": "27cbaa15-ce46-4780-add7-729377e98760", "comment": "Malware payload", "value": "25624e3416224bd63030a51f063faafa776fbbee1a02f56c5796216dd8787774a9af1ebf11c52c8516be6a00cc635f0b", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889121, "uuid": "7d7ed980-adbb-4255-8ea0-66e74a8401e8", "value": "4C530218307CD20053396CB14F8633E14734DE035CDA6972EA362FEA636B966756E2B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889121, "uuid": "53a417cc-1055-4c94-a205-15ab232a3332", "value": "1536:HWA6tDu3nO4eE0fDH+wTLtyWbCgbzqG2mBpB/OicA1891:HX6tDu3nO4+LewvtyWbCAzjpB/tcUy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889121, "uuid": "a36f3039-151f-4cc5-a6b8-7e2637b5ca73", "value": 64968, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889121, "uuid": "4ac70705-56db-4016-8e78-147f6425d838", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889121, "uuid": "58b04be9-05bb-432c-9404-f9243fde37d5", "value": "fisc_570.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e1c353-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615890182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890182, "uuid": "09842d5e-033e-47a4-beab-31c57a3cfb69", "comment": "Malware payload", "value": "733e50c730bcf16de86d0d9dd9feaf1e", "object_relation": "md5", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890182, "uuid": "6a63813d-4908-4958-95ac-3adb54e9740c", "comment": "Malware payload", "value": "8f06ea4c56e7f0fedfe1e271d7a2228cf01e567cd653476ba3b1af7fd24ad460", "object_relation": "sha256", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890182, "uuid": "c0c3581f-7283-46bf-bf84-29552b994c61", "comment": "Malware payload", "value": "6ed3e741515f2a40add4fef1dc1c56229b07c987", "object_relation": "sha1", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890182, "uuid": "fe2fe5ef-c12b-4e6b-ab38-7bd92c35a287", "comment": "Malware payload", "value": "a986abba277eceffbd767c6238adccd9e78f78408fb64c9e3c205221e28595656c3e9640eb8a8f9a2280925e6b5a2555", "object_relation": "sha3-384", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890182, "uuid": "c66b5dea-d6a7-4a4e-894e-825a9db39637", "value": "D663B3F85EA878FFE19CFA31E98D11016E30A6372420B76B49C752E3C1627661DD44EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890182, "uuid": "59e23672-380f-4c5e-b1e7-cb464b3de7b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890182, "uuid": "f90809af-09a3-4aa5-821b-6e264f13af7c", "value": "1536:arP6wAvUizRrIpMsrwqwviYBxg1GL+lOFt:arPtAvUizRrcMscqwvZUG5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890182, "uuid": "48f8db01-6a36-4b4b-83d3-eaa37d10bb6b", "value": 71168, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890182, "uuid": "e6897b41-daf9-486b-968c-ebd54b49d454", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890182, "uuid": "ad634e17-734f-45ad-b917-f6abcd1489a8", "value": "OR60010555_00011136_20200109162034.PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adca0bdc-85ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615855002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855002, "uuid": "182b5fbc-f272-4ffa-9b6c-8b05a7cff5d6", "comment": "Malware payload", "value": "94b5dda22f81433dc9282b766bbdd336", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855002, "uuid": "576065da-589d-4384-8b81-396acfcd1334", "comment": "Malware payload", "value": "902d92c8b869fe25b212fe80b313b8bd7391482334a155942b6bbd96e3c2f481", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855002, "uuid": "156fd03c-2f2e-415b-bb7b-5bdbb9d3e6eb", "comment": "Malware payload", "value": "ecc3171ea5720db2fd83000941fcc2d4d618bbf1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615855002, "uuid": "e9d35072-a7e1-490a-a765-d840043bd1df", "comment": "Malware payload", "value": "1e3190a45d739e115e058a1b76bc56c25109ca3eef8b5550af5810537c747f8c7cdd29f8dd150db600ef8828a730ae26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855002, "uuid": "6fa91199-bdcb-4b67-a769-acf90cc06f91", "value": "C2938419F591D91EC3581A318C8EDEF6B1247D48ADCA631B73A17B7E1E3BF249B01214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855002, "uuid": "6125cc70-0100-4b7e-bf40-dd6279d51e9f", "value": "768:pKO78ds2ea4RUcvNGs40KuI6VVUutz6P9aHiy0+84CLNdi1GIFld:c8KYa4EkG8z6P9Miy0+KkXld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615855002, "uuid": "e01faa48-ae7b-44bf-9ba0-4283f0a5d532", "value": 94720, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615855002, "uuid": "86f6d826-04e5-42fc-8f69-f802ac4ee6f7", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615855002, "uuid": "dde67001-6f32-4137-b298-0d9c658d58c4", "value": "SecuriteInfo.com.CL.Downloadergen87.10432.2074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7afae58-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890210, "uuid": "18d30452-d3c3-4892-a84f-60bf5dd89067", "comment": "Malware payload (Formbook)", "value": "e5d070d96c75bdbe41210711e4bc97d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890210, "uuid": "4b335736-170b-4d13-84d7-476812e836f3", "comment": "Malware payload (Formbook)", "value": "9077c5bd8b52ae5eccd277c906ae24e677a8e158af5fcb3597e254417cbee483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890210, "uuid": "eed4471a-f1a4-416d-b8df-de571b03011a", "comment": "Malware payload (Formbook)", "value": "84f46d0011366eb32e147f258b5513c4d8819a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890210, "uuid": "0fe64740-4214-4163-a18c-8c9c7a9e13b1", "comment": "Malware payload (Formbook)", "value": "5be4ab225c059c89944f9f5b29a7400ff28cd9a7a1297f9b50082f4b3a85b920c8030daf0d510e65561075b441e45f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890210, "uuid": "7d516723-0efe-4aae-adf8-04201e09e001", "value": "69150135279CDBA5E5BE97390830161403F4AD02F626E34E7DA630E92976FC58A77313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890210, "uuid": "52c8471a-4645-4064-97e1-49ee0ded2458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890210, "uuid": "1c668eb6-1996-43a9-8067-5d35704c78b4", "value": "24576:CUS82/Dl2MlmJGHEc4FncEwW5yWpKZSh:rS8ep2MjSCEZ5yWpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890210, "uuid": "06179277-952b-4a8d-84f1-c600af4a2c16", "value": 883712, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890210, "uuid": "feb8e4b5-82c7-4a92-b9e6-5a54d9b15fe4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890210, "uuid": "2e697769-77e5-44e4-974c-f39f6bfbd0e7", "value": "RDAW-180-47D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce3b7f2-8623-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615877361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877361, "uuid": "c4cc1dc4-7f7c-4efa-99c8-d43f27fdba81", "comment": "Malware payload", "value": "02467e46bda3d66d69c2eda41c8c414c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877361, "uuid": "aa7d7337-a9f0-4a24-be49-4201c7ebc398", "comment": "Malware payload", "value": "90c64fa859d15e42dc9b7a67350214d55b51d3704a31f3901208e0221874e2da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877361, "uuid": "d47b4299-6104-4987-9e28-5dda3ebc6042", "comment": "Malware payload", "value": "1cf12eb3707e22e859c084292f9ea87484f0429b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615877361, "uuid": "d0577066-3292-4f95-b068-adb40f3c4849", "comment": "Malware payload", "value": "ca310bf7267951b827b6838b4fe0af2bfa24bde8213ddd07a6bbea9c286210db045e4895df6f2dda1625b8c2dbd97c95", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877361, "uuid": "c548ed25-bbb4-4e7a-b550-9ff18f75d2f7", "value": "B422C09EEDE39A34D67156B28B8B0F707CFF9B14ED1C5579D88434488B6A805502A38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877361, "uuid": "8933f441-403d-44d5-b489-63caaf14e4cd", "value": "192:0JUo2TjiSlZwhEeoCg+8J/3s0IreBf1fp66NllOiaLpxmoJPvbvvABsp:0Fin4W7Cg+A7DfnflQuAcBsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615877361, "uuid": "708c6101-1833-4dd7-977b-dd915d8efe89", "value": 10080, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615877361, "uuid": "bd223cbd-b9a1-4938-826a-59e893e7906f", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615877361, "uuid": "66e43a84-b84d-4594-a7c7-58000a56d15a", "value": "SecuriteInfo.com.Backdoor.Linux.fkxe.15255.17626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2997cda-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894067, "uuid": "e0789574-c960-41ce-9de7-f415c6107917", "comment": "Malware payload", "value": "43d6c3f16b3af2b31f6db8cf8702b5c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894067, "uuid": "d8cc85ed-1667-423e-8fee-6e4c2937a7e9", "comment": "Malware payload", "value": "9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894067, "uuid": "216d2045-5e81-4676-b4da-6c1521f0f137", "comment": "Malware payload", "value": "51a1010f9b54cb916474d288694a8255809f7843", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894067, "uuid": "30235ef7-a856-47aa-9a78-02caa5136901", "comment": "Malware payload", "value": "4ff79c30f0d29cb161db7967c6a0248ce296eb2b76757e771d1ea9382873fb275d1d62cc4a876302c16903bbf3b879f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894067, "uuid": "3e35d8e5-d125-4c45-ac03-1677ccdde662", "value": "0D839518B285DE22C25A1E329EDED9F2B626BC847ECA131FB740776E1F33F245511690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894067, "uuid": "ac4ee1c5-0231-402a-915f-afe96d9d3976", "value": "768:WvHPswBEUAtoTJOenK65rB/5wd2m8XoKW9aLlydJpIE:W+ltoTJOenK65rB/5o2m8XoKOKkME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894067, "uuid": "bb02833e-e5a6-418c-b5af-d2b3d6de7fb1", "value": 85504, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894067, "uuid": "6a404291-c0cd-4a92-9eb0-b4867c855f4a", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894067, "uuid": "32233b67-3904-4e72-8728-63664418fed3", "value": "CONTRACT AGRREMENT FORM.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1819ad-85ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615853895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853895, "uuid": "7b675dbd-3ebb-476a-9858-4ff200aa6658", "comment": "Malware payload (Dridex)", "value": "ec381641aee0a7508532ac96bd41fc8a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853895, "uuid": "18c90248-f73e-4770-a9a5-c73ea4eed120", "comment": "Malware payload (Dridex)", "value": "916bb63ef47ac215e3677fe2abd4faadd8ae8536005c5689ce27cf82a4b5b556", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853895, "uuid": "fe853604-392b-4f0f-92cc-9fce8aca29a2", "comment": "Malware payload (Dridex)", "value": "34a0e939329359cee75b03f21674ebb6f686d3bc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615853895, "uuid": "da5fef35-14d0-4c64-875a-3f540206a02e", "comment": "Malware payload (Dridex)", "value": "2b316be7100cee2c5c21f5b6774b932623fbbef1bcad0a4f2950285fbaf34ecc0a2f3f9125be759d4b4294466cbf5084", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853895, "uuid": "e1bc01e6-c8f6-4a9e-a6e3-1fe8dcef16a7", "value": "8514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853895, "uuid": "0396a354-a8f1-4dc3-8695-31a8f97ef96f", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853895, "uuid": "bc036fb0-3444-4e02-b4f7-9724aff7c10f", "value": "3072:B1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:zi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615853895, "uuid": "feed6d38-8e8c-4d56-88e3-d8df8818d416", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615853895, "uuid": "62e778e5-d588-4e6a-9949-45e64b890175", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615853895, "uuid": "99eada16-3fd9-4c58-b9a2-58d9d7c48cd8", "value": "916bb63ef47ac215e3677fe2abd4faadd8ae8536005c5689ce27cf82a4b5b556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc69b60-8676-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615913009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913009, "uuid": "459fcacd-db40-4262-a543-1c2f9b21931a", "comment": "Malware payload (Dridex)", "value": "de6c742e27dd2527da68db07826c733f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913009, "uuid": "857a2026-3bb3-49f1-b663-c7a69a49f951", "comment": "Malware payload (Dridex)", "value": "92a6749268b4bddec7985d01dfd41453cdaf705cff73b93eeaf05fabe7717831", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913009, "uuid": "08818bb2-2ab8-4259-a80b-441e89562f2f", "comment": "Malware payload (Dridex)", "value": "d1d6fde3320275af7d71057f491f42823cdab786", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615913009, "uuid": "a18de4b1-a305-4a2f-8ddf-b99b72551df9", "comment": "Malware payload (Dridex)", "value": "05d8815b82557159b07f140f035c91eebe9d4bc71f261a7de115c0b7390254b5fa06d031b50efc19507075454718d267", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913009, "uuid": "fe3d71e4-7b78-4841-9966-b6eca16a849f", "value": "E114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913009, "uuid": "bf3bffb8-8b3c-4193-ab59-6d7a0707b9b8", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913009, "uuid": "bd906b02-a1ab-4f57-b597-fc80ccb44e95", "value": "3072:H1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Vi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615913009, "uuid": "2c9ef957-1596-4b38-b9a3-a64b33aacb36", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615913009, "uuid": "f92adbed-97dd-4896-887c-7dea4438fe2e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615913009, "uuid": "e5fe5e0a-de76-4fec-a952-29dfd83e5032", "value": "92a6749268b4bddec7985d01dfd41453cdaf705cff73b93eeaf05fabe7717831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdf2faa-8691-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615924686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924686, "uuid": "817e09f3-bc34-40fc-9dc5-98a8b7b00940", "comment": "Malware payload", "value": "069585cb1a0c1fdfc9732935fcffb46a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924686, "uuid": "242eb7e9-21e0-444d-941f-c55eed0cbac7", "comment": "Malware payload", "value": "92bfc762392a76e45ac28c0eb9c5934c7df0df5656a192e580cf8bba823e658f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924686, "uuid": "dae6b977-d050-4191-8378-f21729f9880e", "comment": "Malware payload", "value": "5a2820ea6474102d0ec7504046cf1ceb5951c9ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924686, "uuid": "8f5de268-f838-474b-a0c6-53e33ebf4825", "comment": "Malware payload", "value": "153a6232f252aba305b9144234f294935fafc801804caec3b0bcb9bcbe2c46d6e2deae815805a9726995457d8e6a7685", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924686, "uuid": "12a29120-687b-4035-8c51-1301ce153b09", "value": "B3339ED5D7419309CA2A937937FD84710666B24DFB28B5FBE5C4C1CDE19222A232B329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924686, "uuid": "856b3829-51ba-4b7b-b6c2-45bafdb60d8f", "value": "1536:/xK+wAH4MMyeZN74acJcHW3J7HK3glR3Z2:E+wAHEnKXAOf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615924686, "uuid": "a2152c12-3a03-4889-be3f-a222c5cf58e3", "value": 50585, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615924686, "uuid": "a627436b-7cb4-45d3-8575-1d48d7182bea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924686, "uuid": "7bb5c8dc-162c-4f59-a805-da0759aeb9ac", "value": "Documents28.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d73519-861d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615874610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874610, "uuid": "acd42322-c2d0-4997-843b-b8227eb81ad0", "comment": "Malware payload (Gozi)", "value": "77c29f8cb55b57011f8f676a23956d2b", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874610, "uuid": "c2f52e98-75e7-4674-855d-d72d9b9019f3", "comment": "Malware payload (Gozi)", "value": "93fa29d1909eabc982ded10dd753233618f68f0c3e769deb26eea24c5af715b4", "object_relation": "sha256", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874610, "uuid": "4e852f3f-ea28-4483-a8a1-e493fa8edeb5", "comment": "Malware payload (Gozi)", "value": "3ed0d5413d184fa059ebef7f916be9b684e09dba", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874610, "uuid": "3f045d55-f881-4919-a319-572d80764bf2", "comment": "Malware payload (Gozi)", "value": "ffa933cc4f95023bec199ba9924dc4be5aca3be542907045f8aaa260dca78418a59aa0897fe1faa0f7d4852777133c36", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874610, "uuid": "22b28e09-3d4d-4fd6-925e-e0baf649e962", "value": "D051C8EBFCA363A49896084B6C6CF1A63430A6122644D43BC980DD5CBE527E4CE63E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874610, "uuid": "378213c6-4c56-4b39-aa98-769bfdd5563f", "value": "48:Uwi3T1yYaY2dFE+X/nLubwvY3CYFuNfInaI5u0G9:bi3T1NRIE+PLukASY0gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615874610, "uuid": "9e41d078-312b-4658-83a8-b5968b4cbfbf", "value": 2598, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615874610, "uuid": "a286887c-232a-4200-ba40-740ef78693e8", "value": "text/html", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874610, "uuid": "e11f040d-4602-42bd-9356-90f2af221388", "value": "main.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee7375b-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615923347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923347, "uuid": "d5d20379-ad57-49f9-804e-60fecf0611e0", "comment": "Malware payload", "value": "e11cfc0c3025924165c9c6229e7552bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923347, "uuid": "c4874598-7f05-4ac7-8f75-c8c7c47fec00", "comment": "Malware payload", "value": "946dadd93aa76641a9ef9c8e7e7c811817ce7b0538988b209df0d5d62739d79b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923347, "uuid": "aa0b86b5-90a4-45b1-9020-b0c163d012ba", "comment": "Malware payload", "value": "4152a75fbefbd7a5b0f1b4365156726e704fae50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923347, "uuid": "5d381f6b-de64-4933-880d-f9680037d69c", "comment": "Malware payload", "value": "eb80125a30641f277df7dd6b882e8f9fe302b13861bf39cfe4a50527b1f72dbde3cb7c6daad9af04e979b6d23e0e382b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923347, "uuid": "2868408a-9f47-49cf-a292-2df39aad87bd", "value": "09263917E2A310ACC26BC1349757D672B931B8691134BE7F39ACD7322F21E605B6E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923347, "uuid": "2933c591-3813-49f8-b231-9d2668c11a89", "value": "49152:sxWvpEM9sR05eXVVC6b4B0UZO71IktqESW8SynCHx6PEwpdp5QtSqJmKSuruFKBh:sxWy2sK+1I054IYFKB3Lxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923347, "uuid": "65912aca-b6fa-4cb4-ad2f-13d84baf8164", "value": 4797224, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923347, "uuid": "8586220a-8037-4184-b3db-dc8d1ff5c6b5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923347, "uuid": "3261911b-b297-4028-93b7-9f467114cbb0", "value": "e11cfc0c3025924165c9c6229e7552bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730675a5-863d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1615888404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888404, "uuid": "62c16244-03fb-4053-8da5-7df0f8ede5b8", "comment": "Malware payload (Smoke Loader)", "value": "47059f3d5dce8d60eca09a09fa52eadf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888404, "uuid": "ded08a79-62da-4e09-8f39-7d5550ce5858", "comment": "Malware payload (Smoke Loader)", "value": "94aec079e597315d1280889ae15d1fe7c935c288837055be9c113b94f6a1ca4e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888404, "uuid": "bd39a54d-ebc6-4678-9f79-25151f52bce7", "comment": "Malware payload (Smoke Loader)", "value": "4f03225c648f4bbe187a50240011acc94b50436e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888404, "uuid": "7928dc7f-0d4f-4e8d-ae98-7281094d4dc6", "comment": "Malware payload (Smoke Loader)", "value": "da53bb615adcede443dd6d0c30b133431600a1955801de0ef1864bea1fa62344d5d1e079c849f0aa0464cb7e41c3374e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888404, "uuid": "59ab4f8c-24a9-45a0-ba29-597e597fc95d", "value": "D8C502F073852FCFE1B18E911A65790C4527F1359ED16AC4F119FBB723A704ACA0A92B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888404, "uuid": "aad4c0c0-b9a8-4726-b36d-677b79e7bd66", "value": "12288:hIipu7u7Iipu7u7Iipu7u7Iipu7u7Iipu7u7Iipu7u7Iipu7u7Iipu7u7Iipu7uo:whhhhhhhhhhhhhhhhhhhhhhhh3M5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615888404, "uuid": "c9c868b4-e5d6-4d3f-a4a3-3021abd71a43", "value": 2716760, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615888404, "uuid": "4ffeed87-59bd-44db-ae6a-96d322ba41eb", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888404, "uuid": "92dca7dc-5081-4888-b68e-38287d07f15a", "value": "866-0001E ORDER AND SHIP.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830aff83-8647-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615892726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892726, "uuid": "d1213447-47fc-4d17-8933-4f06679fd740", "comment": "Malware payload (AgentTesla)", "value": "74f6ba3e4485c883c3ad590effb12676", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892726, "uuid": "772dc523-4448-4ee6-9f81-75834059424f", "comment": "Malware payload (AgentTesla)", "value": "967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892726, "uuid": "0bcc9ada-5c21-4401-b7e6-0363f32d860a", "comment": "Malware payload (AgentTesla)", "value": "7ce8f5b890147cff65b19f323d290633c7d9dda6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892726, "uuid": "ccc4c8a8-d91c-4a7f-9a7c-222f5e7d8651", "comment": "Malware payload (AgentTesla)", "value": "bd10a6a40041003d6764525443fc4cd03f9d427dba2ed361c77cf8a81a418eb4829979b71c0ea603013da319a35807a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892726, "uuid": "d603e812-77a5-40a1-b0ba-4d11212453b8", "value": "7AC55EC5B628F1B0A38FDAEE6CFA4D5434C2D85DB16E51D676C8638A1801B07C2FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892726, "uuid": "6d650c02-348c-4f92-9012-7613ee5ef0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892726, "uuid": "2ea75f14-5453-4cde-8727-50965c02fba6", "value": "24576:zV+N28mcqWWrWWe4rEVJNawmNuWG3yUiFQeJ6VKHT5X:zV+N3mCWr6VNaKMUeQeJIKlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615892726, "uuid": "120d2f31-0e4a-4cac-8f31-753626b2d5c4", "value": 2572288, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615892726, "uuid": "cc7bae6d-2b75-47f1-9a9c-0854d87fccf8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892726, "uuid": "d03e8cf5-cc19-4a7b-bfbc-976e43b056b3", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a673c2c1-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615921562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921562, "uuid": "b5271567-3a15-4d89-91ad-45333b43c25d", "comment": "Malware payload (RaccoonStealer)", "value": "d68252d0ed003803b8f1541607d7358e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921562, "uuid": "25abf8f5-537f-4c67-95b0-d2fb6625f128", "comment": "Malware payload (RaccoonStealer)", "value": "97d7b96a22050c3a29163f3b74ddb0d00b4aa2d70cfb818ef8e5c5f47de25c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921562, "uuid": "2e530b0e-1059-41a8-a757-6dab41515358", "comment": "Malware payload (RaccoonStealer)", "value": "47784fd073304f4de2e99160682bd98945630a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921562, "uuid": "b537bd8a-c713-4bd3-b321-0890f53f4b9a", "comment": "Malware payload (RaccoonStealer)", "value": "1465293718e2d6e604e287f4b45cbc4e3a9ac56c8a785b8d07fe641996ad5806af4a53956995d12f2ab63baed376097b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921562, "uuid": "555074cb-1191-4671-8632-d735f8ebf6f8", "value": "4AC4D101A761C024F4B701B156B6BAA8B9357D709F3485DFA3C02A9F1A2C6E5ED33B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921562, "uuid": "47093cc3-84fc-495d-b2e4-bdfb41a4a672", "value": "95b1a81d545c603a5a65a17dc8240c82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921562, "uuid": "ed174e2a-1022-46d4-b0d4-d4ce19af2ca7", "value": "12288:waGMvDNuIdIh4MPnF0sNfdXnkP+wvrWfFlUDc5PZ:wa9+hdFRN1XnWZrSCc5PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921562, "uuid": "701578a2-fd61-4cbe-9bb9-1ed00683ef52", "value": 578560, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921562, "uuid": "860b4746-9136-4c30-9b94-52c3622bf828", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921562, "uuid": "4d2bb148-c184-47d3-a8e6-19e0886061c0", "value": "d68252d0ed003803b8f1541607d7358e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cee7886-8631-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615883240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883240, "uuid": "5528264e-0811-4331-9583-f35405c8c2e6", "comment": "Malware payload (Dridex)", "value": "cbf87aa71ffd20027d7ca11448f3563f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883240, "uuid": "01dc4690-6992-4663-965d-a1f1b1b886f5", "comment": "Malware payload (Dridex)", "value": "97d7c2bb640a5afe8db35aaed36e463fc9c1199f60552ee68a999762901ece70", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883240, "uuid": "fe216d6f-1791-4f37-bb9a-776c1c2bec7e", "comment": "Malware payload (Dridex)", "value": "91a4895578a78f994e61f992d98cb79e6f684a1d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883240, "uuid": "616dba24-2067-4142-b7f4-0d0b112d995f", "comment": "Malware payload (Dridex)", "value": "5e8022c99028541e762b021eceeb6236e76cf4dc6cd22256b6cdea26481035dd276ce1145c3e96a15d0420b806189b21", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883240, "uuid": "b29d3a04-de6a-4e63-a537-8d8ff2dc6fe4", "value": "F014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883240, "uuid": "e45302ac-d20e-4003-b3ed-d2d432f7954f", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883240, "uuid": "d11b3e5d-21ea-4301-af65-2332b36ae32f", "value": "3072:M1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ii78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615883240, "uuid": "4e52689d-ac16-4c97-a291-bece2658043e", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615883240, "uuid": "54f0f3b3-283b-4c9f-9b78-6140fcf32966", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883240, "uuid": "34bd1e60-2f6b-4522-9f89-1fdb3738c04e", "value": "97d7c2bb640a5afe8db35aaed36e463fc9c1199f60552ee68a999762901ece70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f3f8ad-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615889110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889110, "uuid": "abad44fb-b6f7-4ac5-abfd-fadcf20ff43c", "comment": "Malware payload", "value": "29420fcb844b31b62a6680d90dc6a830", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889110, "uuid": "c3eb5d88-3fd7-459f-b3fd-d75fd34e22ce", "comment": "Malware payload", "value": "97fce87ab897d7714e58f7e0b4c1fbf0ccf4100fb6281778f3ff4d7d8d2ea239", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889110, "uuid": "a1c1a6b4-db2e-43c9-a00b-851cc055c756", "comment": "Malware payload", "value": "d87f8772356b41512371c22bb11734070e2fd45e", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889110, "uuid": "ac6ab016-4e2a-4fd8-82d0-88fc28076cb7", "comment": "Malware payload", "value": "13cd6196327dff3701609b251f4b065a9251f798daf55d68e33c2a2bd2901c3434f78e610eeb3181b300ce9f67f434e9", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889110, "uuid": "296d3959-c5da-4de3-a843-7c5ea9ceef43", "value": "8C63E00E994428B4C3BD367C52256CE1DE4A304F9BC2751F14A4BB153ABA1CB2BDF1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889110, "uuid": "454bf58d-fc57-4540-b767-d853edd8a17e", "value": "1536:E8d/ekh+twusyoflnsZpulsytpd/NMVm3qLzhaMmQ0x:E8dmW+uuXqqulsGRUakzMMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889110, "uuid": "7654279f-3598-4b3e-82c0-4ec48ae687b1", "value": 72392, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889110, "uuid": "77ff1a8b-3d6d-4e7d-8a4f-e1af51b55e1c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889110, "uuid": "722e377d-a5a9-403c-b77e-d5d0dd38c1a6", "value": "fisc_570.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46149fd9-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615906797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906797, "uuid": "878ecb45-508b-49b4-ab82-a56807f853c3", "comment": "Malware payload (SnakeKeylogger)", "value": "0d2a5cbd3ca5c57c435c3be06449f85d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906797, "uuid": "9fcb5586-3fef-4a32-a5eb-c964bdfa4bb2", "comment": "Malware payload (SnakeKeylogger)", "value": "98aaea21babe6e4a949412f6a0ae39df3c9244c2a7a483ef305b00f77135e87a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906797, "uuid": "a6b10866-695c-4be4-a7dd-2c91015b611d", "comment": "Malware payload (SnakeKeylogger)", "value": "44dd6fa2a1a3e2520be5dd7f54f6123451df9f0d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906797, "uuid": "f2cad247-e78b-4dc4-90e0-32608d181653", "comment": "Malware payload (SnakeKeylogger)", "value": "d1498dbab16d15275ea79c7a105bb00ef7fdd784248860428ea5c246e36122d76a5e8b4c1b9e2895d1f652f71727ceec", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906797, "uuid": "292e0f96-07be-4e51-94c2-37a3bf527f68", "value": "C4359C22E694AB70F03973354472133143FDAD0A9665E7BD7D8871DA08B5AC086F7EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906797, "uuid": "9063a55a-e14f-4732-856c-2b66d8939127", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906797, "uuid": "676b221b-e73e-4b8b-ba83-c07ef4b8a55b", "value": "12288:iLUUnKq5oKia5GBQLn8aPbdmWLrlLHKRQ/LeQbQyrTqB/aWSeMzSHlR1:iboKfc/aPbdmMBqRQzkyrTq5D4elD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906797, "uuid": "5c9e6662-924f-4d6f-a1b4-c4c6f8308684", "value": 1153536, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906797, "uuid": "2bd84af4-348c-4af6-9e3d-67f81eb6e5e9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906797, "uuid": "607f9736-d46e-4083-9e09-e8b044537550", "value": "Invoice copy payment no567321____________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4063fe8a-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615875864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875864, "uuid": "a2128c4f-5c13-4f73-b114-0d49bee166ee", "comment": "Malware payload (TrickBot)", "value": "f2c5a4a69e631cd2e526b176f85c7e4c", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875864, "uuid": "f3b8a0bc-a984-4381-9320-800adf94965e", "comment": "Malware payload (TrickBot)", "value": "98b0b35775ac245cd4737506ed5543d79cf9e185f730c2d65d14f092bf538a90", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875864, "uuid": "07b6a380-9d9b-4345-a59e-6c58b4dbd7d6", "comment": "Malware payload (TrickBot)", "value": "788b3579221dcadca9875d0a771f4f7c44f76332", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875864, "uuid": "85efdc4c-de2d-43b1-8191-3954845d635b", "comment": "Malware payload (TrickBot)", "value": "ac5c028b6caeefa386b638a613f4857d17a11d798fedbb9e3389f99e26958e4f7b027d4c7a62020759b7b153156ca434", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875864, "uuid": "cfecdfb5-427c-4613-a1c2-835aa6a4764a", "value": "04E3011E1A51AC22C39C073894A7C7D39706717FF3B2E95EB94CD8362F60BA52E1D04A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875864, "uuid": "6e1ace7c-c69d-4e69-b0b0-582152b6c6d7", "value": "3072:tC9pupSzxNEBBD+Os7/xxkKCtRbsYO1entseoXX6:tCPGSzx0dmxk7RbsYsKtseoXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615875864, "uuid": "a3103c2a-cfec-46ed-9908-28b774c95dd2", "value": 153311, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615875864, "uuid": "0652b227-b348-4c26-b8f5-3c84d94c6434", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875864, "uuid": "fbb78e95-bef4-431c-8fe1-8b6757ed2dff", "value": "case_1909840401.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6235307e-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890953, "uuid": "ea13b851-51d7-4b5f-82b8-503f2003dc77", "comment": "Malware payload (Formbook)", "value": "7f7a4249559e5ee4540994f94def85db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890953, "uuid": "dfb17166-143a-49a4-95d8-da3f45551951", "comment": "Malware payload (Formbook)", "value": "999813d0bce8eb3dd4057bb0535d1ce571c272a3ac60264d4a4ecc28f7644875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890953, "uuid": "2f5b04f9-5626-4fa6-b3ad-5b9d163ae633", "comment": "Malware payload (Formbook)", "value": "d0dde45c613b6402d85ccc1ff5d77c809a619494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890953, "uuid": "79d8fd83-008c-40ef-a77d-cd34df1c90cf", "comment": "Malware payload (Formbook)", "value": "29e40e7ac8fb9d8b998fa427b68533e80aaed79aef8d4cb1a07f5750895e92735aaba0dfeb4f8d9e1391b71d37d197b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890953, "uuid": "409478fe-0663-451e-93fc-b44b5b119c9a", "value": "9DA55A04F758AE96D5171B76C0A3852482E4DE6B6273F30F79D9BCE2793238A4D4E4C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890953, "uuid": "ff177fc6-341e-45d4-ab0f-99d30654a4dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890953, "uuid": "80b59972-33ec-471d-b161-598299a219a5", "value": "49152:z7myfeqqD0jjxnqkaaFZp27enk6ymYIr7GrCKnY27RENq6+7U8LcjHWdr:z7myfB3ebDgJEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890953, "uuid": "8a77eedc-2edb-4f0f-82a9-9ef1148dbadd", "value": 2095104, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890953, "uuid": "1d36cc66-16d3-4d1a-a163-2df113e4dcb4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890953, "uuid": "ada1340b-a45a-4ca1-9582-0f0f596bb9ca", "value": "RFQ_38463846393646388368364834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d25c916-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615876234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876234, "uuid": "b79d82b9-a259-4b66-8f51-e75e41c256ef", "comment": "Malware payload (AgentTesla)", "value": "67270a9af1fe312b5830988c8e7f5a49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876234, "uuid": "f64ffb6e-0247-4427-8ea2-13204ef4c4b5", "comment": "Malware payload (AgentTesla)", "value": "99e20e9f57324e56c59987b2d9778787c6db67693be34699a2968ec1120d2b47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876234, "uuid": "f1373e25-a902-4c37-b231-2b7160f633a4", "comment": "Malware payload (AgentTesla)", "value": "da73e703f8f2015fdc2c2e3491f749b94917d17e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876234, "uuid": "ee368928-797e-479a-bf5b-c65002fd3219", "comment": "Malware payload (AgentTesla)", "value": "7acc19d6b0738c0452402015c9690d60900e6073f6a7c19795ef74923e88b254ecb01fac6241064faef887126e0bb754", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876234, "uuid": "28a04e64-647d-4d3d-9672-257a246a7b1a", "value": "6FD4FAD1F19088DAED6B09F1BD2BA5302493BE9C54A4410C56ADBB1B76F3352309FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876234, "uuid": "6ba942cf-0d57-4215-bce8-5a6e3b2f3ec2", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876234, "uuid": "97c532fe-7d75-45e9-bbfd-8626294dcd88", "value": "6144:GTqjF7okBvGFnkIn2AhB4mWUivG6cnsgQMxQtF6XEASuEqnhRDmEMqnlZtg5TDAO:a+V0kIn2Auhr6spdtkXhxhRF3lZsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876234, "uuid": "1e15632a-4169-4700-88e7-534e28e018e1", "value": 646468, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876234, "uuid": "7a20ed7e-2755-4b0c-bc32-a6ecae8c58c7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876234, "uuid": "6d7ed459-0e6a-4ab7-beba-5ca33524e570", "value": "2QWERW000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea26bb93-862f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882591, "uuid": "782518e8-a5a6-49dd-9ee8-fcf675d03210", "comment": "Malware payload", "value": "f6663d1e1c57746e970825651008706a", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882591, "uuid": "9946eee7-7ae8-4b6c-934e-ebd73a336f31", "comment": "Malware payload", "value": "9ad41516fcc7fa0302fe8976042d6453ad9cd4557e9f3b938c8746faec9ccbe2", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882591, "uuid": "ac93cc0b-adac-492e-aa62-d92782f9f689", "comment": "Malware payload", "value": "c27c53d9f65e2799b3fa4f795a8557da23d3ef73", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882591, "uuid": "95edae3a-04b5-4bc6-a1f5-699057b789c3", "comment": "Malware payload", "value": "eaca68ae3346968a0b21000ff79b4cbc6b85dcb6b2d2dc275bed7ff71743dc9eb99536d7cfe6acbcf5f84ee3b731f307", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882591, "uuid": "5cf05d24-c9f4-4a69-9749-ce558e843239", "value": "B743F293C1A87A397383016425EED616C724354986B0E8D549BC4B798BD3633DFF62A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882591, "uuid": "7bc79838-2771-4eb9-a47e-961a8ac5f3e0", "value": "1536:Z6aOpAOHmGrcwZeFE+rWdbeCaDBzmqa7B:Z6aOeOH5cEeFvrq4BzmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882591, "uuid": "b75a438b-9276-4ce4-be93-a47824acbfb9", "value": 58984, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882591, "uuid": "46b535a9-68fd-4b98-b3a5-fc12b52cc395", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882591, "uuid": "01e7bebd-b76f-4319-b4d1-0ebf86e3d9b8", "value": "dettagli_234.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9ca4f5-865f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615902968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902968, "uuid": "72680097-28a6-47cc-b940-887f7b458c34", "comment": "Malware payload (Formbook)", "value": "30a2187ec67c41fa1e77a7068e745e9c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902968, "uuid": "e04aae1f-c833-4cd9-9fb2-8300ac66eb94", "comment": "Malware payload (Formbook)", "value": "9afbedb7d1a76e7bd59441e83ec3124af0e16244870e61743cd590a64513c0c1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902968, "uuid": "976309dd-61ae-403a-b148-1424a57c4c97", "comment": "Malware payload (Formbook)", "value": "0be26a25eca578b3af468ce0920c5c1f88c9ef35", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902968, "uuid": "3e8aac70-9b48-4b56-8c1b-8d4c0abee999", "comment": "Malware payload (Formbook)", "value": "a0e717c338a87ba1730b0b2eee4671a014843fb1fac8eb933d2c0f8fd27ba87ea730b04b0ee2da187cd4fe617199b4f4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902968, "uuid": "0bbc7f07-90bb-4b06-90cb-e0aa5c03abe0", "value": "E8257A22E694AA70F03C73754531133183FDAD42A622EABD7E9971CD18B56C146F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902968, "uuid": "df8167b3-58b3-4cb2-9125-1bc10c5fa51e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902968, "uuid": "65a4139d-9cb0-4159-8e68-d8d3055a542a", "value": "12288:G/3T6Q86POa6x0d90HssylB28kXL26+6O0j7VY1:g3THEd22NLl+6O0jJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902968, "uuid": "0d2c7bd9-aa89-43df-9ed4-9abfa84cc6c4", "value": 1038848, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902968, "uuid": "f17ccecd-4fef-403a-838a-1bd44da10853", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902968, "uuid": "62624295-2bdb-4ab0-ad21-1268e6030b55", "value": "Info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9264648f-8669-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615907355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907355, "uuid": "b6730b7a-e17d-4ed7-8b3b-c92f9deabb29", "comment": "Malware payload (SilentBuilder)", "value": "6e612c34082071fbcf4a26e6cdd453b1", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907355, "uuid": "9dd25c3b-555e-4ecd-b4f1-8f0629eed719", "comment": "Malware payload (SilentBuilder)", "value": "9baa5d12c58ba503651dd97f77b77a266313e62bcc40f31712c4d9d535fc62aa", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907355, "uuid": "7aba49fb-ffaf-4920-a9af-31cebe5cd7dd", "comment": "Malware payload (SilentBuilder)", "value": "264b02bc83f11aed593b524ea8b56eb66e1db631", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907355, "uuid": "5642572f-4ff0-44a0-9242-8c066eb13dd9", "comment": "Malware payload (SilentBuilder)", "value": "5f08748a9a9d3513af6262fab640f19ffccc625111fc4f0a45835690e070221df5a3cfd41d0b17dcc9c589d430d3bed9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907355, "uuid": "469d2410-ba49-4fea-a3c2-edd831a16f2b", "value": "C1349D57A9458E03E918C3B9BF634E6E631BAE145A9633C7312E7E5B3FB41900C4B11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907355, "uuid": "c0bff334-91ec-4a2b-afe3-2284a874099b", "value": "6144:eKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgv2IS7FgiJsJ4BR5043yVuBCMmnqLsUP:WzGiK4504Sy/mnqoUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907355, "uuid": "a21caffd-e86e-4642-a7ef-2576b3ffc655", "value": 237056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907355, "uuid": "3b7788d3-7023-4292-bdb7-c181fafabc8a", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907355, "uuid": "f1e4f509-1a90-4b2c-9f57-2cf5b469ef6b", "value": "11985824946_03162021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea425145-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615922534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922534, "uuid": "93694c11-6166-4e29-b1b8-323852cb6f77", "comment": "Malware payload (GuLoader)", "value": "88fee451ee8a4be3e5ac92ceea605d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922534, "uuid": "5e4fd91a-1f11-431d-b41c-26537d8918db", "comment": "Malware payload (GuLoader)", "value": "9d39f83f72664ef3e95f07ac9ed16a411de2fdff48f5a88aa346f9671c44c543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922534, "uuid": "e022ee0b-1e84-41d4-bd46-8073c47cde5e", "comment": "Malware payload (GuLoader)", "value": "83d6ec2c2a75a5242c2d5f1270e91367616211e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922534, "uuid": "76ed8956-9fc7-4ce5-8d6d-cbab13e8290e", "comment": "Malware payload (GuLoader)", "value": "70ffb1a9d255cbc8351bcef785bcac19d0a25026d2f7a9c30beeb294b4a5815cc4fc6c8126a210da52880cb2b364ee32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922534, "uuid": "a63849a5-3df2-4b9c-ab05-65dc132e1171", "value": "D5E34A4771005CBCD6483170451EEEB63622ECB58180AF27B2E47D5BE8BE5D12DEAF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922534, "uuid": "2d7be2ca-f439-4f6e-a2ad-a6feb8474b34", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922534, "uuid": "3beaac02-3a18-4ef5-bd70-8872b3607e45", "value": "3072:IuJ8gWc+X+vWa3jioWyda6bxFEbg39pp7yKSHVDTJM:FCcPvW8ji9yda6bXEbg39pp7yKS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922534, "uuid": "84ff3643-23ac-4419-bf61-953826d2d27d", "value": 151552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922534, "uuid": "6271aa58-a6e3-411a-9318-9dbdfe24718a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922534, "uuid": "220d5f5b-52c7-43a1-a9a5-3fee75ff5bd6", "value": "88fee451ee8a4be3e5ac92ceea605d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc855f57-861a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615873602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873602, "uuid": "0cab5c7f-f03f-4bfb-8e66-208de61a90f5", "comment": "Malware payload", "value": "083cf9a733b8f7dbeb2a304a75a4a625", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873602, "uuid": "aab093b6-5f2f-4e0c-b2a8-0e45541b4664", "comment": "Malware payload", "value": "9f12258ff14528c101f043d16c3a5b820413b03d1d17294359910048e5d6846a", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873602, "uuid": "fb9165df-d4e6-4e89-82f3-17a4c1911824", "comment": "Malware payload", "value": "208e150ceba132690c5225918212a2aecbe0a065", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615873602, "uuid": "9e2650b5-a8c2-406f-909c-d0ec353a402d", "comment": "Malware payload", "value": "090a5292ff96010b33ac0b9468722377af28c8222f7010e29aa5f5c5b30949020ab3f1d150b74283c3deeeefc2ce77be", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873602, "uuid": "6a20345f-8962-4da8-9661-38d11193108b", "value": "184301FA37E8603A6A9348F861BD2A53B79E5D33F0AD5BDD4D05D41F7881A2F460A40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873602, "uuid": "a44c8412-7177-4c1d-b2c7-6d360559a08c", "value": "1536:yws487vZIJhcQe1B5zmH25LqK54hROZWUq1m8GUb7:y48z6JCQen5qWVqRS98GUb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615873602, "uuid": "8e2ae6a3-0073-4b0c-a86f-6de46479ea46", "value": 57778, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615873602, "uuid": "7951ee76-0ea1-41c3-afd0-f399a14cd930", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615873602, "uuid": "ff031ce2-f3ad-4958-90b5-62c6633cc1f8", "value": "notif_2227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b421e3b9-8686-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615919867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919867, "uuid": "87d3df03-4a7c-4f1d-a0f1-e8203b193e62", "comment": "Malware payload (Dridex)", "value": "6b7f8e06ffaf8b6d7b82835552770a72", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919867, "uuid": "90edca10-b19f-4a05-981a-88e6e8a59be2", "comment": "Malware payload (Dridex)", "value": "9f92a48a8b29e76af62c957efdc7e2d1c7816f32b39a02795596fefe9ef5dc27", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919867, "uuid": "d647f199-bca5-4635-8f78-900e7c3f0979", "comment": "Malware payload (Dridex)", "value": "2f4d8610cf8d17678fb7e61b72eea214f70eec08", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919867, "uuid": "5cb68f59-9388-4bcb-8a25-da0fa7b42bb9", "comment": "Malware payload (Dridex)", "value": "37eaa49d0ed53e901fc793caf3e7eeb6516261a1e919bdc1701364304a91f2dc3e59aadef9525f3d8fc9ae829df1896d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919867, "uuid": "c4120220-70e1-4ee4-98d3-cc444c2b2dab", "value": "8614BE2DD736EA9BF7F3DEF21420272A59676D61117B918D6AC224BF82BF90C006C14C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919867, "uuid": "9417cd2d-bc8b-41d3-b0e8-82705a486d74", "value": "f51e8df6bd6c2af7857cce5930a68887", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919867, "uuid": "042e65c1-e07a-49f5-9229-c2f009987aad", "value": "3072:Sf/CNh6hxzkBkRCnNo0zLv71FGYH9bTBoXRVBGLlgQPx:Sf6ixID1FGYdvBoXBGLmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615919867, "uuid": "639e96b9-5e18-49c7-b5ea-1e4114293a95", "value": 204800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615919867, "uuid": "fe00e324-b680-4862-9932-4b71ffd31939", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919867, "uuid": "81ef6fcf-1062-4547-85ef-bc1d72d9f7cd", "value": "9f92a48a8b29e76af62c957efdc7e2d1c7816f32b39a02795596fefe9ef5dc27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a1a1b5-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615922901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922901, "uuid": "bc306c82-10a1-4e1e-9824-cb640a9c218e", "comment": "Malware payload (TrickBot)", "value": "e85da3c5a35a887685ff4ce6bb360ade", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon142", "colour": "#9DE626", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922901, "uuid": "8c6e3af7-1365-47db-8abb-02670e7da3ee", "comment": "Malware payload (TrickBot)", "value": "a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon142", "colour": "#9DE626", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922901, "uuid": "9b2ae80c-ff66-4b40-8c3c-c24deb685a5a", "comment": "Malware payload (TrickBot)", "value": "7ecc9e51c990aecba31671b3a39842517efba317", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon142", "colour": "#9DE626", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922901, "uuid": "328a063d-d9a3-4247-9139-8c844c0ae50f", "comment": "Malware payload (TrickBot)", "value": "3df5f25caa6db7058c54ae256bbfa356848c02a6510c2587129509a1fc8e996a3612d0b15b830e4d5eed14111019d4b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon142", "colour": "#9DE626", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922901, "uuid": "fda360c9-f13e-4830-874b-3342e27c3787", "value": "6364CF86A3148A70DB9DF83D5C68CB2647873F4DE6A1415539B8FF1A5EB938008E4F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922901, "uuid": "62087a0e-2f9c-4b69-94db-613247c21120", "value": "bd987b71f4cf5e45a335d1b833a3b85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922901, "uuid": "ac0593d6-9e8e-4cf5-919b-0e7b0542cdd1", "value": "6144:j5Cug2UFF2KDba5eg24xQ7ZV94MFT0R1uwMZ:jbBeEegfxQ7ZV944T0nMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922901, "uuid": "f60099a0-be16-405b-b8df-fc05bc018122", "value": 335360, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922901, "uuid": "e2beb7a7-b786-488f-afc0-89a012b702fe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922901, "uuid": "02a5be18-af78-471e-ae18-ad0431b8f833", "value": "e85da3c5a35a887685ff4ce6bb360ade.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384c4999-8686-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615919659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919659, "uuid": "8533542e-f527-45e9-9775-3522d29077a6", "comment": "Malware payload (RaccoonStealer)", "value": "52694ed23823367cafc4b3d0dc49165c", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919659, "uuid": "5c4daecf-d72a-48e0-9c4d-d22d8efb3dbf", "comment": "Malware payload (RaccoonStealer)", "value": "a0a50284a627570c96cf3ed3d05835bed9fe27d4732034c535a082f727db8660", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919659, "uuid": "d5d901a8-63bb-40d4-a6c5-fa74060d4968", "comment": "Malware payload (RaccoonStealer)", "value": "74c3ea0f488e80ff45ae8f5bef7136811853fa2b", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919659, "uuid": "c8b6b7a5-6c2e-4cc5-94fa-6640912c80c2", "comment": "Malware payload (RaccoonStealer)", "value": "21ac03334f59fd0c4f2dffcdd03d0a393085dd5f77331b2f640f978ed5b5b69c04e6934b7cbd5d7c31768ee8ae62550e", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919659, "uuid": "44d832a0-b76b-4543-a4f7-bfd30b841ae7", "value": "85F1A60477F94326D7FB8BBC08B64341557AF7559C42CFAD54E0024E9D2AE808AA2FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919659, "uuid": "feb09a27-7d57-4a9c-bf47-1efa44268abd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919659, "uuid": "a22b2c8a-a54e-403d-bcfd-6264f0a8eabd", "value": "96:YVCQtykV4I09RwPrOlEKrIVkPPgYKkYunYrB2wRfeu/dSutk8ktGa3tfzNto:5M4I/rEY9kYunYzmu/K/j9Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615919659, "uuid": "0aa94a6c-88f3-4946-b184-92c64f271559", "value": 7680, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615919659, "uuid": "31d94ec6-446d-4684-969f-77ae76fe7e4d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919659, "uuid": "24ea552e-a143-4eef-a270-e1c6ad003bc0", "value": "SecuriteInfo.com.Trojan.Siggen12.41502.7197.24751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3198862-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867466, "uuid": "d1792a80-4c71-4166-bb59-f4216f76a212", "comment": "Malware payload", "value": "e0478696c5fd0f601eebb3783cc470dc", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867466, "uuid": "b865c4bf-f645-4d75-87e7-d97367b3ef46", "comment": "Malware payload", "value": "a0ee31f222f7b6b4967878a34cd525ff2ad33a817d0d8aeb0064562cdb568fd6", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867466, "uuid": "6b72b8d1-7bef-41a5-b316-5988ac12d100", "comment": "Malware payload", "value": "f95d0ca9719a54e40ff9ec07ec75561ccf0626cc", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867466, "uuid": "bf5f3285-265b-4c32-a49c-74cbb28e3ce6", "comment": "Malware payload", "value": "0cad72f8ab1d086dfa420cd6ea8c880130eacf9b0df903795ffabdda15870a4a57012bf3fcfc1191e7e6465ac4d96d84", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867466, "uuid": "dc0b00ac-81ab-418c-a46b-9081ca07435e", "value": "CC838D5EA61470B9C33DB43C974698E24D491057E8C3B22E25A4BE0979EA1C37BDF1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867466, "uuid": "7f4f02e0-f9ec-48b3-b5a0-d0da0f56eb0b", "value": "1536:EOJ+eTSRH+koGNiJcl92DNYUpZZbQjRNe4MvU3jXhV8VeIq:coqH7ziJsAJpZZwRo9EIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867466, "uuid": "359f4f6f-70f6-4910-a49d-b9666e8e352a", "value": 87955, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867466, "uuid": "81fcdc05-5393-4e2f-83e8-105a754b774c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867466, "uuid": "d1386b31-c3af-4ad7-8d78-5731e0819297", "value": "attiv_1717.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72564050-85ff-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615861774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861774, "uuid": "0dca8bdd-5bd7-40cb-8eb4-949a0461fd40", "comment": "Malware payload", "value": "b43ea1f899dfdc6f7e416ee3d4af86b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861774, "uuid": "e133d90f-4276-4530-8338-b7a9e01fd22b", "comment": "Malware payload", "value": "a1e6fbf364b50d630a97722300d8e84d847dd16ce797e9c333f3b22a56083e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861774, "uuid": "d60ce699-ac79-4d18-90c7-f49cde095e44", "comment": "Malware payload", "value": "92724b61d9f1e43f591986462c54e0f215caf4e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615861774, "uuid": "7f8ca319-9d0c-4fe6-b9b4-a0fd27245543", "comment": "Malware payload", "value": "805be4f372597a832a1777f994cf7c764169444462c17bcaa2288545397c8708bf99f07c594b2ba1a03d9a801214ab10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861774, "uuid": "03577a54-3eb1-4311-9363-2095808c1580", "value": "BF244A65BE80DE32D1634A781C3AD7C699B5BF402F24525B76F8EB6C6A3D18028347D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861774, "uuid": "3bdbb8f8-101d-4b3f-9cbd-9416a24f0ab9", "value": "fe43cbd2884bc991df5f9942b9c6ee8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861774, "uuid": "17a699ff-148e-41e8-83ca-816a91df1eca", "value": "3072:Wk8mQcEgZk5RTsC70iFW8VhpRJTuFK6TfiM+iJB4Repd03CYr6jNuHS:p3YRJTWrhJ2RepYLrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615861774, "uuid": "09944ac6-5125-45d5-b540-19b403c8e55f", "value": 219648, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615861774, "uuid": "b4d804e7-2528-488f-a2d4-07622a08b9b1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615861774, "uuid": "4ddc3607-3444-4bbe-a76e-df5dd7056962", "value": "mail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a9a86b-85f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615857562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857562, "uuid": "c5932602-f224-4b59-ae25-75ac0bce1392", "comment": "Malware payload (Formbook)", "value": "7dd1d1b2dc015e24adae46237532b705", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857562, "uuid": "8a3c4258-3158-4f03-a131-c782a1b2c20d", "comment": "Malware payload (Formbook)", "value": "a24fd3aa6733914ccaab078a37a0cb4cf79c2768660de11411662a656507022b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857562, "uuid": "add1cb94-24fd-4479-9b99-9993dd76d15c", "comment": "Malware payload (Formbook)", "value": "78290c4710d05c99a8df48b9cc9c45dfdd368958", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615857562, "uuid": "bb53de79-026d-4364-8f09-6b8cc9fe823c", "comment": "Malware payload (Formbook)", "value": "d153ff9e6645d93f40b451e478cbeadd648857c0bc5dea2e15cccd8ea597dc8a21f26c0dbb223249b3b58b30a71d354b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857562, "uuid": "b9062fed-dabf-449e-8536-09778dc14737", "value": "E435BE9C365076DFC86BCD36C9A81C24EB60B877830BD243A45326ED9A5D99BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857562, "uuid": "0e500120-960e-4049-8ea3-737b07a2a9fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857562, "uuid": "5bc1b163-7cf2-4515-bc27-cec5c16a2b43", "value": "24576:PifHxQ1SHMdwNyVOw5bdh+CnITEB5WH4pO9VO:+Q1fdwoVOQbH+RE6HwO94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615857562, "uuid": "8ed8a5d6-4a31-4ad0-85ca-33c606856109", "value": 1124864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615857562, "uuid": "864cd34f-f683-4b7e-a329-37f2b6cd3dcf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615857562, "uuid": "3db6c5a9-a905-4fb4-89d1-7f98ba8b8678", "value": "PO_210316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631f96de-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1615890954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890954, "uuid": "53122ab8-cbc3-4d58-ab3e-2c31fd82f3cf", "comment": "Malware payload (LimeRAT)", "value": "3a3ab3874e5db43aad1b168ff74f87bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890954, "uuid": "1b3aebbb-cc2e-404e-a095-dc3612de814e", "comment": "Malware payload (LimeRAT)", "value": "a36f8841ed916c93c2b988e07943afe75ffe095d320e17be9968cb926a2c0f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890954, "uuid": "1c2b5f48-26de-4c38-a61e-00ac13b101ca", "comment": "Malware payload (LimeRAT)", "value": "2fc39ed29db752b75939e2b8717dab1bdf47ecf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890954, "uuid": "bef619b1-a377-4708-ac9d-d2e17890b4ff", "comment": "Malware payload (LimeRAT)", "value": "4cbe092285e475ecc24ea3c78745f7418ae7ee0bcf64b74b9d090ec202b600bd5510a4b2744dd9b9586c08bb85d349df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890954, "uuid": "7046c2e3-d50a-4462-9c17-39f5cacecba6", "value": "983516719AECAB0AF03F93359129010147FAEC47D336D74FA98836EA1E737019A57A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890954, "uuid": "6467fdc1-0c1e-48f5-81fc-8d2c38f6ff89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890954, "uuid": "3474e67b-8348-4992-a50d-ac0b03863f47", "value": "12288:FvEUMfeJ+6tKOaV0WzXbpiuk0LRid9azP:FKu+/OaV04Lcd9azP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890954, "uuid": "1e7057c3-d09a-459f-8581-0e71431fd1d6", "value": 1125568, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890954, "uuid": "af49ac5a-cb3d-4520-bade-8531b1541317", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890954, "uuid": "d33685a9-81ab-4327-af70-24c521db410d", "value": "Property Samples 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712aed93-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615923190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923190, "uuid": "6914a26a-2bdb-4127-a14a-6e045c7573e2", "comment": "Malware payload (Gozi)", "value": "1628d4ba406ab98366b34c296e989b05", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923190, "uuid": "2f035a64-bb09-4528-94a1-b44c38806fee", "comment": "Malware payload (Gozi)", "value": "a403c254e562a44201ffad243a32a78545ec3a4cc36c3356717687506f87da1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923190, "uuid": "93814e1e-c814-4d7a-86c5-651dfd880767", "comment": "Malware payload (Gozi)", "value": "f51cf9e2bb94b97b8ef03eba287c38095aa664b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923190, "uuid": "fdb8183b-08d8-4186-be92-606c8a2f0a1a", "comment": "Malware payload (Gozi)", "value": "7192b68e7532116d595c1cf710ee04732b8a3fa2a4ce75df72a45a4b770501bdf91a64ce77f62b16b52ea3650a7188a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923190, "uuid": "14beddc2-a4b5-4cdc-a4ab-016fe158e8cb", "value": "EFA4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923190, "uuid": "46ba6bb1-9fac-48dc-8b64-14dd681dbf52", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923190, "uuid": "8728f042-fbad-490c-bf87-7b58faf064ed", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZJ0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEvxNdbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923190, "uuid": "2bf6f18e-5367-4858-8a2f-d8280eca51e3", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923190, "uuid": "66351225-0c2c-460b-9807-bb9726d31a1a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923190, "uuid": "a1dbcf5e-557b-487e-9e91-c18764d81b2f", "value": "1628d4ba406ab98366b34c296e989b05.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb4c5bd-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906921, "uuid": "576468d5-a689-4223-8f19-8ebe157961e5", "comment": "Malware payload (AgentTesla)", "value": "f72ea5ff325c5023eb0d1f9c017177e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906921, "uuid": "4410a37c-7d42-4e56-af4f-a095f8f4b787", "comment": "Malware payload (AgentTesla)", "value": "a5ba3d8fe194aa084b556318530512e05eb687d8dcc33bb5f8e5fe8126b8ff5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906921, "uuid": "fea9726b-d5d5-4e4b-a76d-99507e98eab3", "comment": "Malware payload (AgentTesla)", "value": "3eb6ad66d8328bc0ad2f640cc9e20a651519557f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906921, "uuid": "ef8c3a47-0faf-4730-8924-7461ffb7b9c8", "comment": "Malware payload (AgentTesla)", "value": "6c74be1367116741de54410005a26c1a4923a2edb3b4607b9a61bcf2c78aeb00546323dcf5022226f343f5314d469f4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906921, "uuid": "0f4c91a7-1fc3-47c1-a7c8-5e3d59403d4d", "value": "38C55FC5B628F1B0A39FDAEE6CFA4D5434C2D85DB16E51D636C8638A1801B07C2FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906921, "uuid": "b81cffb3-407d-4e90-a679-2c1ac955606b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906921, "uuid": "25074961-0e47-417e-93c1-821fc0ec3b5d", "value": "24576:M+Ax6H8zWWrWWe4rEVJNawmNuWG0yVIlk51vms5Xd:M+AMHbWr6VNaKhVck51vhXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906921, "uuid": "fa530cc5-b29f-48e6-b8a9-3b6a3a493bcd", "value": 2600448, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906921, "uuid": "9e3e737c-0a82-45f8-a151-8ff934b7bd9d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906921, "uuid": "1c4c9156-d40c-4669-81c9-bacec77b4b31", "value": "PO91107102300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3227b25-8617-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615872298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872298, "uuid": "5816afcb-d15c-4a80-8090-1de534948eec", "comment": "Malware payload (Dridex)", "value": "6ef4d1e1819f354588bbb3d4f4526329", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872298, "uuid": "279e4c2f-8e1a-43a9-9fe6-f8f887481d9e", "comment": "Malware payload (Dridex)", "value": "a5f7368cbdf2721791aa67dbb11aa2048a84507701f6ca78aac8b9a518db7829", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872298, "uuid": "f8b7390e-8a27-43b1-812f-0cf6452d628c", "comment": "Malware payload (Dridex)", "value": "072d4d0dbf5f09fb3254edfee3092e8dca251516", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872298, "uuid": "9d7b44a4-5bf7-4526-bbc0-e886e9bbe4d7", "comment": "Malware payload (Dridex)", "value": "a734da852f931dba39da9c1c145c78abd009634becd831e59c060d437c4e71c186cc9a4cc31accba029a3cab2c57849d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872298, "uuid": "ffb1a6fd-2261-4dec-9990-53d0c84bd16d", "value": "FB14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872298, "uuid": "0b344f79-75c8-4368-aaab-2d96836e6985", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872298, "uuid": "5ffc636b-50d6-4037-ae9f-267b50f2474f", "value": "3072:m1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615872298, "uuid": "ba01ef19-a717-45ee-8344-9da1dd2f5902", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615872298, "uuid": "5db7ffda-be64-4873-973d-0249f3bdae54", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872298, "uuid": "5d3b291d-032b-4644-b2cd-6dd441803864", "value": "a5f7368cbdf2721791aa67dbb11aa2048a84507701f6ca78aac8b9a518db7829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd084c0f-8667-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906594, "uuid": "b08b67c8-e536-4edc-8582-5e9fbdba3f97", "comment": "Malware payload (AgentTesla)", "value": "f09473c989db69c4c35f2f5a23094ae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906594, "uuid": "a92cba78-f746-413c-b339-abb2ba88bd07", "comment": "Malware payload (AgentTesla)", "value": "a6ab3a1ec39d3a4c0660bbfdbe8cbbdd89d9278cca176d7bff77d7aab00dd7ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906594, "uuid": "117c624f-710e-4529-aee9-dab24ca943d2", "comment": "Malware payload (AgentTesla)", "value": "c878a3e521a3c20b74df4d550feecc6ad6e2e2d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906594, "uuid": "332808da-a13c-4280-97ed-95c9f9417cc7", "comment": "Malware payload (AgentTesla)", "value": "e71604a56d4c4e8ddba03c28eea67b287d14d0060affb061e004eb6256c084d5c89cc41bfeafa2e5298acf398db6a678", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906594, "uuid": "bad70cc3-0a1e-4fa4-afd8-caf2cf35bf42", "value": "E705BFBBF900505EE8A782F0182795A6BD271C6E47E19C0F26E17B1635B2113B1BE71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906594, "uuid": "853ac3df-08d0-406c-b909-1a890d93f104", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906594, "uuid": "7d4fb26d-f526-443d-a01e-b5c1fce8fa3c", "value": "12288:GENN+T5xYrllrU7QY67eW0yACVMTTKytMnxwumfAnY6Qhq/9mOurXD:K5xolYQY6syZsTKyagfAn2hKkrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906594, "uuid": "b581cd0f-75c8-4d3f-b78f-b4e3a9ce0c25", "value": 837312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906594, "uuid": "ef93fe3b-5514-4d16-8c2e-385fed022b13", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906594, "uuid": "0f776beb-f2d7-4313-a6a5-1aba1668cf03", "value": "44000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cea529d-8632-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615883723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883723, "uuid": "e0bdcd0c-b3df-4931-be99-3b163a4f9917", "comment": "Malware payload", "value": "923f91dfdfc42d51e99363514809b392", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883723, "uuid": "027a9cd2-6bfd-4171-8dce-5d72690c0d0c", "comment": "Malware payload", "value": "a72a691acfb01b400a4bfebf2e5307f0f27a47942e71376efa6b98f8816522fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883723, "uuid": "243f6740-5db2-4f8f-93d0-551a5f459105", "comment": "Malware payload", "value": "050f9b3e3ded68bb202e60fcb0d1a095ac3e7d31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615883723, "uuid": "b1e4f66f-1dd8-4dbd-b20a-a08e929e684e", "comment": "Malware payload", "value": "f472cf2de6265c003deb34eb04a9eeadb790ff387c2ae4af9411f7f149a6bbcf91a47a69642717b8ddc10e7d4b0e5ac6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883723, "uuid": "b0db0766-a848-4652-a016-f6a06dd58bc1", "value": "7F75821316F4FD15D27D32358CBB5409C6ED95329338F0A97D6E33868A6F9104FA22AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883723, "uuid": "97a57c5b-b97f-4045-a4f7-1c96df67f18a", "value": "24576:x61WJ0C0DzlYVQoRJ7Jyvpj/Lw4CpHYYY:xgI03Yh3JyxbCpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615883723, "uuid": "0fa619a3-0b27-4d88-ae7a-961db97cb4b6", "value": 1617920, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615883723, "uuid": "a0342834-f52c-44df-b963-69d5a78ef9c4", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615883723, "uuid": "bc1b5760-44b5-4f61-8719-8e18b44d0357", "value": "Swift Copy.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e39f21-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615922470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922470, "uuid": "92b0b31b-3933-4e1e-95fc-ee9d922deec7", "comment": "Malware payload (Formbook)", "value": "4f0ce72af754c4900f2a531354158f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922470, "uuid": "0b04eac9-12aa-4b87-a0a3-9e25f95a8c8b", "comment": "Malware payload (Formbook)", "value": "a75e119cf2843ed454193701f59e2d1a6cf6cf7b249cc04dc22c0258b0be86f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922470, "uuid": "39820d1c-a12e-4f44-bbea-8ebd824a25b9", "comment": "Malware payload (Formbook)", "value": "820d54a54325c5c6a5a08f926b23aea46adecaf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922470, "uuid": "7b83df84-9acc-4db8-a671-4ee25cb57ba4", "comment": "Malware payload (Formbook)", "value": "1ead67873e120076d459f923e7ff27cdbde168404e271ed176a5dc84cf22966abce6b73812b2a6c27ad9d2ca21a4e8e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922470, "uuid": "2ee47436-d840-4255-bd4e-b4fb9a4ed5b3", "value": "FE158D08FB95AF96E00E1F7AC217811893E88023A777F25B3ED4ACD56531B594E0F897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922470, "uuid": "a1be1ec5-67d1-42e6-b949-f487c50e1623", "value": "12288:zGmx84ogKM5WZNZ98qn4TRPFXJO2W5M6/G6QeieUUByGzF:CR4oMes8ERNDWqeUayGzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922470, "uuid": "06a49956-f4b0-4c95-b591-ad2e03b17480", "value": 896669, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922470, "uuid": "73ec0e29-4b86-43db-b03e-2a2a624800f3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922470, "uuid": "91f2b55b-06d1-40b8-9584-816d52d54524", "value": "4f0ce72af754c4900f2a531354158f4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451075d5-8636-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615885320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885320, "uuid": "82681759-051d-49bc-a518-d4be8a2430c3", "comment": "Malware payload", "value": "dd849dcb8f59b8bad04e6ab0a6aca51b", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885320, "uuid": "8116f62b-7d06-4f2b-b7fc-574e96209603", "comment": "Malware payload", "value": "a94d96e8f06c665737aa7282346a671cf04055818ff6c4665f5997bc52bb590f", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885320, "uuid": "8d0da471-486b-4da5-8c00-f75452c7e9fe", "comment": "Malware payload", "value": "d76784c203ba4e6f3f63feaedac27c6b8c49a3df", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615885320, "uuid": "0fb982fe-3b3e-4c8b-8124-70cb86caf0fc", "comment": "Malware payload", "value": "37655c4ad922db492bff49c855f36af5cf65af1bb7d9ac45b98c10c3a91857fa8a40f82b8cab290ca3225a728d1cdf1f", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885320, "uuid": "e15a1298-004d-4552-8ab8-a0a7feec2ac9", "value": "015302AD64453E01CB578E932F4968129912BCF143046A79F3CD30205965F6FE66AFB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885320, "uuid": "d8cc1990-15ab-42b7-bb1b-0d449d74d05e", "value": "1536:bumNv+VODVxNLMSugc2MNNXgfAcjjOPtFnCS7O7VL:blDVfMSm1CA4qPtISi7VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615885320, "uuid": "972f9efd-54c6-4d2a-9838-33af5bc5005f", "value": 61354, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615885320, "uuid": "da3be120-7cf8-498c-9d02-d3628598450d", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615885320, "uuid": "7432db31-b804-4208-97c4-ffcfa4bd4f09", "value": "notif_1945.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bebb4d1-8618-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615872340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872340, "uuid": "623b88c9-b3d8-445f-8c7c-6765bfdd8aee", "comment": "Malware payload (Gozi)", "value": "58d9e2906f42336e9bee1137b4cf5839", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872340, "uuid": "00ba602e-b3e1-4df5-b349-4d398e2fdc53", "comment": "Malware payload (Gozi)", "value": "a9a0db068a2ed9c7b9b3cdbe7f3c1c82a6f9d2c1c7d4b820820927da004b6cbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872340, "uuid": "3372405c-1441-4255-8068-0d4e668442eb", "comment": "Malware payload (Gozi)", "value": "7f29e42f6d317d7b11ad164a672e91e4515b5bc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872340, "uuid": "5c1400b4-2a71-4b2a-b26b-cd72a92a6402", "comment": "Malware payload (Gozi)", "value": "bb9447a61a12035229973518bdd521aaa14784356f2de48495724a4f8c03ba6e5df975bfa02d070fe6416b89dbe0d809", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872340, "uuid": "0d379205-2b89-44ea-8b21-5a1122a00e53", "value": "CF341A18AA478979F79743FDC809C5AD4E2BDE748F5EB84237F83E9691334E91439802", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872340, "uuid": "77bc09f2-920f-490c-b04f-fbe722b9707a", "value": "f34df13d9f12a151ff03a5b61c12591c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872340, "uuid": "2f4964e9-edf4-439d-b5a2-8017616fd97b", "value": "6144:tz3raG3DJCO3wVhIZhzG7WS7l8jE0DjSBj1:tDt4OtRZS7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615872340, "uuid": "de2ea34a-73a2-4c1a-b454-06c069519b72", "value": 243712, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615872340, "uuid": "4b6e5de9-9f1c-462e-98ac-dc66d38ba73e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872340, "uuid": "eff44a0d-630e-48bf-8089-12b6fd6e79dc", "value": "signup.jpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708c5434-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890977, "uuid": "fe2f9896-e912-456c-86e0-55b8fa8e1a6b", "comment": "Malware payload (Formbook)", "value": "ccba61ffbee99e8c4441cd2ed9368dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890977, "uuid": "ee1f9260-320d-4385-8999-b036b5903a60", "comment": "Malware payload (Formbook)", "value": "a9a706f6bf46b495b886f632dcafdcc8a3d493c465451c69d25fa04006a918c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890977, "uuid": "4b6a7b90-5457-41eb-8504-4d4f378d1bf9", "comment": "Malware payload (Formbook)", "value": "caf044df8ba359642d24c19aba9b9d16e22122cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890977, "uuid": "8c4e0af5-cb24-40d4-8ffe-e4e81a6d0006", "comment": "Malware payload (Formbook)", "value": "b4da5cb63ae2a19d52f591269a0a8eab18b8de950062879b331d81631634ee93ad9279d50b941cb022fdd43f2ceb3b32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890977, "uuid": "15651392-7701-4fcb-967a-c4394548ea18", "value": "C665611316F5FE24D27D7230CC37601986ECA1729338B469BD5E33868A5FA414F636AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890977, "uuid": "1c602f8b-2944-40b6-8f7b-1212bb622b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890977, "uuid": "81008368-270b-4d1c-a0e3-782395bff706", "value": "12288:3eqXOtIh0RToVGTC5qI5/yB/Ru6x8hdMm5yBUbBCFgOXJykdX75QA7fxOjbgvs1G:5lyB5u6AdFCFgOEk8YxU+2YgrvJRMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890977, "uuid": "318ba73d-e8b2-4bbe-9d98-a91df9aacbe3", "value": 1437184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890977, "uuid": "ffa62655-0117-4175-8909-0d4ffd0f047e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890977, "uuid": "4e05eaed-3a89-4dae-a891-d5a9cc7b9d03", "value": "New PO 100955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf291cc-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615876556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876556, "uuid": "2c061012-1436-4feb-a669-601cdfa0efde", "comment": "Malware payload (Loki)", "value": "e100ddee2606e6b0076b83ad63193f69", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876556, "uuid": "afef1f97-e391-4d83-ab68-0b5ffe7a0d75", "comment": "Malware payload (Loki)", "value": "a9ea5b8c8d4850d40c8595631a2153b5d14a0648efb2dcc93c5603b866c8d871", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876556, "uuid": "aa576dbe-b78d-4aee-9137-55cf8e77f595", "comment": "Malware payload (Loki)", "value": "738829e41519ca232688e4a5d19166017944b0b7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876556, "uuid": "56839510-abf8-4920-9a0a-443d561f7d72", "comment": "Malware payload (Loki)", "value": "23443dba15b2ac1aa936ba51a51b448d32f648476543a0091559bf6512063819199c98e070550602c4e4bd93a5e84e05", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876556, "uuid": "c27b50f0-17bb-43fa-a91a-4154844a6594", "value": "2CD5337CF9614A0AC26B8BB7412F975EA1356F619A03FE9B33353790213363123D528E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876556, "uuid": "327350c4-adf6-4954-95be-6df3b62d276c", "value": "49152:WGcZtXul4Me1ilkcbbXGvMbHcQ0d1qZM+PeNYJpnHMFsounROTWB5:WGayK1ekkXFbH2d1qF2yJpnHfpnROTWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876556, "uuid": "2ffdcb35-69e1-44bb-b5f0-0b9e610a75fe", "value": 2748416, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876556, "uuid": "c5453b1d-b69a-466a-89ac-90a9c2f9e685", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876556, "uuid": "6013063b-24ff-4d01-83b9-8561ce702889", "value": "MV BERGE MAWSON.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535a2854-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615923570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923570, "uuid": "e1ca5380-3257-4270-a24d-c88780708547", "comment": "Malware payload (Gozi)", "value": "93d389d780ff703bd53b923f144f21aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923570, "uuid": "c24b454f-eee6-4ab5-8401-2e418cafcc00", "comment": "Malware payload (Gozi)", "value": "aa8a59aaed89dd7c8696a7d63fa2763689be023a4a7692f63d950d8b923b6154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923570, "uuid": "a37f4154-699e-483f-980d-6ea5bbffcef9", "comment": "Malware payload (Gozi)", "value": "be672f1a3e7633aef5c810339a2db9dfe1e4d2b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923570, "uuid": "779924c3-16ef-4bec-abdc-8aa88ffe98e5", "comment": "Malware payload (Gozi)", "value": "735bd20c00565e89ea9d029918a215f9ee8e0352ad290252cdbda0d7d86098d1fb9a42ee3473d8e9ac20c0c61923ca77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923570, "uuid": "29b99afa-52c6-4460-adc3-a1411954b6a2", "value": "A0F39C1172E1C4F3F196153148A5C6B50A36FCB68F2156C77BC47BAE5E322E29A3A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923570, "uuid": "c93ec8b8-e9ea-4ab6-a660-d3fda033e6ee", "value": "8a2d10d675a05af75649cf71c3f5b77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923570, "uuid": "ad703c08-14a0-4cf8-954b-35790602e41d", "value": "3072:N5imRyRGJk3vrqIr1LU680lex/V97gSff5XMAV:jQRsk3To680lad51RMAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923570, "uuid": "80bb61ae-591e-49ef-9d00-665d6ed6304b", "value": 169984, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923570, "uuid": "2c0f3aed-e264-4514-91de-3758fd87c601", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923570, "uuid": "25d7c147-16a1-449e-baf1-52df9bd9746d", "value": "93d389d780ff703bd53b923f144f21aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7985fe2f-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890133, "uuid": "ad3a3a36-acb6-45c2-913f-e6d140e6e736", "comment": "Malware payload (Formbook)", "value": "f3d4464384511dae6a852ff484aa2f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890133, "uuid": "1c433620-aedb-4702-88fa-353785457e67", "comment": "Malware payload (Formbook)", "value": "aa9692c1769e25297176b847f4274570c56c4d74f4577608bd036e72d82d5bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890133, "uuid": "6c72c6a5-ec6d-4eab-8986-991fb8e2b044", "comment": "Malware payload (Formbook)", "value": "0c19b6f7b14385e2f5d39a34153a0cadf53d0e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890133, "uuid": "9e7451ef-f09b-4eac-92c4-d61ffbe4ec20", "comment": "Malware payload (Formbook)", "value": "07ab19beb798b3a160e0099cbb0dcaf9353c68b46ea421c824e8f830408ddc68deb160676bbe4772b8844707f99616db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890133, "uuid": "7f728a1f-5e27-46ad-8a82-dec0348206a3", "value": "4C257A22E664ABB0F03D73754472133053FDAD0A9222E6BD7D8871DA05B5AC585F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890133, "uuid": "23c36c21-f12e-4eef-b3a5-dc99416f7819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890133, "uuid": "a6650a04-dbec-4f83-92d9-ebb53517a98c", "value": "12288:4nmjCKfoTvd4bZ10CPy0fPJDZ8NXBSfMC5m1:Gvd4bZ10Cn8NXBGMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890133, "uuid": "f677c715-207b-4719-a2cc-4c4847f1bad9", "value": 1028608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890133, "uuid": "babfeae1-6861-4382-b656-602ac331bbe1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890133, "uuid": "7710d3ec-d79a-4f40-81f6-2a1270de374d", "value": "RFQ for Machine (Vision Semicon).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e8101a-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615906855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906855, "uuid": "25dbb5af-24c3-4fae-b92a-1d053805e56c", "comment": "Malware payload (GuLoader)", "value": "afab492cf25030756d492dc1390ce91c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906855, "uuid": "6d4d75b6-52ce-4c24-8a25-393c3b597556", "comment": "Malware payload (GuLoader)", "value": "aac1f58fa3aadcace329818a7ffdc7af1b10d5a142923dc25dda4dd10e2f57d0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906855, "uuid": "601ddbf7-9b79-4fab-bd79-f78d2ad316f5", "comment": "Malware payload (GuLoader)", "value": "07b85d564fb7cb6bc70a3af81a4fcff8099d43b2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906855, "uuid": "8a9d88c6-36bd-4835-a417-660df55173f7", "comment": "Malware payload (GuLoader)", "value": "49493d13b0e688918b076041fbeb8395755b4e59a644d497b6afbe552b17832c90210014a047d85dc25b4ada80f6afd0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906855, "uuid": "cbecb1fe-0600-466d-9336-9d842cca3a90", "value": "96732B27A1D0A1B3DF957AB26A550FB8343A6D3C9050DBCBA6DCE91D2F31744A83061F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906855, "uuid": "bb71dc85-e019-4ee5-9a79-226290410e30", "value": "7ae91190628cce6a1c5e8124ca1a2d35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906855, "uuid": "ea9f06e8-7aea-4983-a346-89fb76c6c739", "value": "768:jQTDUtKpMUFlUTnmfp4bdDpWSbfTPtGm54j:0TDlAmfp+d1WS/Mtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906855, "uuid": "ad4f3152-cf84-4988-9161-3e182eedcbe1", "value": 73728, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906855, "uuid": "3e991e81-72b7-412b-a51d-e9cc569ce54e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906855, "uuid": "a625cf6c-c463-46f6-8fda-086e5c3eb2ce", "value": "new inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de825963-86b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615938836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938836, "uuid": "abbdb688-296b-4a2a-835f-03c0413a3dc4", "comment": "Malware payload", "value": "40ad1885a6afefa547a789f17f8bcb72", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938836, "uuid": "c19dc571-24dd-4e32-911a-af016c361ef0", "comment": "Malware payload", "value": "ab70c24650bee2c4e9e008ade11adf8da89539ff68dad440c6f1e0411ff476d7", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938836, "uuid": "b3ea1883-dca4-4d62-b555-963497af1c07", "comment": "Malware payload", "value": "2df9248c32364330f88d203390791436359bbfd0", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938836, "uuid": "63d12cc9-5928-4e61-bd0b-979efc307bdd", "comment": "Malware payload", "value": "fb72291181d151de183254fc2f23dfde245b25ff58778a2ea9dc33593d76de834ad6aedebb3e7084b5c739673f2b7fb0", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938836, "uuid": "e55e82ea-8fa5-4cf1-a22f-ae1552f36ba7", "value": "1801FE37F5E7D2114429C89FECAE9F89E87000070F6955D0D0C084D78D4084A477C81D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938836, "uuid": "85693668-c735-45eb-afce-f26098b30ecd", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZrelhyc8brdvkPCEhXNAZJN:1IecuEZgNpYcYrdMPGoJrelYcYrdMPHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615938836, "uuid": "ddb33f16-9f60-4627-b346-074bc2c89e54", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615938836, "uuid": "3bd1483e-e6e5-4c7c-beb3-69beffb5d110", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938836, "uuid": "0b05f89a-cc23-42ba-a5a8-b754aa314093", "value": "detect3.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c22f6f-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876299, "uuid": "c68cbc89-0a72-4e82-8252-863e15f7477d", "comment": "Malware payload (Formbook)", "value": "3955015aa2e33447d87572f32f8e079b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876299, "uuid": "8596af71-a1c0-4fc4-bf91-77acb5629cc6", "comment": "Malware payload (Formbook)", "value": "abe39dc45b1164bf002c3de61df91ec599598523bcf4f8c6252f9db7d69b03b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876299, "uuid": "cad58f07-a323-4523-90a7-aac2dba5a2be", "comment": "Malware payload (Formbook)", "value": "a58e19449b940bcffa1521b101dea9f1b636e2ba", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876299, "uuid": "61a8f4e5-d122-4d61-ad8b-725c5ceb4fa3", "comment": "Malware payload (Formbook)", "value": "028d5e72c440a7c40cda616578c0bc94e0474347ec2db392ec6b7e82f2a7e63c4eb285e7990cc66a9d0b8e2943b5c23c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876299, "uuid": "27e6a3a4-08c6-4ebc-8a0f-782efac09018", "value": "39C4231C41FA2DBC62975593E1535FFC44D8B9B93A6F2E62E33A2A034FA1705CD8E042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876299, "uuid": "9c4c1cf2-e5e5-4261-a637-50182a055c81", "value": "12288:qyjBEffw1lfpq8jcD38lGRn1OETMxns2Y8hzFfStik1PrjbjYaBA:qyFEHwo803r16sZ8hzF6iwzpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876299, "uuid": "393615f3-1bdd-4dd7-b73d-7c6b6a36bd32", "value": 584784, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876299, "uuid": "c9ab87ed-a27a-4c70-a3c9-ece5df02e15e", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876299, "uuid": "d4f34dd7-4ba9-4dbd-a824-5dd964659985", "value": "New order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2dfb5d-867c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615915478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915478, "uuid": "e22fc72c-606d-4fad-a7cb-c049e9836972", "comment": "Malware payload", "value": "1c8ddd7d828d4018f3a946b54c97b3c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915478, "uuid": "f2eaf95e-e1a1-4ea7-8b6d-7d80290e0bb4", "comment": "Malware payload", "value": "ac72be7e600689c834450d211dda7a9100e07c8979f972749007e4ab51f7b202", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915478, "uuid": "2f221527-a30d-4486-ab91-3fdd9febf960", "comment": "Malware payload", "value": "f71230fc32fd09d7d0f047bb3694dee0a1778796", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915478, "uuid": "6b16048a-4ce9-40c4-ae5c-600e9fb5d072", "comment": "Malware payload", "value": "957ad01964b5a3dfdf2d5306e4e2f941067fd136491b19440f71cde410e190dddc27daf79b20855d8de49c4f9424fd53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915478, "uuid": "fe088a73-1915-49a5-ae4d-1f432c0f6fce", "value": "3A73F107CFA2BB42F56416B97D8B1BECBF02281D85A375DF46910B4B3E1463B0A4C5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915478, "uuid": "a5edc82a-e0b2-4e1e-9c96-a2733cd6618b", "value": "1536:6BAvSdERDOdyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBSLfxw:4AjcjZ1k8g05oyDJmipk4vykYARfWBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615915478, "uuid": "3aca8e13-05f1-42f9-a640-2b1a223b9384", "value": 77661, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615915478, "uuid": "61c3f77b-740d-490d-85a2-93899a7c8706", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915478, "uuid": "b5affec4-1fe0-4ce7-bcdf-649a8fdbe546", "value": "ac72be7e600689c834450d211dda7a9100e07c8979f972749007e4ab51f7b202.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2915fe5b-862c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615880979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880979, "uuid": "39091509-714a-4495-87c0-e37560afbd11", "comment": "Malware payload", "value": "18589aea0b4a4dbb728cf30828d81bfd", "object_relation": "md5", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880979, "uuid": "a21c92e6-8ad3-47d5-adc1-35db84d9b547", "comment": "Malware payload", "value": "ad0fd9f325cacdcb99d4a66640f448fc1ac55c1d1e5367c1c6eccdef656beed7", "object_relation": "sha256", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880979, "uuid": "0f4ed2ac-acef-4d94-a4f4-3a58410d81b8", "comment": "Malware payload", "value": "907c0e1231af23e68a2f8287b89b53611a649c74", "object_relation": "sha1", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880979, "uuid": "0c3c3181-3481-4d41-bd06-a08ba539cc3d", "comment": "Malware payload", "value": "47d40704d4e774a38a194fff61b5a4db13939dca2ce342de776a0c2e9c67150c1b4e7ae99ba94db802650dadac438f28", "object_relation": "sha3-384", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880979, "uuid": "5665bd91-e137-46a0-bf8c-4b0b43baaf2e", "value": "87D54C26B184A53AC0AB1935C937A6789C3FBE6166178C4F16F43C8C9F356402A3E75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880979, "uuid": "773aed7d-8245-40b1-81fc-c1793db0f460", "value": "f871e7b97444b8f61dfcc85dbfa5aa2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880979, "uuid": "f8be71ad-7625-4c6a-b953-1bd3b42c14d2", "value": "49152:SEe70rc8Y5ZDZwSrg2R2gksbqHiTT71M4Y:3Ta/9mCb1MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615880979, "uuid": "dd2c045f-9150-4be5-892d-e31b7778b321", "value": 2772056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615880979, "uuid": "8a3d83a3-77b1-4c0e-8020-b7bb4189b5dc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880979, "uuid": "5a97d809-afdb-4cb8-b723-b313fd2ca957", "value": "ad0fd9f325cacdcb99d4a66640f448fc1ac55c1d1e5367c1c6eccdef656beed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e867433c-8667-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906640, "uuid": "e36cd451-bb58-45d0-bb56-d3523aeff70b", "comment": "Malware payload (AgentTesla)", "value": "1c6644952ce7a22c9acabcd3d95414ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906640, "uuid": "8b596ab2-b3da-4d2f-a225-f389d750a7af", "comment": "Malware payload (AgentTesla)", "value": "ad39169af0ebe9afeba1bc9947951d8235f938f95fb266282860115bc1cad4a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906640, "uuid": "2fc02440-d6ca-4f1c-bdbb-a422be0b2e80", "comment": "Malware payload (AgentTesla)", "value": "87ffc2ab1865111b78ca9b3490251205245f39e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906640, "uuid": "a610aac4-fc95-4b37-af9c-8862e11104f4", "comment": "Malware payload (AgentTesla)", "value": "e2307e85909396157a978ab22db275b9deae960585f61050959c8c39d389b39716f17df91181f4905c6d2e7f13b609e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906640, "uuid": "e5727c5a-bcb5-43f9-9a12-cbe383e5f1b5", "value": "101512362798DBA4D4BE977C0830250017F0AE43E796E74E3EA532DD1972B85523B763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906640, "uuid": "4023141b-8233-47f8-b177-062d5ca08422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906640, "uuid": "ca1f53e4-c86a-46e9-82e9-01643761997a", "value": "24576:XEjQVZ2GK5z27oGRPnnuCpoi9mcJiIWk3jO9sSOxLiTaFcUK:UUVkRz27nhzpouJiIH7SlTaCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906640, "uuid": "f6c717ef-e54b-4c42-ac97-a9fdda8afcf2", "value": 937472, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906640, "uuid": "943931a3-befe-4397-917f-1bd97304f9b2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906640, "uuid": "df2a2b5b-4ec9-45a5-8acc-8066657b4731", "value": "Company Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d77e0b-8688-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615920728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920728, "uuid": "4c12afe2-f270-45cd-b913-1e2875bf81e4", "comment": "Malware payload (SnakeKeylogger)", "value": "d4f5ff12e0df2ded151d08fa5c3f6d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920728, "uuid": "35b28070-870a-4adf-9f13-cde786e68cd2", "comment": "Malware payload (SnakeKeylogger)", "value": "ad5890a2532595ec7adca3b79fcede8214ce4428332e54158eaf154909e474dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920728, "uuid": "e6fcd6e2-86eb-4fb4-bdec-201440511632", "comment": "Malware payload (SnakeKeylogger)", "value": "4dd5705585cb61253104709823809df6e2c9f46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920728, "uuid": "b8b591e9-337b-49d3-b7f7-1e9cb0c25a6f", "comment": "Malware payload (SnakeKeylogger)", "value": "4f61bc78b533814a1b5e385ed3b0e177b54db2b033ec91e4830534ee5412bd92e3027deebebed1e34a7d4d8fc5e0fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920728, "uuid": "dca3c37e-dcf8-4a0b-ad84-8c0c9a71d3b5", "value": "13847D62A29ECF73E46D7E3F019F141C4381E1DBBAD0D24B2A6A1F7325168C47B4D899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920728, "uuid": "f061b797-95df-477f-8b55-02469e35ff07", "value": "6144:pv9ay50jRVCdT3/ceLDcLuZTvujtGxwddZpLJCPV2dgNc2bS835I25sHBVFM:Z50jwcEc6tcJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615920728, "uuid": "fe0ad7ff-d965-477e-8bc6-ea01ceeb3b07", "value": 402825, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615920728, "uuid": "281b167e-081b-489a-9e2b-b1d349d0288d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920728, "uuid": "4f9476fe-93ad-4c2d-ae66-63b617165dde", "value": "d4f5ff12e0df2ded151d08fa5c3f6d9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7ba833-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615922515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922515, "uuid": "f9450f53-bf42-4200-9efc-a9818570c870", "comment": "Malware payload (RaccoonStealer)", "value": "3dcd03958ce79c660153d69c41225b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922515, "uuid": "78b01541-e35f-42ff-afb8-abb9aed5f5f3", "comment": "Malware payload (RaccoonStealer)", "value": "b1c98e9d6909af1bd2bf1436a95928ee0a1ec090c6d85bb4ef536f6230e83df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922515, "uuid": "30c45c38-bbf7-4979-82b1-5208fc559981", "comment": "Malware payload (RaccoonStealer)", "value": "cd081c8b499c093023acce505a38d2f30b080b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922515, "uuid": "723b585a-a055-499f-a784-d0f6db6d5957", "comment": "Malware payload (RaccoonStealer)", "value": "96cc0e0f721ed0cdbeda0eae3bc6888088e85d7741a010ee93df9a701d10f8191b22eeb16a49ad3f95a71dec896d5de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922515, "uuid": "178e9ebb-e76e-4b30-b48f-28eddf472c50", "value": "5EC4D000A7D0C034F2F765B445AA82B8B5BD7EA19F3484CB63D52AEA1B385F4AD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922515, "uuid": "3f7c9515-b5d5-4be7-b5c9-2bdd3d05d4b0", "value": "6ce9d3d90c7fd3dde0888519f67222eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922515, "uuid": "2226d9a9-65ae-4fed-aa89-0fb676ae8e0c", "value": "12288:lMJnku5D0op7hECdes/PjvOp7gtNugeytS:lUBD1Xx/b2oMgDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922515, "uuid": "471f253c-79ae-486f-a2aa-72d2a35eef71", "value": 544768, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922515, "uuid": "50e3226e-f9d9-4748-be3f-b53bafe5ca1d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922515, "uuid": "69b94a73-5e8f-4fb2-be0a-12a1f6c80ac7", "value": "3dcd03958ce79c660153d69c41225b21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a73452-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894826, "uuid": "76f793cf-608c-4b74-b0cb-7aacc70e7168", "comment": "Malware payload", "value": "e7d148a08be2371309ed9bf144b85856", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894826, "uuid": "11a4a74b-a12e-40cf-93a3-4631a2c27276", "comment": "Malware payload", "value": "b27b3048288c5f28f60f84fcf62f953fc4129593a575bc49131c8a501d83d2b4", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894826, "uuid": "302223dd-bdb4-4ef3-b07a-96abf29a512a", "comment": "Malware payload", "value": "2ba0793e1cf01a46134ffa268a76199b04f92b12", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894826, "uuid": "1dcd593b-2e3c-4dc1-90fa-ce19be944422", "comment": "Malware payload", "value": "e1b85ec37293657a22669999b3bc490642adc98babfd36484dd5b9df4cd688057b66240d24aebf925b6b14cc79e38f6b", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894826, "uuid": "c71f6ccd-2482-4cb4-9b9c-779aa09d5843", "value": "DF63AF4ED2A468A6C779B43D530268D14D486057E983B12F72D879083EAF1D727DF2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894826, "uuid": "41e45905-6bca-4131-aa07-d6146be64781", "value": "1536:4mmMf8b6NFa7LobwRMU0SH1ITpFnsZGhW/g7VHPGWj:Xm8coMmYHWTLP7Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894826, "uuid": "9f6b72b7-0fc3-4b7d-9e0f-76d89fb3e65e", "value": 71950, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894826, "uuid": "1243b957-1fb5-4012-8b3f-816ac4ed168a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894826, "uuid": "7028d0c4-e8f4-4c7a-b79d-a83d2a0ba514", "value": "dettagli_144.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70e97db-8688-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615920784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920784, "uuid": "5c48fe40-11a7-424a-8b86-020bcc80d147", "comment": "Malware payload (AgentTesla)", "value": "58c0c92c8e95bbc99c0dc9b25f268b58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920784, "uuid": "126e749f-35c9-4981-b8cc-5e2f690b0205", "comment": "Malware payload (AgentTesla)", "value": "b2ae47f62aa239fb6badfb8af83054c008e9c93d6fe1953732ec03029dc474ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920784, "uuid": "cba48c82-19b1-4ac3-844e-521b283e8bf6", "comment": "Malware payload (AgentTesla)", "value": "54874cce2f5693bc7c49e86cd6ad8b96eccf16f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920784, "uuid": "ac5a2ab6-29ac-4fae-9fe4-087c4fc48c6c", "comment": "Malware payload (AgentTesla)", "value": "673c90935122a37c169f32dc96419aa34270952872225e3693ae6a80e43bd9a6ab748738c10b915ceff730bf0076b96d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920784, "uuid": "bb3e6865-2337-4ca4-8c89-855bc959736e", "value": "2125DF352AED6615F177AF3A8AD474859BEFFA236303D41D2CE1138A4713E80CD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920784, "uuid": "50d86313-eaef-4364-8991-21233ca03053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920784, "uuid": "f41bc976-30d9-4820-bfaa-88d9077ca26c", "value": "12288:DLtSf3miOFhJTZ3LO0/88Bry3ueDwk9etTtg2rSJ/osT+LChSplGAciSHcrmgBGg:7j3L+O8wk9eJtXrS5osT+LL/Q81AqZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615920784, "uuid": "323b2280-1e61-41a2-be5e-c3c0c8cf6faa", "value": 1005056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615920784, "uuid": "8dca812c-854c-4c8e-bab1-1f2b06483df0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920784, "uuid": "5e927381-fcd4-4f91-ac6a-76662c47148d", "value": "58c0c92c8e95bbc99c0dc9b25f268b58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e4fa18-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615893967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893967, "uuid": "0f1969ee-4ae5-4e40-8a96-ee1f6f60c2cc", "comment": "Malware payload", "value": "a5d2a2078b2039d78b6eae01a36ea14d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893967, "uuid": "0707965b-1b11-4384-bd8a-42cb261d2de6", "comment": "Malware payload", "value": "b2bda28484c55a51ea2d210d3ce2587b1df4079e8684a286425c51771843ce88", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893967, "uuid": "6d3f4682-4fce-450b-8754-d1a02e12303f", "comment": "Malware payload", "value": "e06540665575811138b2ed60b28b7725148ce860", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893967, "uuid": "9fdcb47a-5eb6-45b7-98ca-8dbb277b6baf", "comment": "Malware payload", "value": "f10f806a07dcfca69d236b1580def9c094002c94d35526fb630600c00566419cd3f7080ce9aca7e007502ca96427197c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893967, "uuid": "1ea4617d-f937-4e64-94ca-9e4aa3f0c540", "value": "43E42356650331C17A755E13E34DB7B0260B3AE5CE50B9A2B4E69D9DB2B24B08F21C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893967, "uuid": "9dc95c50-20d9-42e1-b20e-df840295ae21", "value": "12288:UawKuEI9K4lKM7HuZaHyRnO7v0Jl+Ptf77NeKR4t45iTKcoM3ZV8i:RwQIsyKw5SlO7v0JEf77knTkM3ZVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893967, "uuid": "0c0e3d02-d465-4641-b697-119a6e559d0d", "value": 670948, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893967, "uuid": "c870c83f-56c0-45a8-b611-45872e2ecaa8", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893967, "uuid": "f54d40dd-4a73-412d-8d7a-26a5db4582eb", "value": "Purchase order for attached items.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79438f7-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615876520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876520, "uuid": "618cfee8-65d4-4549-a9e8-05783c10cc65", "comment": "Malware payload (SnakeKeylogger)", "value": "ca1a24dc3bfe3c9a842bca74d6f60939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876520, "uuid": "718ff630-609c-4e52-b806-69b24a8485b7", "comment": "Malware payload (SnakeKeylogger)", "value": "b3422775d543c511ab8b6edd1e9fa7c5d1b23edfd8a62a64210dbca024ca7bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876520, "uuid": "6749978b-fbab-443f-8c52-3016e0b54966", "comment": "Malware payload (SnakeKeylogger)", "value": "05f060f1466b335666a23d8f342d9e3b67cfe3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876520, "uuid": "b4a157f3-d90a-4f0d-9bc2-8d414ea1f579", "comment": "Malware payload (SnakeKeylogger)", "value": "b9818258fddd22db158a7a38c945888269680f7edc74afa04ca7fb85ec027bc458b8496e5a002bc9a1faac8033781534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876520, "uuid": "ed9288b3-1496-4736-9996-3646243e92bb", "value": "19D570C5B629F1B0A79F8AED6DFA4C5434C2C45DB16E51D636C8239A2C01B07C2FBB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876520, "uuid": "66ad0199-fe93-465d-876d-577acdacf8c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876520, "uuid": "4a00809b-21f2-44c3-abe9-e3cac1709999", "value": "24576:z+028mcqWWrWWe4rEVJNawmNuWGdyk6Xs8esolbcZekgfc4lOpdn5X:z+03mCWr6VNaK+k63olbcZeNEkOpDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876520, "uuid": "deaa09a0-e46f-4c8c-96d4-55849e6d8e78", "value": 2751488, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876520, "uuid": "260e1b9d-6e01-43d7-b875-9a3fa2e6f600", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876520, "uuid": "3caebc52-1fc7-4cbf-96eb-72cc9d3352a9", "value": "MFT40FT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a23621-8665-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1615905392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905392, "uuid": "86cc5808-67ff-4feb-8267-d7dabc4f378a", "comment": "Malware payload (IcedID)", "value": "0c72ab9a9056aa37eaca9d0be5ee30cf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905392, "uuid": "986bd53e-ce67-4640-8009-2d176380527e", "comment": "Malware payload (IcedID)", "value": "b3791ea2bce069a6a17d518c6b62e08273a0f7bcdc023536a71af7210722cccc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905392, "uuid": "6fe90dfd-5b36-4a5f-b7d9-f7b228207398", "comment": "Malware payload (IcedID)", "value": "061fe160f7b96da8f01b245425a56a9792605ed6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905392, "uuid": "06c4d285-8a5a-4d9d-9d59-fd29c39cf7fa", "comment": "Malware payload (IcedID)", "value": "ea231a9653f50218d17a208e5b85662620cba651e6ff926cda858faecaa1da63a4b55f201e36e28794b023aab211db2a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905392, "uuid": "3bd3a81f-ab74-4543-b595-70f079b5add0", "value": "AC134BC665B00622D9352971C0F65B28C63BFB40B79355F7E14CB769C5C21A0DB329FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905392, "uuid": "7b0bdb46-6dcd-4f43-bd17-04f6696d47dd", "value": "b0b1eb6b927ff9eac0d5c84755673f1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905392, "uuid": "c7a8b2c1-b64c-408e-8739-afd9e0787aeb", "value": "768:Ba0m1j0AyrfvFEnWfF+gBDRIqkQsZtFKbvrAbDSpVRsZpajFvuXYM:Ba06L291fF+gBBsZtFEl/RTjFv7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615905392, "uuid": "250b2f1a-7b70-4794-9554-87f36200b295", "value": 44544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615905392, "uuid": "4dcf0aea-8277-49f0-9f06-e2e20f396550", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905392, "uuid": "812c504d-72f4-46fa-8461-e491794428f0", "value": "IcedID", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5c4839-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615893845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893845, "uuid": "063e1b7d-51f5-4aa5-8d29-923514b325df", "comment": "Malware payload (Formbook)", "value": "dcb7f1452b4accc80454b112953f88e5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893845, "uuid": "d9be7b3a-bce2-4a15-9b89-e08b09758340", "comment": "Malware payload (Formbook)", "value": "b38c11ce5d7c368dd1b51d1b5d8df3e09abff40390f68a1f81dacccfe3f01725", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893845, "uuid": "e339592f-0d33-47d9-b6cb-aa55cba6cb2b", "comment": "Malware payload (Formbook)", "value": "cce279ac815d614ea04c08321523a59506c4ad0f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893845, "uuid": "d24775fb-3cfd-45b6-91c2-23fa06d6de46", "comment": "Malware payload (Formbook)", "value": "b47610f0af2616488083764f92e6041e8e29f843a41e19b21c668ef93a84428d9a8d2dca1cd731aedbe25bb3b51894e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893845, "uuid": "a4d3678a-e259-4574-b4e6-7f919a4b6820", "value": "F1053925F2F14432D3531538F84752A97D26AEF11B2A68F736E87D484B38ED3E4352A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893845, "uuid": "8209af64-6087-4e00-a1b1-24f7308f1d44", "value": "6bf7d0ce52df1f675ebcc54d87bee2d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893845, "uuid": "df5d5720-5ddd-4a63-9637-e263ba134514", "value": "12288:GPx8AiN9H9Ouul5AGEj46EW8JYQ4QMd27Q9lWU9V5yr+vPlA:AqAij9O5fEj4WWYQN8Xn1yr+vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893845, "uuid": "9b270b47-0d7a-45a2-b1af-ad10696a9843", "value": 845312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893845, "uuid": "a0166f45-181a-4c64-a6f6-177ac9dcf4c8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893845, "uuid": "13d8c158-221b-4d50-85ce-70bd2057e926", "value": "bestellen pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3e5814-86b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615938617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938617, "uuid": "d6416f1a-fa88-4660-93a5-5c46794df928", "comment": "Malware payload", "value": "63f132b08a06ebe1d5237d44806351b3", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938617, "uuid": "51785811-ff8c-454f-aaff-14e2e979b4f5", "comment": "Malware payload", "value": "b5214bca0ddb8e8094bf7b80947dc92a245665efa1e789d1c64f41ea5dbe2866", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938617, "uuid": "c7ab445f-ac41-40ed-9e9b-e9eaca3ebe3d", "comment": "Malware payload", "value": "c5d5469e52d2850455ea42f5d9556c13fb7a6b11", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615938617, "uuid": "33f63a72-5db4-4b56-98da-0239c48eeae0", "comment": "Malware payload", "value": "59af8921821731bf825f779cb12b31c5cca5eadba69257bf2b327b21ed56472b64326428e87e8e7f9de88b01aabc82bd", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938617, "uuid": "aeb348c0-bd60-421e-8d47-b9803f67cddf", "value": "E0019E37F5E7D6124429C8AFEC6E9F89E87005470F6956D1D0D084D78D4184A577C85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938617, "uuid": "d963bb9e-89b9-4e77-8395-08b093f0f78d", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZmKelhyc8brdvkPCEhXpyZJN:1IecuEZgNpYcYrdMPGoJmKelYcYrdMPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615938617, "uuid": "cae18b7f-4414-4033-be8b-955ec8e4edff", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615938617, "uuid": "a30976b5-4ace-479a-81b0-54eb19fb4595", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615938617, "uuid": "db598ce4-ca62-45bc-97ea-155776e01884", "value": "detect1.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb6032f-865d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615902116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902116, "uuid": "624ed530-a3cb-47a1-b0c3-d384b559b6f5", "comment": "Malware payload (AgentTesla)", "value": "e829cad85048d4945256c46b340e2cea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902116, "uuid": "0c74e20a-a651-44ec-8146-f9e7a5337cd2", "comment": "Malware payload (AgentTesla)", "value": "b5f0e20f9980ba833f56a6bbe1e0e3deea46e566c0eab83a473c4705e2b295d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902116, "uuid": "4ab20713-35b3-4f06-bb84-88c536c34d07", "comment": "Malware payload (AgentTesla)", "value": "c7faa7da66b6f440fdf50f80d380148b53aa9d10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902116, "uuid": "7cbd59c1-5a4c-497b-8e1a-c068c12485df", "comment": "Malware payload (AgentTesla)", "value": "3348f68b1f6d67fffdba0ad35b46bb44d10a720101a46aec20c97e5ffc71a5cfc7bf9e296e471a928a2c6dc12b0b4368", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902116, "uuid": "ea1911d7-b4d8-4ad4-9c89-6d75bc50324b", "value": "31358B22E6A4AB70F03D73754432133053FDAD0A9626E6BE7D8431DA09B5AC586F3D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902116, "uuid": "0817e2fe-b442-4525-b89d-92e2daabefe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902116, "uuid": "50fe386a-9b91-476d-925f-d04f31ee308d", "value": "12288:WxvbtKyo6doVaW0uulPCp4SRK/pd6Q3XsYG4eiMLp25fdvs1:Who6doZMgpHKNsYG4Wp49A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902116, "uuid": "9c32ea7d-2bd2-48d6-b5ff-6685fc0f7eb2", "value": 1074688, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902116, "uuid": "aa623f87-2f7e-4204-aa21-0b88f79ba19f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902116, "uuid": "a63bbf77-d8dc-4614-b95a-4df753f0cd37", "value": "M5tVZX8elw4qvXx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc0ad34-861b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615874037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874037, "uuid": "5546722f-7441-436b-a6c4-48472fbf2790", "comment": "Malware payload (Gozi)", "value": "1e5bb5d9b94de2f57603021d57125d9a", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874037, "uuid": "dc7f063b-2266-4dd6-a11f-433de57f8a11", "comment": "Malware payload (Gozi)", "value": "b5fcda8806def3e51537b8b94012bca05057f162dc0a3b8ed6609df4939f359a", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874037, "uuid": "5886d59d-b50a-448d-9efb-7932b1f9986e", "comment": "Malware payload (Gozi)", "value": "f311e990f90496803bf17c49381ad9712895eea2", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615874037, "uuid": "ee195aad-50f9-43a7-b3c4-7acbf82bcaaf", "comment": "Malware payload (Gozi)", "value": "1d939ae5214e67213c8c97995e2b0d5aa8fa52240971022b379e951a37004b798031828f64b1bd339ae534f6e31b07e9", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874037, "uuid": "f6194e03-8dda-46e5-bad0-cdbd2bbb6221", "value": "9773F117CF669B41F1A852B9BD8B1FDCBF0124189A9375DF0A500B9B3E2473B1A5C0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874037, "uuid": "5c314ca8-4882-4d61-a2a5-b36d96e73a39", "value": "1536:lPKFAa0IG0yY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBXLfx/:t0/pGsZ1k8g05oyDJmipk4vykYARfWBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615874037, "uuid": "347dfa5c-65e9-4a68-bd75-b0f6e5bb255b", "value": 77706, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615874037, "uuid": "cabc100e-57c4-4b47-a946-2059ce018170", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615874037, "uuid": "22317029-4738-4627-9f14-dbefa8cb0fce", "value": "comando 03.15.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c32da4-863d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615888402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888402, "uuid": "7d150bd1-85a1-407c-a3a3-dde690e90871", "comment": "Malware payload", "value": "73df0657542a28840d85dcf5dd1d5a39", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888402, "uuid": "e8116be9-f741-4870-86c1-8c04a0bbea96", "comment": "Malware payload", "value": "b61a378db7cac7698deb72e955288d4be97d401a890fafaee7903664bc90dddc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888402, "uuid": "8d75a830-dba2-466f-aedd-ac258be2729e", "comment": "Malware payload", "value": "433696daf8522cd2e40afb13857ce9fea3781248", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615888402, "uuid": "8231b79e-0367-46dc-8658-5fd2b906ae8a", "comment": "Malware payload", "value": "638eac93bb78e5a22cee1430d93d85e620483ee9df39fd7ccdad8e15a87212cdcbb597e835cf85d29566e591e04fad90", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888402, "uuid": "37fdc65c-7eb2-4eb2-9f05-97d31083ed95", "value": "60F36CE8E8D1CDE4CB8FC5DA460D7A941063F979C6C36C8A4428F3F50B9267F5A5AC60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888402, "uuid": "223f085e-45f4-4985-9d70-7ff1a37e3323", "value": "3072:Av6qm5AvFTnx1//kUWwyJi7eLbkrMrN6EetrKYWZ6gq6AVKlG5hEBYRPYfsa8:Av4KFvkeeLbyA6EeNXvgGVKlchEBgPYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615888402, "uuid": "baf4b119-7034-40eb-abae-6e71359c08c2", "value": 166198, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615888402, "uuid": "83f27202-2a53-4ac9-b9c8-7ae9e45180c7", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615888402, "uuid": "9ca60546-2081-4a87-802b-357c7348dadf", "value": "Scan 001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6064cb03-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894815, "uuid": "efab7aa8-2bf3-400a-bb1b-db59dc4b55c2", "comment": "Malware payload", "value": "4e43ebe63bf2c30c687b510d108b08fd", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894815, "uuid": "a7afb2c5-d7c8-45c3-8f82-dc42c04ba5cb", "comment": "Malware payload", "value": "b65d90916a662392dad1f77cd64a84f5604fd1a72f1944bed0b40f3838492c35", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894815, "uuid": "42ade0a1-600a-45c3-b20f-fd3fbd8d71ad", "comment": "Malware payload", "value": "de2084101cc574647af4d2e2370000797895c17d", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894815, "uuid": "31222539-66b1-4785-ab65-b03ab8aab9a9", "comment": "Malware payload", "value": "f387dc45876b1dea81a083b11894f4559b6fc6a3069656015ac3a2d315702e66f6c636ca30df4a405cf1dcd4c92af2cf", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894815, "uuid": "e05c1d59-d44d-4d6a-aa06-34161d4bf930", "value": "4853BF4EA10560A6C269753C930668E25C4DB097D4C3F51F29A4BF08B9FE1D72BCF1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894815, "uuid": "8423a19a-f379-4841-a6f9-c6fc726fbe9b", "value": "1536:57tSRuEsKmSWrhaePe7qTRhhj2QC4fIoNhJvM:570mKehaetFhRrtwYbvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894815, "uuid": "cd2ebae3-151c-4583-b64e-463c15000585", "value": 66238, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894815, "uuid": "3a8bf311-b1a0-4075-8a41-74278e6bae29", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894815, "uuid": "a20bbd15-0d7a-4454-8bea-ffe9c44742d2", "value": "contri_2442.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecc7a31-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918005, "uuid": "ec4edbdb-c1c4-4e7a-b4f6-e76395b01700", "comment": "Malware payload", "value": "e9b51901366a4117cd043bf75e4a5134", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918005, "uuid": "42139759-6325-4685-b1f3-3c196d04b7ad", "comment": "Malware payload", "value": "b7b970eaff26baabffd607c63e2825aee992cc8de6de46cec14b7b1a3c2ea181", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918005, "uuid": "8440186d-8cee-4dde-8378-0cd8f7ceeef9", "comment": "Malware payload", "value": "45e2b899d6bfcf3d830538fd02757890c3c17bf5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918005, "uuid": "995161bb-aa9b-445b-a5c2-5abbbadf0729", "comment": "Malware payload", "value": "b4f2d57c820477a322792283bdd31e1ad8cffec19eee8018c65b9f97284b5009325e184ba42004d31de2e6a01899ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918005, "uuid": "1276429c-c9f7-445e-8585-a313fa1b2c4a", "value": "83F37CA8E991CDD4CBCFC9D94A1D3A952023FAB9C6C36C964438F3F50B9267F4A16C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918005, "uuid": "c6de671b-4591-40ad-8b7b-88c1c25421c7", "value": "3072:Lv6qx4Zts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8eJ:LvZ4Zts6vVGt/2l8nxpKJTJznhdDT+8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918005, "uuid": "7927f68f-0dcb-4364-b99f-da8944223418", "value": 167476, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918005, "uuid": "85eef54e-7f82-4ca7-9e9f-7fe8d754cca7", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918005, "uuid": "e1bea1b9-1094-4dc7-874d-826e21b7f82c", "value": "sample sheet.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a269db-865e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615902473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902473, "uuid": "0c530048-7bc8-47fe-8e1b-5b06bf244d60", "comment": "Malware payload (AgentTesla)", "value": "e0088eda10946c694fbd7e5c47a4b671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902473, "uuid": "9fcfe6af-3ef6-4e76-9121-8c9c22b872b0", "comment": "Malware payload (AgentTesla)", "value": "b90e1e7edc9c706f49052560be86957b71f1dd905ee08c9441dd686546bd9804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902473, "uuid": "487f1926-a0f8-4a1e-9571-19cb5d85e369", "comment": "Malware payload (AgentTesla)", "value": "ab1ecd29d9f0640e4773dd9d4f9d70e5d1f7ee83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902473, "uuid": "093f46c8-9630-41c1-8fb1-cfc31e7b9ebd", "comment": "Malware payload (AgentTesla)", "value": "beafd49ea09ac5a55e389e8564ec0bc33c3455483ba24495d3f0e2b3600eba9630d5e261b0362fd49b9bc4e2bdf02c19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902473, "uuid": "72ed384a-e907-4c8b-8d2f-e50fc13dceb3", "value": "BFF40159B1AD8A2BCA5CB0BE01E3602C8FB18913E761D7CB5ECB31E951C1BC92D059D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902473, "uuid": "2a14ac7a-97a5-4207-83c7-8800867dc1a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902473, "uuid": "30358e3d-be07-4c88-bcec-bbf1d5971284", "value": "12288:Tn+sOEYrOj2JTR0ym2WsWUh0PqSYLFGC17M5mS15eImD1Nhcluv7zI79iEbYRVt+:TWA63BNpGC17M5T15dmD1NQ179iK6N/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902473, "uuid": "0deadb53-99b9-4749-a119-ca0a31faf54e", "value": 763904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902473, "uuid": "78fe5613-8f15-42c0-ae26-73840545605d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902473, "uuid": "fadc9896-132f-45c0-b6d8-a96b4519ef2e", "value": "ORDER_0199321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4df6e5-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615922108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922108, "uuid": "f578815e-f94c-4057-b1a1-a642e7e7a671", "comment": "Malware payload", "value": "ccec4951889a6617205b08a075e9ee10", "object_relation": "md5", "Tag": [ { "name": "Hafnium Webshell", "colour": "#59C31E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922108, "uuid": "655ec261-9043-4a8a-8528-d5b801e5ad59", "comment": "Malware payload", "value": "ba0003d14437ee22ae0989146d5fbbb94e89983fea5e58f8016acf8cbc950e80", "object_relation": "sha256", "Tag": [ { "name": "Hafnium Webshell", "colour": "#59C31E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922108, "uuid": "e3d5a9a6-8dd8-4f88-b98f-57bb88645879", "comment": "Malware payload", "value": "48b7079595b7195c996e1f3a6bce2799ab041ce0", "object_relation": "sha1", "Tag": [ { "name": "Hafnium Webshell", "colour": "#59C31E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922108, "uuid": "cb2eca82-4d95-4e30-8344-92fdb53eff71", "comment": "Malware payload", "value": "c29747820d2aa1d7bbc46f59a00af8a7064d1e2f80c091918e59c9326913d185ac4451c596a3a234efca48565a3e0f97", "object_relation": "sha3-384", "Tag": [ { "name": "Hafnium Webshell", "colour": "#59C31E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922108, "uuid": "686e4ce1-26ea-4a62-93a0-7388a026cfcf", "value": "D564AE3BBC9321447B54138F5B0BEC472C076E172E4B6DB86379864B91ADFA72520E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922108, "uuid": "d58f68e9-faa1-4478-89e5-925f38f581af", "value": "6144:j4puzvjHMvzuN/k7U9hQ1fLB0TNndGAJb68Ijws6:jHsruiU9QAGAJq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922108, "uuid": "6a080b15-fe63-47a8-9c3d-934dbc4f2a72", "value": 322848, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922108, "uuid": "115b4151-eba4-45ee-a0f2-18b689a7be44", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922108, "uuid": "3ae52566-c17c-41c2-ba85-801b9a09e18e", "value": "ba0003d14437ee22ae0989146d5fbbb94e89983fea5e58f8016acf8cbc950e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e426ea5-867c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615915481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915481, "uuid": "0a7a1db4-2431-4997-aab1-212a56db435d", "comment": "Malware payload", "value": "a35cb4fd0acec4f032925172279ff06c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915481, "uuid": "ece938a3-7fe9-44ec-8de1-859e03079e06", "comment": "Malware payload", "value": "ba087223efef70dc3f8d226ce94deb4e13addc6713f2f3304965b3a692b53960", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915481, "uuid": "6462eed8-08cd-4fd9-9b8d-15406adca0a9", "comment": "Malware payload", "value": "8a68c62420c6fa338abfcb66c2e9064a0035a43f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915481, "uuid": "f437b12a-54ca-4ff6-a959-22074c23450f", "comment": "Malware payload", "value": "0ee9e9ffbeafac4c19e95672da32a5ff7c466f69f852383e2e8e0055b269811dfd87df6d74f8dd377cabc42d2258ea1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915481, "uuid": "04c4914b-1e05-4f54-a68c-14742bafab8d", "value": "8873F117CEA6FB42F56412B97D8B1BEC7F02281D85A375DF46900B4B3E1463B0A4C5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915481, "uuid": "d7ee6647-46f6-45a1-a6df-365fff2a1f93", "value": "1536:6BAvSdERDOdyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBSLfxiP:4AjcjZ1k8g05oyDJmipk4vykYARfWB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615915481, "uuid": "21c77d5d-0652-4549-9378-a33ae45607e7", "value": 77660, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615915481, "uuid": "7c3aa01c-b86d-4c76-8189-5ff8b52620f8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915481, "uuid": "9f79d622-a4f3-4adb-a4d0-eee192a8f56e", "value": "ba087223efef70dc3f8d226ce94deb4e13addc6713f2f3304965b3a692b53960.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98df8ec4-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload (WSHRAT)", "timestamp": 1615921539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921539, "uuid": "436d3ab9-f4cd-4467-9cbc-718bdbc12fa8", "comment": "Malware payload (WSHRAT)", "value": "f94bfce5384f10201df977d67ea6c5d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921539, "uuid": "8ac78b00-5e33-4487-b4a4-95bf45ade6cc", "comment": "Malware payload (WSHRAT)", "value": "ba25eeb1352d5aab2e09eaa942324510ecd964671e7def1e158c3a543534ca1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921539, "uuid": "286ee41c-f5ba-4cd4-853a-05cd8b107077", "comment": "Malware payload (WSHRAT)", "value": "fb5f56e7e554d466b6ca7264c2748826daac8cc7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921539, "uuid": "35bc3603-fa56-49c1-a7dc-dd8fa168713c", "comment": "Malware payload (WSHRAT)", "value": "15a86db35fbabfa14cff7aff4764e0313b6f5e2f0273fbbd035e39ce62c1b97ae4998f75c167ad2d6107e7dddbd6c61e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921539, "uuid": "6ddc102f-7516-4c8d-a87c-dcb14be1431a", "value": "6A04E09E5909D23E834176D4A20F971DCCC1A59B3A14C0924AFEC58CB73B6B496F3A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921539, "uuid": "c80dd88b-d9dc-474a-9f90-1f1090d09c12", "value": "3072:+p1gHeX3reX0f6ZKOBRY+7Q0bamKZtvEzKbURCqeGK/6SbIpklgVDSxGfmuZyas:+p1gHeX3reX0f6ZKwRY+cM24RCqeGKZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921539, "uuid": "595d6444-5ba1-411a-84c3-6e7f65b40a12", "value": 183652, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921539, "uuid": "efde14ef-a025-436e-a4e8-124ee78537a6", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921539, "uuid": "62b9190c-43f4-4c83-9f07-dce41b39f463", "value": "f94bfce5384f10201df977d67ea6c5d1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c843f4-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867422, "uuid": "54cc1ef4-6a51-4341-b305-1dfcb49e66c4", "comment": "Malware payload", "value": "a0ef945347cf105b8a6300780651ee21", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867422, "uuid": "aef3b925-6806-4adc-a9bd-c623df4a4b87", "comment": "Malware payload", "value": "ba4d06225cb59e32a9002bb27c53471a19bdc37b870870fe3891a66e05dd20c8", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867422, "uuid": "9532dcd9-fab0-4ac3-834e-a26196a9263b", "comment": "Malware payload", "value": "957846c85c880e6b20b746a36441b6ff9a1c6d09", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867422, "uuid": "f0c25d56-4e45-43bf-93c2-37ebe8ba1105", "comment": "Malware payload", "value": "6417ed7746380b422a913aaab35907f9157bfa450d16746ec4f994da710b09cd1c4bcaad313ec46b6a52d673f4e501a6", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867422, "uuid": "d073b487-82d0-4f51-91d7-07b0b31e9956", "value": "D7630272C1B2176BC191D7ACFD42B136DA4051668FC99DA6EA44DFA3DEC3804711C8BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867422, "uuid": "253d0850-5b3c-44e1-8e30-01505335671b", "value": "1536:5d3Ecia+YfLC06+kse4Ov/suaYeTAHbbS3w:khDr+kC2/suaYOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867422, "uuid": "0f9acdac-d5c3-4453-9d4e-947fb015b491", "value": 67474, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867422, "uuid": "66f6b02e-d019-44c7-9076-3bbb7b199bc9", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867422, "uuid": "cc9894db-e2f4-4c9f-885c-6e21fcbb8e6d", "value": "attiv_1717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8bce5a-863b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615887479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887479, "uuid": "6936212d-7185-4fdc-ab22-5d65e3f7517b", "comment": "Malware payload (Gozi)", "value": "0887d9f8f3f1c58d907fd658f3c13a07", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887479, "uuid": "dca92f07-8959-435c-bea0-548df047d1a7", "comment": "Malware payload (Gozi)", "value": "bb48d55decf6536269b2fc1ba5a3ac64df6e7f7bf5886eb842fa365709e018ca", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887479, "uuid": "7174cef6-79a7-481e-86e5-1f8059368710", "comment": "Malware payload (Gozi)", "value": "43bb8c0445032e25ed067123ef96791dd232e9e3", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887479, "uuid": "e6514b6f-d817-4d31-be88-c8b50dc4a632", "comment": "Malware payload (Gozi)", "value": "d7e4375e2952926c3f29753115be681e0f0d1cbb703335eb958d1c0e9e89d0f91a9776a4e822c1aefd72f96a5784baa0", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887479, "uuid": "8ff47f1a-cc8c-44e9-981e-ea73c715909b", "value": "E7437D8172E008B5C7A259303580B7E7BBFD477061F4E04197631ADAAD929A7ED7D30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887479, "uuid": "6373b951-a00b-4784-83e1-f4e3b3079f33", "value": "1536:TW+zYqlalXWu4s5xvXva0Qc1jH7sHzL8mFOPV:V0qlal6Ax60nL7CzgmFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615887479, "uuid": "5bf1636f-77f7-4165-a5b1-e99499aa4dbe", "value": 55808, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615887479, "uuid": "552bdf49-9a86-4f80-a008-84d2eb1b9f6a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887479, "uuid": "a1b4a186-bc4b-40bd-9550-ffcda357dbe2", "value": "9370000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcc8c71-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867481, "uuid": "779e275a-968a-465a-9f78-51cc8c394bf9", "comment": "Malware payload", "value": "bd712f9de5fb81340b4e1eb8b98d35ac", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867481, "uuid": "210ea1c9-56f9-4e39-9144-25223f8a39a8", "comment": "Malware payload", "value": "bbad1214d89fc321edb837f6eedae53d4efec53d3c2ee1b4549f066405a09b16", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867481, "uuid": "9ddc7b2e-a5fe-4c56-bca8-5e902642001e", "comment": "Malware payload", "value": "3396987fc72af34a67b1fbbd49645a36cf324576", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867481, "uuid": "9b8aa5f2-7f28-41aa-826a-693ada4c9666", "comment": "Malware payload", "value": "bf3d01b96ac3b1980711fa70c3a2ef33e6939b2f0eee2a7186c2291de8b23e4c8446c79e98c64b25423a33473ca71bc0", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867481, "uuid": "16e4486b-6fd9-441b-9e62-4c09369c77eb", "value": "76638C5EE210A5B8C379B13C62464CE11D4921579883F51E26B47E49BAEB1C33BEF1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867481, "uuid": "9e0c0c6a-4f39-463a-817c-4d95c53cc717", "value": "1536:RRsD0eH2arAaetudbKHF7Z6V3Jr+W+cK1mDEkTlgNDBm:7sD0eWa8FkdWl1grxTAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867481, "uuid": "5076fd69-d33d-4dd2-a68c-840b5eabe266", "value": 72728, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867481, "uuid": "34ef3025-dee5-40d8-8eef-770254de09f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867481, "uuid": "3fa4c121-0fa2-468f-9896-5f6990a7bc70", "value": "modalita_545.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebe227f-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867432, "uuid": "d2459612-ccb7-4a40-ac9a-1d3dab422ee0", "comment": "Malware payload", "value": "a5d56d427ddd2278212911839ce111e7", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867432, "uuid": "5fa513e6-fbb9-4abc-acb3-454421417d5f", "comment": "Malware payload", "value": "bc6524c175e4c6e13c5d2de1afb43316d3383d9e1905c3e777706015fdb30aac", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867432, "uuid": "13790db8-4b64-4ab4-8df3-c716f9b4f34d", "comment": "Malware payload", "value": "93a2ea761b5d9dcc47844adc9be5f1ed43d93893", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867432, "uuid": "8fc5a48b-63e4-4d70-9789-cfc8a75116a0", "comment": "Malware payload", "value": "b06043c25d472e0b814a11d1629540b0c0d12d478769668851e9e33dfbcae4ad4bf9a04533ac52e837ec9f4941ee7d47", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867432, "uuid": "7f6c69ed-3345-4ea7-bfbc-2e61b489eff4", "value": "9F6302D9F74FD886E8B0F13B8E1C568329CA2278AD3790C452D34C15D3D197BC61EA8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867432, "uuid": "b72787a2-6fff-448d-9346-d2eb40393668", "value": "1536:VSNyvMFD4hm88whtOC5kqGzZNYozzwNWLcvlLLFhDb0:cwUeOxqGzZFCYcvp5xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867432, "uuid": "eb3c76a7-beb3-466b-9c2e-83ac7a647f12", "value": 68170, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867432, "uuid": "9e816bce-18be-4d04-ba77-16e5b2e03b07", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867432, "uuid": "b239e9dd-ddca-483a-bd6c-dbafc987e7a7", "value": "conto_2792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8761824-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1615891554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891554, "uuid": "f9130322-ca96-4d17-bd26-c8cde0b0ca52", "comment": "Malware payload (LimeRAT)", "value": "f120d7885694c8d6b38fc56e19bca614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891554, "uuid": "d260aba0-2892-4576-8fcb-f50a0687964f", "comment": "Malware payload (LimeRAT)", "value": "bce5fbda80f74f265eb7f13f8a7dc5c5d06f121cbdef88ce348f9ac01bdbed03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891554, "uuid": "2a340145-357e-4ef5-a1ce-b52776cbc965", "comment": "Malware payload (LimeRAT)", "value": "15d86767bf271ec71dc9fb49145aceb8e254e092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891554, "uuid": "a45bffca-bf45-4a08-9c8a-480f283b517f", "comment": "Malware payload (LimeRAT)", "value": "fba617ce49a985ca63982d9edf5d5d5f8bcb63dc436d06caedfac3a07a914c91ddd6a6040a361e22d3954f0f79fde3d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891554, "uuid": "81a248a9-cb01-48f4-bb7f-c8bf4325c035", "value": "283505709AECAB0AE03F5335912D010187FAEC47D736D74FA98836EA1EB37019A57617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891554, "uuid": "63f976dd-ee9b-460c-83b8-9969f9e16a01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891554, "uuid": "b4183a68-79ee-45a0-a3f2-c4971e6bf517", "value": "12288:hvEUMfeJ+6tKOaVDWzXv6NOfxzhRqm9azA:ZKu+/OaVDy6lm9azA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891554, "uuid": "07a3324d-e385-426b-ae5b-e984f632b413", "value": 1126080, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891554, "uuid": "29c09a0f-8728-43d3-a1ef-43b54b379afe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891554, "uuid": "6a24cc09-cc07-4013-a66e-6370c7c851ae", "value": "All Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3af561d-864e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615895787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895787, "uuid": "5c84052c-1d8e-464f-a51d-e39135c50ced", "comment": "Malware payload (Formbook)", "value": "52a4602da021d95b924bfe5534d8dd50", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895787, "uuid": "d6bf62e5-77e3-4e6e-a50b-f81658f13318", "comment": "Malware payload (Formbook)", "value": "bd5ca223f31f19c9f72102f04c8dcbc6ef6514aa02fefc0b8a937b16ef55cb3a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895787, "uuid": "159f2bed-a5d4-4c9f-8de9-5a0bd051ef7c", "comment": "Malware payload (Formbook)", "value": "69ace8924d73d722ba772af235fcd78a98821fb3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895787, "uuid": "992f3324-e1d7-47dc-99db-8a9fefa05d25", "comment": "Malware payload (Formbook)", "value": "30ef5dd71db365438150fac889cf574f6414782534ce6ab8ac2dcb24bf32825bbc28deaa371f7a2448bd8f1ce57b4367", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895787, "uuid": "2f16773b-17a8-4755-ba82-5a20fc3bd803", "value": "41357A22E694AB34F07C37368870577192FEAC029622D6BE7C9535CC84B2AD541F3E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895787, "uuid": "4cbf38dd-008e-48ec-b4cf-1efe86bfe9e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895787, "uuid": "6110a2ba-d57c-4d79-a707-deb48c7e65a3", "value": "12288:DoVaoCYxqt/tei9KzJmW1aKAhGdoNDl2Vb6SWn1mVteRnslY081WobFKw:DdexakuKVDWh88DcIYXmslRwZKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615895787, "uuid": "bf62e805-2a6d-483d-acc0-eeb0f4ef98a1", "value": 1108480, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615895787, "uuid": "6937fd91-c907-4ca3-a156-6028f721fcdc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895787, "uuid": "8747b0f7-1402-4786-ae36-dfe422f317e6", "value": "PAYMENT UPDATE.jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b714e6d6-8655-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615898826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898826, "uuid": "ed6164a6-84d3-45d1-bb5c-a148c10b0ab7", "comment": "Malware payload (Dridex)", "value": "cdb5d6cde9bde2bcc8256b4fcca8e055", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898826, "uuid": "cbfd36d7-f98f-4a9d-8ea1-d6aa3701d10e", "comment": "Malware payload (Dridex)", "value": "bfd86e81f98da9c10a7dbcd558e8d187ee7724711142fc1ef9e7f43659295bdf", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898826, "uuid": "3f91918c-9eb8-4cc2-97fb-34843a385811", "comment": "Malware payload (Dridex)", "value": "9b820f27c6c46ab83a116edc156de73b08f63085", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898826, "uuid": "232f4f39-d908-4f44-9bcf-fe2248a3d37e", "comment": "Malware payload (Dridex)", "value": "7f3e89b7256c56e5537f258b338a211fd8b5d7343ea6c76f31495df36799d839f9119b81d3ba80b57c50473b8180234a", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898826, "uuid": "af4d3d89-b796-4c86-9d9b-c1f8096b0edf", "value": "05E2CF96CC07495DC6370078D38D82E0658C3554A07DEA3E7E24E29C0B936D3ABAF6DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898826, "uuid": "43668c49-c6d2-4df2-a084-93e16c21a32a", "value": "384:M/QSxm4ZBf2koeu2UllJBKA73OX3HnTeIsjbUyjPersnvlc54QUSoQ+vbycank:M4yVuleu2iBKAKHHnTeIilUucmuVcak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615898826, "uuid": "d80d4d36-a091-4816-a38c-00c9324a3105", "value": 31290, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615898826, "uuid": "db677fbb-0eee-48dd-a48f-5d0a7a13ff69", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898826, "uuid": "f5fd417d-d9d2-467a-92eb-c142d1d5d97f", "value": "Fattura_82802.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ede966-86b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615939081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939081, "uuid": "a3edeb0d-51cc-40dc-89ac-556892c3d2a2", "comment": "Malware payload", "value": "6d85dd3f941157bfa939175dcd01c496", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939081, "uuid": "56ca4a92-08c5-4701-b3c4-9fa7093bf713", "comment": "Malware payload", "value": "c0120881b80bba96c0259ff50218ffa4679afda9a54b34b7d8145c072ae77287", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939081, "uuid": "4067feca-624e-4d4e-ab9d-c5538fe67b56", "comment": "Malware payload", "value": "b94a8467ebbefaf812ecd5f6579be603543116f6", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939081, "uuid": "aac6a194-5dc0-4608-8219-727c984f973a", "comment": "Malware payload", "value": "9668084095bbc829bf0f7387e527adece1f399d541291d8c723ea968c39e7c01abcdd465d604db495a5a6e54e3538cfe", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939081, "uuid": "f4a9f1de-e60e-4c38-8e5a-46c7d4494e05", "value": "CC01FE37F5E3D6114429C89FEC6E9F89E87000030F6955D1D0C084D79D4088A473C81D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939081, "uuid": "063a5e0d-eb02-4227-aef5-9325a25dc810", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZpAelhyc8brdvkPCEhXfZJN:1IecuEZgNpYcYrdMPGoJCelYcYrdMPHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939081, "uuid": "f263b796-f03a-4e98-8ef1-d39d1397a479", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939081, "uuid": "31bb469d-bcc2-4dd6-ad8f-9a5a589deb3c", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939081, "uuid": "44f7350f-89c4-4f44-a3bd-7a9053614fe1", "value": "detect4.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67480323-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615923174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923174, "uuid": "cf3a55a5-b66e-47e5-a3f4-c9a6ab287e7e", "comment": "Malware payload (RemcosRAT)", "value": "fb1bdf600e46d96af6154d2410d48329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923174, "uuid": "4108e160-8fa4-4776-a6d1-caef1dc04cf0", "comment": "Malware payload (RemcosRAT)", "value": "c059548509d5ca453810776ad5bdea3440fb122b361211616d7300cc3b25fac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923174, "uuid": "72bd7844-54f4-473f-92aa-be306c453887", "comment": "Malware payload (RemcosRAT)", "value": "909838f66686aaa71992ebe759cf1c4d0574adf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923174, "uuid": "c75b8eb3-c6a0-4fd7-b2c3-cc2d096ffb2f", "comment": "Malware payload (RemcosRAT)", "value": "f0c44cb8d0734ee1f9f9727881c14a20db9c17228fdb670d52ac20a477a496aed8b4f288cecb5790e377880657a39465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923174, "uuid": "f409f89d-cd5b-4bf2-bdf7-2c9d007d8466", "value": "F855231226E745B2E5F327315E497BB266FAE3314B5409EB631006173E33AE5CB3C19A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923174, "uuid": "d63535ca-d203-444e-bc35-b163b33b0a77", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923174, "uuid": "c23c359a-792e-4d9b-ab6c-082163295c66", "value": "24576:f53uhFoLhadoqlQNGWp9fVvYD13VNySANzF0U5/B2WM7bCJx27eTlsYJuG:f5+hFMA6qlQfN8VNydNZp5/B2x7b0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923174, "uuid": "9821705b-7429-4250-a921-4ec09174ac1a", "value": 1308812, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923174, "uuid": "fc047f69-ddba-485d-a89c-ab071d3c99e9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923174, "uuid": "270a7aff-9067-41c6-ae4b-1c68f728be55", "value": "fb1bdf600e46d96af6154d2410d48329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1ee700-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615922536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922536, "uuid": "18b3728d-f3f9-48ef-a23d-54958d8570ec", "comment": "Malware payload (GuLoader)", "value": "50779df624494704e7e2d1c2b821a127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922536, "uuid": "bf8b17cb-7029-4b03-b531-6027ff1a70a7", "comment": "Malware payload (GuLoader)", "value": "c169a50f79367c282348c93d99790a6493d0b585030ddcafe770a9cb8eeced87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922536, "uuid": "0d54303c-5f7e-4bbc-b36e-92c87d63bdf2", "comment": "Malware payload (GuLoader)", "value": "85d1fc65665aec97996ef9072e85c881b2e88131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922536, "uuid": "d8751a98-982e-4e49-9710-f7c668e583cc", "comment": "Malware payload (GuLoader)", "value": "9230e9a20cc2d3f86a4db787dca8749fe28d0eb81f361ce963391aef5cf37d8e538a32ef36cd7a7abef3bc380da08a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922536, "uuid": "967dc610-b434-4e6d-8f4a-112307b2ab9e", "value": "D8E35A4332116C7CD6493430040EEA7A3622FCB291519F67B598BE2BE57D6C12DFAF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922536, "uuid": "08a96a3e-6376-4af4-b835-da3ccd6e8196", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922536, "uuid": "319d0b0c-b2d5-4746-8cec-f33ef61dbf4d", "value": "3072:UsBTX38jRuY4OW+G5gnsodMQ+IpxMgToXQBg:PURuY4/+G5gnsodMQ+IpxMgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922536, "uuid": "454b63c6-679c-4251-9960-acc9c0e3e15c", "value": 147456, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922536, "uuid": "a6b5b943-0193-44f2-af75-992640b517fb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922536, "uuid": "f14b4b7a-dab5-4244-aa24-86f65fb744a2", "value": "50779df624494704e7e2d1c2b821a127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb2f44f-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1615890217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890217, "uuid": "13f0bb96-82f6-4d2b-bf49-153f2479d374", "comment": "Malware payload (AZORult)", "value": "3e46b813100b19b478af7a88734f9345", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890217, "uuid": "dd4fa122-6229-4a1f-9164-76865cfe8b57", "comment": "Malware payload (AZORult)", "value": "c1b7b4e979c5273e41de9b274a1fcfdf11dbb796f00de6386ca33811d3afc48c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890217, "uuid": "a2a07b12-c958-458f-bd4a-0b75d0ba5d91", "comment": "Malware payload (AZORult)", "value": "7a2d42a7368bed9d67f58d2dd4088a7bf554b077", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890217, "uuid": "fb623711-3bd8-46a9-9c1b-422b290e24c0", "comment": "Malware payload (AZORult)", "value": "e55fa906a2e2724632325bad8e7e09edc4ce5947d2a051a8981297f7c9f927d09338b2c560bb9ea0284f2581cca04be6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890217, "uuid": "73c888e0-89ea-4132-9a71-11e1177a7332", "value": "C725AD9D3250B6DFC867CD3689A81C64EB60B87B870BD243A05326ED9E5D59BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890217, "uuid": "c2639cf9-4fc4-45a1-bc15-448db27ad895", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890217, "uuid": "a924fbb7-feb4-47ce-969f-b5059ed7deba", "value": "24576:hQqI2eJ2/JUwy+a64m7bKxhBx5v2Sqb6vgBv02TC:B8J0E+xZ+Fv2Sqb6av02T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890217, "uuid": "a19df302-06c8-4ced-8b93-ecb39934efcd", "value": 1024000, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890217, "uuid": "e97321d5-65c4-4b9f-9d32-75fceb3b8ca0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890217, "uuid": "37af32ea-12c8-4fae-8333-cce1f91f62a0", "value": "quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98749704-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615890185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890185, "uuid": "2047520a-1678-4dba-8dc8-6cea41b4a5d1", "comment": "Malware payload (Formbook)", "value": "8537bd6ea074695ff2b95d7b2e38ab63", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890185, "uuid": "ffff61d9-1bdb-46f5-9cfb-56ab7ee949dd", "comment": "Malware payload (Formbook)", "value": "c2d6e5914eb812ee96b4996392e03707376d069c96573104cf5b64e6b1ef7f69", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890185, "uuid": "f21d8e24-6710-42f5-b3b3-6b9617ef81da", "comment": "Malware payload (Formbook)", "value": "611f0de314e7a0535f827b43a030889a8a05a5f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890185, "uuid": "6a6c5f0c-54dc-407d-837b-c8563b9b4b1f", "comment": "Malware payload (Formbook)", "value": "5fa58658c4e6ba9791277d12ce3518dc05fdf513120fca54d04a0924fce9eae16cd8c08f3bc353300abeea5f53f7e2b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890185, "uuid": "9ad95304-75a7-453c-b189-c10894f82a04", "value": "5675F0212688FE51F0BDDB7C046115C017F7AC06EE26FACA7F9933D91A72681467A633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890185, "uuid": "ac7cb7e3-8fa7-4907-94e4-4c3f08dd1d86", "value": "24576:I+9VKqcBR6ajPaQBmQKqWlzyuQxzquJDQ:IcVKqO6yyQefXNuJDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890185, "uuid": "d2c4f752-1a84-4d4d-b4f0-d58a50d1bd90", "value": 1572864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890185, "uuid": "00a70752-a1fc-4a00-9b48-9a921a4245a1", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890185, "uuid": "99e0e7ec-7188-4131-be63-34a2979e5aff", "value": "PO_2536478233.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee50dc35-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615921682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921682, "uuid": "05ef163f-28ef-4c27-910a-4b3ed40b8634", "comment": "Malware payload (TrickBot)", "value": "24b3e1f23f5382ff30cd43ef8fa68ce6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921682, "uuid": "325f27fe-028f-48df-94ae-ab4966801560", "comment": "Malware payload (TrickBot)", "value": "c3674599d872cf73497b4b5171828be5e9cd7da892b1eb54ddfb4593e94587d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921682, "uuid": "6f58bf24-d4a6-41aa-b7ed-b282089564d6", "comment": "Malware payload (TrickBot)", "value": "d0b89092ee86a154a6c4252bd8f3cedb90773a63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921682, "uuid": "d2461911-9959-4a2c-a1b1-2552a637fea7", "comment": "Malware payload (TrickBot)", "value": "b09d9ab120a371e18c182f798a498922203d6040176bd5b3b5ffd8026207f6d28738f7a97b46adeed1a7c96010b1d9c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921682, "uuid": "ccbfe561-8e78-46fb-8278-0c2758a02bf0", "value": "0FE4AE117AE0D071C57E36705416E77852ADE8B06F6D87CB6FC42A3F6E312C29A3835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921682, "uuid": "3d47a2df-ad28-4e91-bc1a-66d3bb27d293", "value": "cae73998be5b008dd1c2d777a562de39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921682, "uuid": "d087a694-6af2-45b5-89f0-0ecda9178d64", "value": "12288:RFq5gJqjDe8jUCYPnXjX/5n85pFb856xaBm6yOD0kVUU2:/0+jXBnApFo6xaM2YkVUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921682, "uuid": "1d026de7-53b5-48cc-8e2a-5c26a16b888f", "value": 690688, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921682, "uuid": "96a593ad-ec51-4c85-ac26-8898f9ede1f5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921682, "uuid": "5f75a23f-92ce-4083-b0dd-9f4fef13ca0e", "value": "24b3e1f23f5382ff30cd43ef8fa68ce6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ce6545-868e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615923112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923112, "uuid": "1d28ab8a-3ee4-4ac3-97d2-9640b036f994", "comment": "Malware payload", "value": "603afc39509ea12acf6ef69b94af3fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923112, "uuid": "4c9f6d89-3a99-470f-8bbf-866933873349", "comment": "Malware payload", "value": "c3b699aaaf2a476cf84ca13efd09ac86e66b501e3baaa5b0ef7cdabc47ee9ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923112, "uuid": "78acd91a-b6c0-4b3f-9d8a-5d3e0570f52d", "comment": "Malware payload", "value": "8690249cb2040c7d32e09d8b84c888f0fd0c736f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923112, "uuid": "21056ec3-1d46-4c3a-b885-f72a78d4e30a", "comment": "Malware payload", "value": "232a6e9786f9f67cb2e61d287b1bb3b23941a9e5017f637033116e63f29f81ff45e36b8d53893848eebb2535e3ff9b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923112, "uuid": "5b36db96-3193-46c9-8f04-4a5a79c4a27d", "value": "AC452321B5DAA1FAD5B236704909BB2668F2F3301B1D41C3B7510613AE7EEE4D77D08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923112, "uuid": "7a531e9b-3adb-4db9-a57e-d1ffb094552a", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923112, "uuid": "2447318a-cd5c-4ed3-8b55-75bac039535d", "value": "24576:a53uhFQfcc0Hsmj2yrU1CcpltZN2P8RUX9FqevjsnKzRz:a5+hFOccWyyrqC8ZNxajJzRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923112, "uuid": "d7a1df15-c64e-49fa-a8d4-3a5d244b480f", "value": 1198682, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923112, "uuid": "adf25205-2bbd-4814-9b38-8a3f39cb1f2b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923112, "uuid": "f16c399c-f350-4e67-a830-2126ca39b031", "value": "603afc39509ea12acf6ef69b94af3fad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b055b02-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615893920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893920, "uuid": "898c5492-6c91-4094-bb17-d748bed51f89", "comment": "Malware payload (Loki)", "value": "63a3ec009884bfbbca8c06f6d7238acc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893920, "uuid": "49ce1c5c-3082-40ec-bcf8-67e4e32beb89", "comment": "Malware payload (Loki)", "value": "c43db818ab202d1a2974cbd98aaee0432f63e5313f845ada8d7f2a19603f0890", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893920, "uuid": "39c99a46-cc93-4477-b94a-48bd8edd5397", "comment": "Malware payload (Loki)", "value": "5d600e3efd81b3c1d6ad777cb82c08081160ef4b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893920, "uuid": "6e5dc36d-f30d-4513-93c5-81b81bd3326c", "comment": "Malware payload (Loki)", "value": "31b1085dda3167aaf6b61c542d039edb89d329e6430f21c6d664710d0d8f277f279c86aaa66b3e5188d06bfb924134bc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893920, "uuid": "f5c1ae17-2dff-4e56-8375-d7e08fcd7c6b", "value": "8F9423E2CDD99D39E60B9DF173CD43A85E28D1941856A1ECE3867C28AB93DC835DF600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893920, "uuid": "fc6e3932-2a4d-4c75-badf-ad6201e7e8da", "value": "12288:f8xQzF4ut4dfk/VpZ2q2s6bHxcQ+fkyjymDajc:ExQzCutofk/XZ7gRc3Z+uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893920, "uuid": "77f5a38d-9341-42ba-9b76-d79a4b8c852f", "value": 440682, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893920, "uuid": "175a1149-e241-452f-9016-73e4752fa29b", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893920, "uuid": "b65cdc27-6525-46cf-9184-bdde78c97de7", "value": "CORRECTED PROFORMA INVOICE#8349.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733746e7-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615893988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893988, "uuid": "2c3dfa7d-6633-4ad1-8765-a684a2803d67", "comment": "Malware payload (Loki)", "value": "e80fee009ab801e6262a640dc715dc4c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893988, "uuid": "6bfd07b6-22ac-45c1-a794-81389d31ca3b", "comment": "Malware payload (Loki)", "value": "c475083d64254f5afb9e1160de1470355daa5968dee32028b44946c89573a333", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893988, "uuid": "b383a723-2288-46ae-ba6c-bdc27989488c", "comment": "Malware payload (Loki)", "value": "656daaad7064aeff0781554b1c74299fcf659c51", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893988, "uuid": "a216cf00-fc5a-4ace-b906-ee87e0966ab1", "comment": "Malware payload (Loki)", "value": "1a8c4eb7460c8cfbc943a25121eba79397f382e6f03a3bfbd7dd2b9ad08d8f7a7540ed1e1802271acfdfa01120c371cc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893988, "uuid": "0592ba63-e23c-4dc0-9927-f6c653540b1c", "value": "43942340A1A6FAA9D3304C39457E448B8742FDA283D99873DE1D33737C0E725BC5639A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893988, "uuid": "c263f9a4-72c5-4271-aa36-bf884aa6ba0f", "value": "12288:dIxMD+yW21+BX/P6mHURsvYN64rR6BZzgEFiWCobZtggE:dCI+yW2oVHhURp6lHcYivoj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893988, "uuid": "26d890fd-271b-4445-8f39-075e85b30cc3", "value": 433550, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893988, "uuid": "dd575c84-3e31-4b53-97c0-84399251a208", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893988, "uuid": "73090ed6-0715-415d-8947-dfd4c51b3a1a", "value": "Shipping Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d437d96-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918030, "uuid": "ce93210b-8a13-4a85-ab63-9e4fd09003d5", "comment": "Malware payload", "value": "e90198328c29398f8cf8188f9f6cd012", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918030, "uuid": "f3135f75-fbc6-42af-9628-4ea1608ebfe2", "comment": "Malware payload", "value": "c4f6006e8f913f56a76a9e6bd453c1725950705469e4b19f76c0b7f63cbe63a1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918030, "uuid": "62faeba7-e955-4d32-b9e1-aaca746a19ef", "comment": "Malware payload", "value": "746c25e52c8476e12388bdab440b89de9ab8533e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918030, "uuid": "3f279318-a98e-4329-8988-3e938f320c20", "comment": "Malware payload", "value": "3288da3e98da34d532f112a9b1d8cabede5240edc038076b9b5090d5ded5f5d2150e92b55f726f18d1bc943c0ea0ba45", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918030, "uuid": "bf0ac418-2927-4cd0-a608-5fd4fefb7f09", "value": "27625C7C9FCC14A5E69FD062DE1ABE7202A3F2D6C7CB5EA6330CF871076A9855A21150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918030, "uuid": "82d3fdc6-98d4-49d4-9491-158d578eb7de", "value": "192:wZzkhZepo6JWIj76KKEEbHPlg111zk8981Es50J1lpPGKX8z2TkNWYge/rmLZ:wZzkveS6H/3cCVp98U1D02oNseTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918030, "uuid": "d28ed50c-247f-426d-a8f0-0c566eb039f2", "value": 15567, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918030, "uuid": "aacfd1ef-a6b6-4744-bbce-c68290271fd6", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918030, "uuid": "3fb1b67a-2f46-4565-8319-05b6daa44d68", "value": "scan-20210316.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe1ca5b-862f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615882601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882601, "uuid": "a4af1c5a-20ec-42c3-94b7-05339ac4d2fc", "comment": "Malware payload", "value": "3ccca9ed30538a6503322fe4711ec5d9", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882601, "uuid": "806041f6-f072-4f29-ace8-b874c0e89c41", "comment": "Malware payload", "value": "c56199a06bcbe85f0770ebf905f285d1c55d669a6fa4ea6f188b788a9f5063d2", "object_relation": "sha256", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882601, "uuid": "d9935568-1f63-4be7-b5da-67c516c30db3", "comment": "Malware payload", "value": "46b5c4ebe65a3a4eabbda183990ee8a7b683d88a", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615882601, "uuid": "f544996d-7d51-4be9-b6b0-1721a19b8f84", "comment": "Malware payload", "value": "63152c3b1bf96979f45a67295455a9a4e41fb33b8812ffb5dd97bc22dad7fbc0822f7df4d5d7bef62dca8467d9b581f9", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882601, "uuid": "6b45602f-d2ff-4a65-b431-310b1627ce06", "value": "8E8312AD706FA802A69D18E0B88CC66B1E25CC7F3DB5BED1C651052F10C82FEB5F5625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882601, "uuid": "e9910ad7-4d5c-43ee-b357-f45e62e8ff79", "value": "1536:veiYTzI8nnQBLx4gEXRTgjuk1a090GdaA9gELSOpt/omyRfdfdxSfX/6vuPV:Gi8LnqW7RuPvMegEL8ffd1xSn6vuPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615882601, "uuid": "723e8b15-3fb8-405f-967e-be428dbd303b", "value": 84586, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615882601, "uuid": "63f0d420-0bdd-4a7f-b7e2-bd84329f3bda", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615882601, "uuid": "6472fb28-b1da-48b2-8881-622a21cfeead", "value": "request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c60c2e-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1615890199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890199, "uuid": "3b4e2cf5-b477-4b5c-b909-b7916cafa603", "comment": "Malware payload (AZORult)", "value": "8c0fee401e7f5da0885db5296a9b58ff", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890199, "uuid": "a4ccc5a2-ff3d-411f-b41c-683392293fcf", "comment": "Malware payload (AZORult)", "value": "c5b84e95c3c5d74359f6dcc6d465f7ab9a4709807c15aa08ed258b1e32f39668", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890199, "uuid": "7de0ae75-e476-4966-932f-215ce71571a0", "comment": "Malware payload (AZORult)", "value": "c955f183d747500ae1211d08e45120089b8423c3", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890199, "uuid": "0813caae-41de-4e5d-97d1-c6c1c355a9d0", "comment": "Malware payload (AZORult)", "value": "f6bbf5b7aee02f0f5b39beedc954232873046057ae468af0630c92ffdd074415f475cf727dcc93bfd5ee670fe93c626e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890199, "uuid": "e92f4a14-8965-4d09-9be4-3156fc8aeae2", "value": "77755A0DBB9DBFAAC62F0F758623845882E4C0A75333F38F79C568D668057698D0F196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890199, "uuid": "e23793df-89e7-4fba-a1e5-d9edc80e7e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890199, "uuid": "1e892397-91d0-4b93-ad23-f164ecb35d45", "value": "24576:A7ip00NoNe3wZmzJKE3Qxu+/OaVI3vqXnBME0dX:gNve3wglp+7K/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890199, "uuid": "36c36f76-f401-40b8-a7d7-75c8ac8d41cf", "value": 1616896, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890199, "uuid": "0c420587-513b-4ff0-a97f-fe1048ba4be6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890199, "uuid": "2b146846-0007-4ad6-96c8-037b5c31a6cc", "value": "Company profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648aed44-86a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615933906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933906, "uuid": "0a13b6cf-6a90-428d-bdc2-b212e45312b6", "comment": "Malware payload", "value": "cc8464ceb9ded19e13dc8a861874cb74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933906, "uuid": "75781342-f2f1-472e-9da6-f0b815055377", "comment": "Malware payload", "value": "c5fa790bdc1b774f3c06c3193204215671cc44a17c42f9dee7648a1e9120b66c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933906, "uuid": "d5ed4218-150b-44ea-bb60-b1ce7e6f0faf", "comment": "Malware payload", "value": "4144167d24144ce768c5608f9244a10aff530d43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615933906, "uuid": "32aacba5-2cb5-4c74-a10f-29c2ab837646", "comment": "Malware payload", "value": "11f472dc19c3b4ca8c096222350b2b4735901905a3d864302637c9984b80373ccff05563d5ac9d7546caad1e2660b9bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933906, "uuid": "b3b3ad56-0979-4363-b870-0e31dbbdd894", "value": "91938219F591D91EC3581A318C8EDEF6A1247D48ADCA632B73A17B7E1E3BF249B01214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933906, "uuid": "4eba6694-8ad8-4964-bb55-c19baef133ac", "value": "768:DfKO70D2wR4RE8vNGs40KuI6VVUutz6P9aHiy0+r4CLJdi1GIRlV:DS80XR4EkG8z6P9Miy0+fYLlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615933906, "uuid": "1622a3ad-78f1-4b7d-a0e6-b8f774976234", "value": 94720, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615933906, "uuid": "b7ceed12-71b8-4a54-ade7-429cde0a2758", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615933906, "uuid": "dcc15deb-b660-43f4-8053-2cbb47fa2347", "value": "SecuriteInfo.com.W97M.DownLoader.5256.959.30585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a527cb-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615884629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884629, "uuid": "2df695d7-50cc-4fe3-8871-fa78742a5004", "comment": "Malware payload (TrickBot)", "value": "71634faf3e5689ba093d6bb8701eb42d", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884629, "uuid": "453a9609-4231-49bc-b15d-cfab45f0beec", "comment": "Malware payload (TrickBot)", "value": "c826f15397da6524595b08d710f4d69a18ea5870c5ef4029b20988987461aeb0", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884629, "uuid": "9cb8e20e-7c14-41fb-9265-377bcdf970c1", "comment": "Malware payload (TrickBot)", "value": "724ec8585766111c8b46c96ef959b1c563e806d3", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884629, "uuid": "7a3795df-b837-4015-93d8-dae38b198321", "comment": "Malware payload (TrickBot)", "value": "0565f77a508fdac0c1cf707265cbc5cb762eb0324b012123d4ccc5f91b5df071e5fadda61209fe89309f33cde43b3ef4", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884629, "uuid": "ef0e846e-9629-4d39-aae3-41ff24b1341f", "value": "B2B4C031FA84484EC4F60BB71CA87FC3E439A79C6F2252A3B96C45AEC7604B15158BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884629, "uuid": "6e9b159f-fcf5-4e4c-a65d-a64af63816bc", "value": "b5c8d37549a784c0c565febea0373025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884629, "uuid": "abeb7dd1-db36-404b-859f-d01e4df4699c", "value": "12288:wKdDJTzq9eCqw/+XVB/FpJBOpury1/veg6l:Rz/Hw/+XnJUuG1/veg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884629, "uuid": "c5061286-89ef-4c86-b315-209fcf5aee77", "value": 505344, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884629, "uuid": "2745e9a6-db15-4bc5-acde-f60168b414c8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884629, "uuid": "224ed7c1-4fca-4a80-981b-f4332a477976", "value": "SecuriteInfo.com.Variant.Cerbu.91867.22195.16933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f6598e-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615889125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889125, "uuid": "d5fd39e4-e134-4ec9-91c3-dfbfebbb7857", "comment": "Malware payload", "value": "a3eb30ba4711ffa2343ace6c0045a5b0", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889125, "uuid": "c682abd1-93a7-4257-9a78-571fc6122fca", "comment": "Malware payload", "value": "c98ede541bfc171afc9f6af6b48f384c680f43492b561c971661b89333ff18a2", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889125, "uuid": "a2743ef2-900d-4f1f-b94f-d9840f2fee30", "comment": "Malware payload", "value": "0fc1c6c9eced7e4d53265d571086081dd281aaed", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889125, "uuid": "e8a000c8-11c8-4681-8898-8592027ffb06", "comment": "Malware payload", "value": "c11dab3d89d201a59fa9c7c7eacff79eab48e8c5bfa7960df219e2d685603db7725d012e861ece20692f16db665dab9d", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889125, "uuid": "5fc653d5-5f49-4aff-9796-56f81f50bb06", "value": "2E33F143D60B9ED4A93AF4B807134F9118992177CDBCB90B1832FACD429A7647F28933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889125, "uuid": "e4fc477f-0d14-4d99-8455-2c39f9c6ad09", "value": "1536:GpxTU3UA9mkdxp+6qRWCHB15pgYZMXMQcYPZDu94Z6DJdU:sxNA9mqp+D8SB1PgTMX2a94ZMJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889125, "uuid": "29bca201-e970-41c1-ae3a-ff5381f7184b", "value": 52442, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889125, "uuid": "4666da81-a11a-413a-8b43-7f838c1b195d", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889125, "uuid": "76bb2edc-ce73-463d-82b2-3a44f53c6f42", "value": "tipo_135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2479b9bb-865c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615901587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901587, "uuid": "24904330-1f63-4c62-b871-021b52565488", "comment": "Malware payload (AgentTesla)", "value": "0e3611c937911177a709f5ffc83672de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901587, "uuid": "ae883658-d572-455d-bada-1f2c009c9c7c", "comment": "Malware payload (AgentTesla)", "value": "c9b11315a65d68d5577ca5b762e4d5d16f660b1ffde12cd5192c9717747a63ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901587, "uuid": "2b1e8050-bab2-4d06-9593-197ac36cbdfc", "comment": "Malware payload (AgentTesla)", "value": "19c37068fb9eaade4091d639b4078b1d21e2aee8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615901587, "uuid": "a58f4046-8d7c-4ace-8825-3ab438f697d1", "comment": "Malware payload (AgentTesla)", "value": "1402476c15a72888e3ef544164600bf674f373f61308d23b322eecbc61db22fb205e419ef84cf1140842990faa64f73c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901587, "uuid": "6abf5825-77c4-47ef-ad17-64523f4a4f9a", "value": "3D358B21E6A4ABB0F03973765432133143FDAD069226E7BD7D4831DA09B5AC585F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901587, "uuid": "338adedb-9e2e-4fa0-930f-f79d05e555bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901587, "uuid": "9d332b99-3c99-49d5-af11-ca45b9dc1657", "value": "12288:HIuTKPhPmTBokXVgTkX8pioBTmF1BqwAO3FDmS1:ShPQlV/X05BOLqoFa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615901587, "uuid": "036c0afe-0232-4257-8766-0dbd41f6c8bf", "value": 1060864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615901587, "uuid": "298fea48-01f9-4791-a80c-3059553ae96b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615901587, "uuid": "06e9a820-0032-4078-8221-c9080bd442dd", "value": "New Enquiry List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5c7e1b-8683-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615918293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918293, "uuid": "340a0472-4eb3-49ce-ac01-7035eeb2920b", "comment": "Malware payload (RedLineStealer)", "value": "a291fd4b6985343cc9c2a00098c5b7f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918293, "uuid": "ca279539-1122-42eb-927d-ea4ae802014c", "comment": "Malware payload (RedLineStealer)", "value": "ca3f25030ff8f3c92d29caa22bae001d1d795a0ea2289cae3074679d86341b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918293, "uuid": "4fe77313-abfd-46e0-ba53-35dc2a0d2301", "comment": "Malware payload (RedLineStealer)", "value": "64e1f9d0324a9c70570c67c670af299ca941979d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918293, "uuid": "d10d8c5f-95c2-4e05-b6af-348c5170e1da", "comment": "Malware payload (RedLineStealer)", "value": "3e864ff9d5954439eca37e74a290c13b5e1d018f8f7c5205e1e8ccee58d398055e606dbcc249adda40a8ad689e15ec7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918293, "uuid": "d534a394-6f98-4567-a613-c6b551b08eaa", "value": "A363FA31EA12D039E4E100B593ABCBF8B4286531539D50C7B3C47F971A647DEAD32A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918293, "uuid": "14d76c2e-f15a-4d17-9dfc-4805eaf0bf58", "value": "1536:5BMABXaYpbe99RrGEeq7nqPkczODPwMs6CYxNRyk:PMwlbe9brGEecVDPlLrTRyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918293, "uuid": "35ea684a-8168-44ad-8d4e-3909a551da69", "value": 67584, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918293, "uuid": "4e3d8d45-d9c1-499a-878a-44a73daf62a9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918293, "uuid": "31d73891-e79d-4140-83f0-5a026bc433b3", "value": "a291fd4b6985343cc9c2a00098c5b7f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a172a79-8629-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615879880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879880, "uuid": "1756b503-5b90-418c-8f5b-d14726290c1f", "comment": "Malware payload", "value": "14a212bf4899de37a696c24a0372475d", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879880, "uuid": "1b97984f-5a8f-43b1-b7df-a3ef9b568d0f", "comment": "Malware payload", "value": "cb1fe079f0384c18090d6c6912a5c7117e284ea9a84d450828407fc5dc779be5", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879880, "uuid": "e44c88aa-3265-4483-adc6-ef3d3b98c218", "comment": "Malware payload", "value": "089faa9bfe0a1e50664ce9dddf331703eda5eef5", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615879880, "uuid": "4e54ed2b-fdef-4575-a96e-151b1fef78af", "comment": "Malware payload", "value": "1458f613521b10f96bc081d01353910b9334ca1324acc5e453acebe52be34b0e71a7660eb0a620f7fb8c8ac64252cd3c", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879880, "uuid": "70a16050-72dc-42fe-94bf-96ee840207e8", "value": "0133027C7B2C41368B8A11835C809686D2FA7FB9E1459DA84139C3B722395C98E94EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879880, "uuid": "8664dc0e-b7ec-45c6-af37-08b203d8fb76", "value": "768:NB8Qd8mDJ9YPkguKw2YhAVGeWsVR+B1eaez88EotV5I6cy0xmfwBnPzo8T7ndWxG:XtPuk9KwaKQ8mAcI6R/fS8x+gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615879880, "uuid": "5c852766-dad0-41f5-990d-7c64e3ef8690", "value": 54246, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615879880, "uuid": "509e2769-1891-46cc-938a-cfb70edb4bb9", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615879880, "uuid": "ca4eb78f-1d8a-43d3-a965-c1bffe01a735", "value": "dettagli_1976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d49c969-8690-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615924123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924123, "uuid": "fea52ab0-bbd6-4a7b-a772-a964241790fe", "comment": "Malware payload (TrickBot)", "value": "3a35cdd69dbafa00b86e274c03444a49", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924123, "uuid": "5a0839ff-2e75-4285-9361-a250d538226a", "comment": "Malware payload (TrickBot)", "value": "cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924123, "uuid": "87fb89d7-4b30-436c-b75b-aa32a2d7e96e", "comment": "Malware payload (TrickBot)", "value": "f0fcb980a3d13b3aae0c6059e9a83a700af72978", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615924123, "uuid": "1b2de1e4-4208-46a8-854b-f03a1e54cf00", "comment": "Malware payload (TrickBot)", "value": "06461f9737983e5dacbf60e05d43498089cc970ec383e23637ade796689a53fa72a4a0cdf09951754a17b3491ae07ae3", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924123, "uuid": "5b2cd72a-86c4-4b2a-a86a-bc7f80e9c8db", "value": "81D4DF5275E1C075CAEE07301A699B3463FDFD505E71C18BF782BBAC5D339418A2AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924123, "uuid": "7982c73f-f9ab-4141-a670-2065a83a9eba", "value": "3bf893761e37a67bd8b3cc12a37692d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924123, "uuid": "37648b33-524f-4f2c-a0f5-fc78fab5e04c", "value": "6144:CdVreYRzK1L7g+3BCebsL5utzT1lTWYYgGcnbAPp5yTlPMie3uuK5pUXk/:CPBCL7NgewKZlqyAhoTxMie3Zu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615924123, "uuid": "5bb2a536-e6da-4653-b68a-9217ca5c8a6f", "value": 622592, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615924123, "uuid": "bda81c1a-3887-461e-8396-5be0db7bb3e5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615924123, "uuid": "bdcb0b20-0360-475a-9e7f-e3b019007cea", "value": "SecuriteInfo.com.ML.PE-A.2715.22369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48f627a-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615922042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922042, "uuid": "9b4d1ea2-19dc-4a56-9a00-181e3f394d31", "comment": "Malware payload (Loki)", "value": "1563d9fbbaaf735217201b3a9514ae6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922042, "uuid": "a757291b-16a3-4a72-8b7a-d9ed49f01593", "comment": "Malware payload (Loki)", "value": "cbd36ecbe74b167ba71470da24c3f16961e22f6f41c436c9d1d53fa81335e968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922042, "uuid": "997091a2-15a6-42ef-96b7-4aea1eb78699", "comment": "Malware payload (Loki)", "value": "28a54c62926fcaa99d6a6d44f87f9d64046b7db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922042, "uuid": "37416799-2b0c-42d4-8d7b-e1d3791496d4", "comment": "Malware payload (Loki)", "value": "140c4cfb986c05679d8f530e0b5822fcc981004c2d95c37d3a0e1443ebd705d793c43c4315fb7e2b881d09d6287ce98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922042, "uuid": "7f25f065-bd73-4e2d-81a7-d410247c0466", "value": "5FD4E13D4258AFF3DA6D50B88C63A21087F182972B61F78D3DC461E916C7B1E0F51AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922042, "uuid": "a86ae3fd-62d4-4c13-b905-8c1de92fdd33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922042, "uuid": "cdd7d0fe-4c33-4f75-b57f-f314f8eb22c1", "value": "12288:NRHks/mMY8goqdpA0X/QxRTIYqPHqBAc7XUJJ:zkp8/sA0XOIYq/qBx7XOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922042, "uuid": "23da2cdd-b8c8-43b0-b9b3-64b92fc78a23", "value": 642048, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922042, "uuid": "809acb00-13af-4856-ba17-0633e3d1bf56", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922042, "uuid": "6ecc6ec8-854e-4cce-8bca-1607dd703f10", "value": "1563d9fbbaaf735217201b3a9514ae6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeeaf9e-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615889115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889115, "uuid": "e0cc62db-1541-4d1e-a592-6f96ca72af41", "comment": "Malware payload", "value": "7cdbd3ca25037a12c6ec3f38dfc4833e", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889115, "uuid": "d19ca5e6-1344-4ada-accc-88efef35aca5", "comment": "Malware payload", "value": "cbec2b40fb13c8f78b0e87af9e691f0227a853617d3b816539e2bf28c6b25425", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889115, "uuid": "a4d39bdf-4a37-4352-8050-b6e089ba4518", "comment": "Malware payload", "value": "92dcb3f314aabfcd234965d7b1244850e4a2c90a", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889115, "uuid": "48e88905-1ea4-4a7b-8d60-51513ce81ddb", "comment": "Malware payload", "value": "9bfd0a1e39572926eaeb84e1b9753c40f7be23852118e9de944738730bbebe6e4f35c5b071e905b06393d22d6816947d", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889115, "uuid": "dfaf95cc-609f-4030-84bc-d00c226091f0", "value": "2643CF5E59547869C23B797C560A14D15A0E20AB7C82F82F3AF4FF1437DA0C327AF968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889115, "uuid": "adb35fa4-dbbe-4ae0-9d98-964b47230668", "value": "768:fit0S7gs4pe2tqIPU5R/Mg7feA3xsHhWPSh6FrLue7qyBPP54ZY4abcQr2OWNyTt:fi72vtWGgvxe6rLV7BBPa90v2Ty2d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889115, "uuid": "c903b09a-5d9a-4934-8e3d-2b5adf0add2c", "value": 60502, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889115, "uuid": "acb227cd-dbac-4cde-bae0-6d6c6f4a2a9b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889115, "uuid": "44b08bf9-d5fb-454e-8f46-289d005185be", "value": "tipo_135.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ed5593-8688-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615920752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920752, "uuid": "e7c4efcf-b2b0-44db-bfe9-8cecf4b7ae20", "comment": "Malware payload (AgentTesla)", "value": "fcf267c5a024af4a880c33317eaa5432", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920752, "uuid": "1c5035a4-6d31-48e4-bdf0-d558c7f5c9f3", "comment": "Malware payload (AgentTesla)", "value": "cf0f9462ba658c843a0487fc3480a46395d317808b190ce54167a0a8e2ded7a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920752, "uuid": "3872ec3f-c145-4bd8-b374-d5d2a0637a60", "comment": "Malware payload (AgentTesla)", "value": "e91854c61a77913a2b73c5e70c63814cecc03eda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920752, "uuid": "16b5ece1-db04-4c15-adbe-ce080ad5986b", "comment": "Malware payload (AgentTesla)", "value": "411dfa0abe9764100f3d0d39fd3565496a92c719555d069ebbeafed96892081d2dc4b6bb4e6c8542a5d0161eee2a95e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920752, "uuid": "b7b6a7d4-d974-4216-8bd9-bffb57568698", "value": "0415C0302AE95619F17BAF794AE470959BFFF6237706D41D2CA103C60713E41CE92A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920752, "uuid": "af77a890-694e-4d4b-9d64-9559ffcfe0de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920752, "uuid": "41f45563-1af5-4df4-aa3c-4be414bea635", "value": "12288:Q1vgP7wNvG4bkaDv/JP2EcwdiH6gZlrBngZKqHqlNiliIDkEltmdTozW6ESajWiK:O6tZlNgrHsfItltmdQWVbJOtYeSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615920752, "uuid": "2b83899a-9421-4a59-b228-d0a8fca23de1", "value": 888320, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615920752, "uuid": "432e57cc-9497-44f5-8024-539a12c6dd7a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920752, "uuid": "6ac48b10-4631-49b3-b653-3601ed23d4b8", "value": "fcf267c5a024af4a880c33317eaa5432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad4be72-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615884632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884632, "uuid": "068b878c-fdd1-4892-b0e6-169c7eb6aaaf", "comment": "Malware payload (TrickBot)", "value": "955a8fad4b34c808afa21c1c8692891d", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884632, "uuid": "b3ff4523-f048-4fde-a94b-e6750d830e6d", "comment": "Malware payload (TrickBot)", "value": "cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884632, "uuid": "86a7ca76-95bc-44dd-b970-5fb116ea2f3c", "comment": "Malware payload (TrickBot)", "value": "63ca8b7553b4fd19d9ad9fbe5199656d223a93f2", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884632, "uuid": "a54bbcc0-2ca7-46a3-9fc8-2b2e5388d3db", "comment": "Malware payload (TrickBot)", "value": "2fb08b477dff506b0ca00373a7f31f1046b50c42f9d820f912b075bfb4caba1c98526ed299c8e012a1e44dcaa57e3b6a", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884632, "uuid": "4943184c-05d3-4a5f-a380-d0d3454c566a", "value": "4EC4DF31F5984426D4F96E3358B0FFC3D63DA35C9F211A97326C0AAD8B244E09A76B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884632, "uuid": "8b35bb11-f2d9-4eba-9a99-113ee77750fa", "value": "882620d0d6df83ec090498c41ffd5fb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884632, "uuid": "c11af917-b84d-42f1-a1cd-abcbc08de4d7", "value": "12288:sQOIVKgB7z01G3yfoQ0ANqxy9Fx/C3meRdksUQ:m9W08u0x8x/C35/ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884632, "uuid": "9865daeb-af8c-4075-965b-b59de7228cf6", "value": 559104, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884632, "uuid": "5d4ac6d9-cce3-4783-9a8b-0e11f1459588", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884632, "uuid": "98790d10-bb66-4ae0-be49-ea7a25853340", "value": "SecuriteInfo.com.Variant.Razy.848795.10426.24069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b930b12-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615893895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893895, "uuid": "d9c5b3a5-40ea-4f9e-a729-4bbed67be4a9", "comment": "Malware payload (Formbook)", "value": "fdac4ffbe8fdbd1c8c543f7c99ca5bbb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893895, "uuid": "86070a76-a41b-404c-ba00-d109a28e6ea3", "comment": "Malware payload (Formbook)", "value": "cff20b43e7c12b27611bb33a9b77357af443ede89860134e43d48095949abd15", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893895, "uuid": "74d82203-74ec-4b84-99e0-2b3440aa3cda", "comment": "Malware payload (Formbook)", "value": "e43af42e1be3d59d93f614790dc9d09dcc243bfd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893895, "uuid": "158fdb78-2a7b-4435-8d56-07596e43874a", "comment": "Malware payload (Formbook)", "value": "c7079b10ae66a0ebd4471468bb94d992ab841e070bf8ec4285cfd142b072fb13367901f6336a9fbf82f4e66598d85f06", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893895, "uuid": "5c286648-c2f1-4c8d-83d0-263264902987", "value": "77054A21F6F48432D3531938F817A2A97D16AEF11B1A69F736987D4C4B38ED3E434262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893895, "uuid": "35be74cd-7a56-472a-8922-5aee6a7356c0", "value": "6bf7d0ce52df1f675ebcc54d87bee2d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893895, "uuid": "84139c40-1608-41d8-8f8d-e8dd33b3d386", "value": "12288:GPx8AiN9H9Ouul5AGEj46EW8JYQ4QMd27QqElWU9V5yr+vPlA:AqAij9O5fEj4WWYQN8GIn1yr+vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893895, "uuid": "cc539ba3-c1bf-4335-9511-0f0fd35e1164", "value": 845312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893895, "uuid": "9e805091-7b9f-4865-96b7-10e6a71322e2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893895, "uuid": "d809182f-da7f-4981-9529-9d52d98b7728", "value": "Scan_9387267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad0f842-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906939, "uuid": "fea3ab4b-2243-4916-9cd2-7d8f34e08716", "comment": "Malware payload (AgentTesla)", "value": "3d0103fd43df65921b569bb06ff71a21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906939, "uuid": "c5c8e1b6-8a6a-48b2-8b7f-8cebcd8f2c08", "comment": "Malware payload (AgentTesla)", "value": "d109079330a4ac9070598c686a9a1ee1b880d9203dac4e871e3f184e7cc00484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906939, "uuid": "15a3a275-c249-41af-9697-1381906feb37", "comment": "Malware payload (AgentTesla)", "value": "5dd6709405fc67ece13c2f5a124711184fbd2b32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906939, "uuid": "76fd1a08-e86e-421a-8282-9b3353e4d292", "comment": "Malware payload (AgentTesla)", "value": "77cec88273eaf1d53b32301707393a66625dd1ec7e9bcbaf8083de4cd5b5dffd32d5d95b51b0afe5d3e2bf6b4cd6022a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906939, "uuid": "9fd4e0bb-3475-46df-b3e5-2f5cf1b130f7", "value": "B535F11736DCD6E2D03D47780C21F21C13B57C11A606DE0A7D96B69E1A32A8296F7A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906939, "uuid": "ba5e47d6-843e-4b14-859c-b464c987bef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906939, "uuid": "44beb323-d543-4916-ba82-71dc02d48d9d", "value": "24576:uiQgaLf5TooOlgoUzSo1S6DudwVel1PM+fNxxEThT:ZQgUf5XBbSsS6D4wY5/fxGhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906939, "uuid": "dab70262-4fac-49b6-83c7-ee5bfa90ef0d", "value": 1071616, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906939, "uuid": "4e51f4d6-b4b8-473b-a695-efbb5710d6f2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906939, "uuid": "5373d795-be44-48ea-95ad-a1fb9e4bf82a", "value": "Purchase Order copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f2e46a-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615922926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922926, "uuid": "3a32a53c-27af-4d32-9f09-43534c5c0593", "comment": "Malware payload", "value": "1514dbb232830019a54bd6b18459c560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922926, "uuid": "87a07cd4-3291-4163-9895-abb82c711fd9", "comment": "Malware payload", "value": "d1597e584fec8eb356aa5c831045b2ce68531e69fe70436fa3ca0d8dd1d90ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922926, "uuid": "60b7906b-e3e9-4da0-b8cf-b4d84e48f920", "comment": "Malware payload", "value": "17f3bd295c04f2488b9689af427f0b0fcf2e435e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922926, "uuid": "66d37a14-4b9d-408c-b6b9-8e2725f22cb2", "comment": "Malware payload", "value": "bec05b419895772130bd162b454647915006b3a4c71ed4efffc4d4b38ca13d11766a7788f5519296b1b8370a3895e557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922926, "uuid": "d38962e3-341a-4ce9-adbb-f326e108dc79", "value": "2F4633605A8312B0E6E37331991ED1EB24773C31AD69741C31772AA8AD2E13177B6BDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922926, "uuid": "e6e9909c-1a9c-4c46-bebb-b276a57b35eb", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922926, "uuid": "a8b486b5-7ef1-43eb-b8b8-c9c91272e6aa", "value": "98304:ZB6ZrUlCzP58htFkYu+fPkdqdV9zXJK7zsYx4VQU0G+WEJgueQ79KObDSfp:j6ZrUSR8htFlkI3lZxGGSeCF+fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922926, "uuid": "9baf8401-6087-422d-b7bc-524f61d1d0f4", "value": 5552860, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922926, "uuid": "c1a98e46-9f2e-4585-9a70-62150b0c98ee", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922926, "uuid": "f6084018-bf44-4885-9a58-53244eedfab7", "value": "1514dbb232830019a54bd6b18459c560.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f9583e-8654-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615898254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898254, "uuid": "f170031d-f8ac-48c6-b2ac-e5f93e9012dc", "comment": "Malware payload (Dridex)", "value": "ce38d32059dfcc29f003485640af2934", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898254, "uuid": "27f5600c-9f17-4397-940e-54917559fe67", "comment": "Malware payload (Dridex)", "value": "d1ec9235c6959f76845e0137f12f1059503fb5881c9bf75ef7295136b204108c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898254, "uuid": "3501bd62-6cb7-49ec-9552-3e5938f788f2", "comment": "Malware payload (Dridex)", "value": "60e64a4cd4b5cdf122b590c639e2624407434c3a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615898254, "uuid": "f83d8ca2-7cb0-4fc6-b363-9c7659d14eae", "comment": "Malware payload (Dridex)", "value": "006bf1afeba358d3de5806f407eecde2e1ed1c144d46a327eb550d7911b34312b0a554ecaecaa3609666c47951757eef", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898254, "uuid": "cceccb7a-95d1-47cc-916f-8b8183731c48", "value": "5914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898254, "uuid": "8a3f9948-eb05-470e-94df-9100d43d72cb", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898254, "uuid": "b0d2fe81-d266-41c4-bfef-23603d70c1c4", "value": "3072:01i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:gi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615898254, "uuid": "3ed3216f-3383-466e-af07-03930dc88b5b", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615898254, "uuid": "f9e44631-26e6-4c67-83bb-3972cd47b2c7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615898254, "uuid": "642d736b-7240-48f0-98ba-79b42ef28d1a", "value": "d1ec9235c6959f76845e0137f12f1059503fb5881c9bf75ef7295136b204108c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62d6f3c-867f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615916864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916864, "uuid": "6e987d73-417b-4884-9c78-7c275ef59471", "comment": "Malware payload (Dridex)", "value": "03f083ab8c3349894d33c92e795215d5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916864, "uuid": "1f7685cc-f5ad-4be8-80ec-2ba0ca5b8809", "comment": "Malware payload (Dridex)", "value": "d2bb4b0580955dd9bfcb8f534c605cae4cb5136212730d97bf672dc49ab52c82", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916864, "uuid": "01149a2b-bb39-40fc-8fa4-5432172d2a28", "comment": "Malware payload (Dridex)", "value": "6a7838f8970b28f511718fd0324a578bb6ee907c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615916864, "uuid": "faf41085-f71b-477c-b439-833bbb53133a", "comment": "Malware payload (Dridex)", "value": "aab689108c9b0045da289077da63e3bea12190de937b0a4d50e47cc864525cbbbaac86ff99ed6809d7606a14bd734fb5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916864, "uuid": "0f073a37-e626-4c18-8149-a9cfd1239daf", "value": "CD14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916864, "uuid": "d0c399b7-01bd-4ae9-9e33-fd54137f667a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916864, "uuid": "f55b5951-4fb2-45b5-8747-c39bffcf5fda", "value": "3072:m1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615916864, "uuid": "4285fe9b-d019-4868-8119-f3fd0671abf3", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615916864, "uuid": "790fcbf8-55b1-4db2-b07b-9320a8cd5d8e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615916864, "uuid": "44644055-c3cb-4f7e-8017-ef42958a085a", "value": "d2bb4b0580955dd9bfcb8f534c605cae4cb5136212730d97bf672dc49ab52c82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6947c53-8686-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615919871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919871, "uuid": "fdae3c59-4cee-4963-bdf1-871ba6c93676", "comment": "Malware payload (Dridex)", "value": "f0237363b264e396cbae782ec4bdd8c3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919871, "uuid": "f722acfd-9f56-4e01-8928-c1775dc0670e", "comment": "Malware payload (Dridex)", "value": "d3c0fddaf43d46885f994f7a34d19858b0ee6f22d4c4f67a7355ddfd98029475", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919871, "uuid": "8dfb67ae-2daa-46fb-b9c7-334d81e2b578", "comment": "Malware payload (Dridex)", "value": "bd9cc34de6ff0ffd2fa0c9862fd49c2c3c158d9a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919871, "uuid": "19f50d2a-6826-4148-98f8-61ebeb672b17", "comment": "Malware payload (Dridex)", "value": "636351973096ceb2045bf7991444c161fe4b2dd7cca854a31dc691fbffcdecc65106741e6143071449bc9ff3a482820a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919871, "uuid": "6766cde5-ea90-48fa-bbac-f8ba0ed67df0", "value": "9914BE2DD736EA9BF7F3DEF21420272A59676D61117B918D6AC224BF82BF90C006C14C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919871, "uuid": "2faa453b-7421-4bcb-b11c-4b2deaf74545", "value": "f51e8df6bd6c2af7857cce5930a68887", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919871, "uuid": "6cb47462-8454-459a-a735-bf7d304d36f2", "value": "3072:Of/CNh6hxzkBkRCnNo0zLv71FGYH9bTBoXRVBGLlgQPx:Of6ixID1FGYdvBoXBGLmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615919871, "uuid": "c4567717-2a92-441f-b963-5a5616bf0197", "value": 204800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615919871, "uuid": "f006acc8-04a0-4c57-8667-ae2370291172", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919871, "uuid": "535a3e6c-04e9-4157-ad22-5c023771daa1", "value": "d3c0fddaf43d46885f994f7a34d19858b0ee6f22d4c4f67a7355ddfd98029475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98f93ad-8622-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615876899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876899, "uuid": "da0fa850-077e-4155-bf23-2f061d5f1a06", "comment": "Malware payload", "value": "e36b7c5a805a92444fec9cca6c6117a6", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876899, "uuid": "343ecae2-fd46-41db-94a8-bba969e03604", "comment": "Malware payload", "value": "d4025547a695709d0bf70ec34a2d920ffa8c0f02717728700a4db8bbcbc57d57", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876899, "uuid": "b468bc14-4106-4c6d-9ba7-3464c3f2d006", "comment": "Malware payload", "value": "b102ef42d9d58f5fbc483a2f279df0750d458e4f", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876899, "uuid": "5b13ce16-ba8e-440d-bc14-ca1549861baf", "comment": "Malware payload", "value": "88d705ad707ae38351da2b84b76b43a6e90c73d07a4cac6a98606197a11153fd62044205e94c529d58d90dffb222996a", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876899, "uuid": "3a0b30be-bc31-4c67-be8d-e9e6b6c372b3", "value": "5163128A4EEA7D38CD875C4E36311707EF949C6E992448369D2F80857F23C5E4AA24B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876899, "uuid": "188fbe90-55d3-4663-842d-d4b7e2b438ec", "value": "1536:lXE19p1Udd6MIAMnlQUkjz/cy56Axvlv4wJTJ/hXDPkVJ:hE1ZUdQAMnSUk/uANlLJN/BPaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876899, "uuid": "7eae20a8-58ff-40ef-b3b0-b13f648f9ba0", "value": 71694, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876899, "uuid": "4c6b3ea2-12ea-48b5-96ad-de7ff41d0232", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876899, "uuid": "d337bb82-4ad9-4f63-8708-cf6310bc00c4", "value": "notif_2859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd390f3-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ServHelper)", "timestamp": 1615921812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921812, "uuid": "47d8ef05-5394-495d-b50d-a40835ddcc15", "comment": "Malware payload (ServHelper)", "value": "9a0215081854f8e55149f4255b36278d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921812, "uuid": "75588d2b-d6e2-4656-ae93-03bf1255b654", "comment": "Malware payload (ServHelper)", "value": "d53c9d7349bdbee8f73709c263cb08c2ca721365bb0670993b81fe2fd9200bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921812, "uuid": "0d899d7b-9b08-48f5-9729-7427094a4fef", "comment": "Malware payload (ServHelper)", "value": "fd4575dc03089e7825d31c55159ec97d767c07ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921812, "uuid": "8766bb40-75a1-4c86-a122-67ba208bb846", "comment": "Malware payload (ServHelper)", "value": "0b8c468a80ef06ec8f61c49917b953f133c6f24774a906111d1f7c0fb38e09f2d66d0ac76022c1269af677a16c7b5a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921812, "uuid": "5d006207-1f1d-4005-adae-0a7997f5e95e", "value": "0756E012BCD204FAC5BAE17085569362BA713C7487323BD71E84B66A1AB5FD42F3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921812, "uuid": "61fb3e55-2895-4029-bb89-2a328df58297", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921812, "uuid": "a38b1a02-6ad3-41a0-aed7-037cb23db721", "value": "49152:WrrSKXMLQnrYo95p5GwYhPIzStgmhF0CIUW1Rira6CKkHihFDqZX52YFy8aVut7x:AXMLQns0aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921812, "uuid": "077885d3-3138-4115-a3c0-e9bdcc6cf2ed", "value": 6347264, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921812, "uuid": "350b6350-b6b1-45fc-98ab-0f6459273c0c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921812, "uuid": "afcd3093-f52a-4ae0-ac72-5d2840113937", "value": "9a0215081854f8e55149f4255b36278d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcd00a5-8658-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615900176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900176, "uuid": "c5e7cc07-fcc0-4da3-9ac9-b867231e15c2", "comment": "Malware payload (AgentTesla)", "value": "f0bbb85804a6759fe665b2482b6d083e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900176, "uuid": "2c5c9acb-5b13-40de-9318-38453016d004", "comment": "Malware payload (AgentTesla)", "value": "d60076d9ebcd69f0403422ebb01bf2df5faa59ce3fe2596b76ba0868ec666549", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900176, "uuid": "fc3e8684-7fa5-489a-8f96-944384573941", "comment": "Malware payload (AgentTesla)", "value": "0eba1c2a8877c96b1cda52a11ab2066124663e19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900176, "uuid": "0671fc11-dfc2-4828-9e36-e018ba4f65ae", "comment": "Malware payload (AgentTesla)", "value": "f6a81029448942c7323f51d7a0c7953f8ed87273bbfea800796d07322d8d638773f72d145afb3701fcf0968b3ea10603", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900176, "uuid": "7504ca1c-52e0-4144-9021-1b5fa19c9ed7", "value": "42631803BA89CA43F1254A75FD83C999772A7D08ED02A6AF325D3FAE7F341614D05226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900176, "uuid": "ddd18959-5fb0-401c-b809-eb894d8232d9", "value": "768:9xzHY9aaaaaaawJoH0aKsCTo5FORNBSwnWwwa1j/qWR03os7H/33kH6J:9xzHUyUaKsCToyzBTpqyLs7/3kH6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900176, "uuid": "e457f101-87ae-4a54-a60e-557f3280aa03", "value": 70656, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900176, "uuid": "be80a4e4-aa1d-4d3a-ba0c-25e8148ab3fd", "value": "application/msword", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900176, "uuid": "a4dcaf00-e6e3-4284-8637-78b8bd0f7c1c", "value": "Purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8914a3-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (ServHelper)", "timestamp": 1615922943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922943, "uuid": "73526391-e3a0-488d-acdc-f36ddbdd6194", "comment": "Malware payload (ServHelper)", "value": "83027abc024bf66f7fb1daedb3bf8ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922943, "uuid": "b69e8713-a420-4be5-896b-680b269bc424", "comment": "Malware payload (ServHelper)", "value": "d6372afdd18503ab17f18ebec05254727c7a0377d425bc74e4ae12ffe6243c4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922943, "uuid": "ace8ae74-2337-41ad-935b-161ae5faedd0", "comment": "Malware payload (ServHelper)", "value": "aaa73f754270d848ac16f790c2b5e4018a158bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922943, "uuid": "52fc0858-964b-4724-ae8f-a6b754485177", "comment": "Malware payload (ServHelper)", "value": "a8c81d8a0ba6c73e5e4ff30044f186c2905810561ffa252944b587d4fb229eefb6990afb72a43ee5f26ad8373b556253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922943, "uuid": "06ba51eb-eb58-4226-b3ce-8c6841c6102d", "value": "7D56E012BCD204FAC1BAE17085569361BA723C6587323BD32F947A6A1AB5FD42F3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922943, "uuid": "ec829601-1334-4cee-945d-a1816951e7a3", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922943, "uuid": "f1da68e3-8888-4b07-9875-02f4a644c089", "value": "49152:YuEIjXaBqQ0eiD1mUp5uL6E6z3LrvWhA610W4qfj3RPsr27MqMG6dGNdpZ+pByjE:3XawQ01kiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922943, "uuid": "385f800f-a680-41ae-8c8a-1c99723bfa69", "value": 6347264, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922943, "uuid": "a8e651d5-ac98-4adb-ba2f-576ade0d39e0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922943, "uuid": "c4c21ed9-9ec8-484e-8e0d-ff90cb605d88", "value": "83027abc024bf66f7fb1daedb3bf8ea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd043bbb-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1615918271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918271, "uuid": "7a731248-4d3c-473a-bb88-1ec6509c1c2a", "comment": "Malware payload (ArkeiStealer)", "value": "4c7c0133a1e7543e5e7cc1db521fe07e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918271, "uuid": "0062cf2f-cc99-4fbd-ac72-2ccdbb22af27", "comment": "Malware payload (ArkeiStealer)", "value": "d679fb2bc435b228ddaafd947f6be943c0a45c9bd949af04f2c4231e2e2052cd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918271, "uuid": "c95bc9a6-e6e4-493a-b919-c11266fc34f3", "comment": "Malware payload (ArkeiStealer)", "value": "63723cbdc017e9b7e5baebaeabe4784cd19dd1b2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918271, "uuid": "a4754396-bbab-4e31-bf04-a16e2ff95c1c", "comment": "Malware payload (ArkeiStealer)", "value": "b13b161f52a6c0fb255b6fc416a71bc61082ae9699e4fd06544679443176cb50182c03c3a77f54ea44204fda94dbb8d4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918271, "uuid": "d49f8f67-2927-4fba-98c0-f31865f76790", "value": "4ED4E031E7B0C039F5B3057645B682B4B9397A31573885CFA2C0269F5A386E5EC32B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918271, "uuid": "8671bace-862d-4d55-baea-4a8c07d2f98b", "value": "4b91c14eb0915fdca34ac1a2852aef0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918271, "uuid": "cffeeddc-d62d-49af-b81f-3e344a83e781", "value": "12288:WVLXk1snzr8hKethJ89xbiWK6unYXIVHvxFCDuYnBC2qYpcFSMMMMiMM891D:WV7nPMtwyWK6oJ3qxzBMMMMiMMq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918271, "uuid": "72f2d38a-b1bc-4823-9492-300b2ad10fe1", "value": 652288, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918271, "uuid": "859dc454-2a9a-4f3d-a89e-ffe0833b7e4d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918271, "uuid": "73a88ca9-d7f6-424f-9490-1e9f20bc73a3", "value": "4c7c0133a1e7543e5e7cc1db521fe07e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba945b6-8620-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615875936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875936, "uuid": "40140161-a03a-4657-aa83-f6d63059c307", "comment": "Malware payload (Dridex)", "value": "e14bcb5172d9380f65cbb19130ea53ed", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875936, "uuid": "897e2072-ae6e-4fab-990b-2ec90b40ebdf", "comment": "Malware payload (Dridex)", "value": "d7a02771b29145a8df04d58347c89e39217ff08d84678f9e9f9eae9db008ac50", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875936, "uuid": "6834ddda-57b0-4c00-af8c-c658cd6326ad", "comment": "Malware payload (Dridex)", "value": "307767287c4be7ba954d57475f8d4de297f00d3c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615875936, "uuid": "791e310d-0b39-4a8e-ba3f-498ce1208ce5", "comment": "Malware payload (Dridex)", "value": "a6087bbd46a19777fbe5e70daed584204998bb3b20adf1761f8d8fd0b7a5d58c7b595be8bebe296f83c29cb6fce8a137", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875936, "uuid": "0e28e6ac-1080-4d71-8e79-d1657c544805", "value": "C114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875936, "uuid": "250d3b56-972e-489b-aa1e-65edc93dfeda", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875936, "uuid": "9a73bcb1-3d42-4515-9b5a-12206be05ca4", "value": "3072:01i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:gi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615875936, "uuid": "735c8312-4c31-4069-a2fe-f6c353655d30", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615875936, "uuid": "9d328a6f-989e-484b-8b61-92c6e7b560bd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615875936, "uuid": "11ada3c8-7dd3-4b3a-87c7-8409f66cc061", "value": "d7a02771b29145a8df04d58347c89e39217ff08d84678f9e9f9eae9db008ac50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d729286f-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615890290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890290, "uuid": "79b04e85-4e34-4e0f-bf78-38f6a1d8a702", "comment": "Malware payload (AgentTesla)", "value": "e10b9d568489db75b16c7ccceffcefbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890290, "uuid": "0bc22fcf-3bbb-4932-a134-5c1a44f15032", "comment": "Malware payload (AgentTesla)", "value": "d8a41a28c498d512310f9acfe5c44c6d22daa445d522cd53bd80bb4b2fddf2ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890290, "uuid": "7b92bb13-bd7a-4e8c-8509-fde9c9d900ec", "comment": "Malware payload (AgentTesla)", "value": "a1bca9249818ada8e6b5cba17210860e5f041768", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890290, "uuid": "c3c49a01-019a-4387-90ff-beac12c1dc5f", "comment": "Malware payload (AgentTesla)", "value": "f0b364f1890a23e75edd3c459c9dc9a6e39f6f0cc9c1038b2ae220e6036f1c75327394a3a1758a20a5a126d0d4b0e84b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890290, "uuid": "73bc0674-e6af-45f5-b445-cf43070c78d1", "value": "68856A58B798BF9AE22E5F769563841882E8C07363B3F34F75D5ACD22910315AE1F483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890290, "uuid": "8857a233-df33-41d5-8bd9-056cf047c28f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890290, "uuid": "0064b9c6-5e0a-4c81-a546-43b43e5ff683", "value": "24576:hCBIYPPLPI/KCZkQS/XLe8Ftu+/OaVIegw1vW8P5Dgqk9v5:7YPPLPI//lySb+7KelvW8PpYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890290, "uuid": "411ab7f6-cac6-4809-a08a-529ed91a2f4e", "value": 1783296, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890290, "uuid": "915d31bb-369c-4b89-a6c4-670fada3d32b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890290, "uuid": "ddc9802b-8845-4f71-8fab-93839011a650", "value": "SMEC SX#ATUSG02.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5756096-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615922875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922875, "uuid": "d43b9c8f-0d61-4729-b5ae-4e3716aaa4ac", "comment": "Malware payload (Loki)", "value": "ea769cf84ee3d0ee32aac403b9c693db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922875, "uuid": "b49d5c8f-c4b7-4250-ad13-4ebebdb06890", "comment": "Malware payload (Loki)", "value": "d95a590da00fdc70a8673764f11f32533982398e0cd4f65d991d2c401b9a5cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922875, "uuid": "79c08af9-28f4-43b3-81fd-d49f9f96e919", "comment": "Malware payload (Loki)", "value": "2e0e0399e1d351f4d101678be982c730bece0284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922875, "uuid": "2047588e-72e7-455c-9156-01e9aa8c1ed7", "comment": "Malware payload (Loki)", "value": "c93d21994615b12540562d831c0605b82ceaef3e2059bfab890689bc2a2d7c96d41092c9ed427f985684777bdf687776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922875, "uuid": "e8e50b8f-ed8a-41a0-9cc1-3035e6bd347b", "value": "502527A1E7509A74F07A73794436573252BEAD0E8A25D67D3C84BA8A2C713C240F3DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922875, "uuid": "a32ea75e-3d02-435f-b8c6-2eb3b71eea08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922875, "uuid": "9c73ccc2-9482-423c-8559-9271deca93cd", "value": "12288:7v2FsKDAjTinM3pMy/J/R6AeztZ7NosiRAc1xdAA:GhAjTiMOW/RIfNDqZrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922875, "uuid": "cc8c4915-f043-4574-8904-9078e2af6787", "value": 1053184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922875, "uuid": "e02a66ef-364b-4bcf-b048-bbc76cf6318d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922875, "uuid": "7af378ef-3e12-4e09-bc07-90a18cf19785", "value": "ea769cf84ee3d0ee32aac403b9c693db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8290728b-8643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615891007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891007, "uuid": "750d82ce-4978-4065-943e-7ffe623cfe7b", "comment": "Malware payload (Formbook)", "value": "7bc89267735fcce7dbbf20f270566a8d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891007, "uuid": "f7441203-3801-4abe-b0a1-4d413d670d2c", "comment": "Malware payload (Formbook)", "value": "d95ecdd2dc8bb08537a5f6547fd6dbb0a3b29c8ac03f8efc244f332a3603ee4d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891007, "uuid": "dfc99bfb-a28e-40b1-9ab9-640eb54acf6b", "comment": "Malware payload (Formbook)", "value": "e73a486ff758569445f27a9cfefc4f556d140f86", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891007, "uuid": "d8a76e76-c6b9-4d6c-b730-ea49eb65e362", "comment": "Malware payload (Formbook)", "value": "bca74f219b0d61d04bb2d78b7216e71d59fb7daa4addeba755119f6703ecf7d04cecfd8d3dca29a05fb281735da10279", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891007, "uuid": "a6db7d38-554d-4ca7-9073-a3e31c86b450", "value": "131412E8CF8A7E22A785D57994022035FFB38165A42DFE8917AC19F1716057F8FB2243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891007, "uuid": "b5940a9b-cbd6-4cd0-a543-d5778e65783f", "value": "6144:OhEBYJVpL5Sk211b7LiDD3jScBBq/6KWWqvTU4:Oh2YJnL5SPb7OpBUC/jI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891007, "uuid": "7ee0ac1f-ec7f-4bf2-a1cf-a3383cce25e5", "value": 203024, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891007, "uuid": "299eb13b-6b74-4233-87d0-e07700ba1f39", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891007, "uuid": "b7414db1-dcbd-4ef9-be19-f3e396e88360", "value": "Swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c503c8-8686-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615919848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919848, "uuid": "4c0bfa70-75ff-47fa-8b65-b35aa195d9c4", "comment": "Malware payload (Dridex)", "value": "036e61ad652c45958bc8696f50a29f83", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919848, "uuid": "6859b171-ffa0-4a78-81aa-0be2857dbc25", "comment": "Malware payload (Dridex)", "value": "d98a9cb471089f9e64e39582c3811c7340291eab2c14e72d2fb88e1c04b5eca9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919848, "uuid": "6aea3f1e-672b-41b1-9b7f-545e3258f445", "comment": "Malware payload (Dridex)", "value": "4230b042381d56837e6c3a2473b43739e93c0e72", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615919848, "uuid": "bcc1dfd2-7f23-4357-b6cb-d76eeaab3d3a", "comment": "Malware payload (Dridex)", "value": "aea4dae1b5fe24624256cf69bbaa748343019e71a89570fad7cb21e5ccd827663449a210451a5fd154c7f03d699af212", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919848, "uuid": "0b2c62f6-25e4-4594-8a36-82e2fbb72de0", "value": "AB14BE2DD736EA9BF7F3DEF21420272A59676D61117B918D6AC224BF82BF90C006C14C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919848, "uuid": "6f5f3a57-69d3-4424-ba37-7ae90c0cf7d1", "value": "f51e8df6bd6c2af7857cce5930a68887", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919848, "uuid": "216b2152-56f7-4db8-9b52-e1939b1d8a77", "value": "3072:ff/CNh6hxzkBkRCnNo0zLv71FGYH9bTBoXRVBGLlgQPx:ff6ixID1FGYdvBoXBGLmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615919848, "uuid": "6c81d499-2509-4e90-bac2-7c2f42563280", "value": 204800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615919848, "uuid": "f9addea6-be36-45e6-addd-86be73896d2f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615919848, "uuid": "4a68ea75-484b-49cf-9d6f-e0e8b1a74b89", "value": "d98a9cb471089f9e64e39582c3811c7340291eab2c14e72d2fb88e1c04b5eca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ead31a3-8648-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615892987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892987, "uuid": "cd386f40-e635-49cd-b5b6-a0aaa7bb528d", "comment": "Malware payload (AgentTesla)", "value": "10dfd1676daf7ba6493182aee607ccaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892987, "uuid": "895f82eb-0911-451c-a166-ed80c1540d66", "comment": "Malware payload (AgentTesla)", "value": "db8f9afbd27731f8899013e88ce0f155241c8807ddefe7a5391a8205869873bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892987, "uuid": "8fccb398-fea2-4e38-b8cc-176835a2a759", "comment": "Malware payload (AgentTesla)", "value": "d489ce3aeff35e1f4ccc68f2ffb2eb98a0eb73e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892987, "uuid": "18577912-b9e1-4ad0-8f3c-03a10f5b1c97", "comment": "Malware payload (AgentTesla)", "value": "f5881512e44da97d963fe488a1c5e411debe080da3580c61ad72ccb30e8957cd8674079957b3a89067af3bd5848a99b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892987, "uuid": "32b5d750-194c-479b-970b-9a01c116f5a8", "value": "CD1512253B8DA676E03E97341464260003F4BD66EB13D74E7EA630DE6D76B80863B727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892987, "uuid": "207e2829-44d2-49e7-b762-9405ae4e40ad", "value": "24576:MYwzmGYmA2oBZP1w5ZvogHjZen56xHIZAR:PoE1wvzPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615892987, "uuid": "325163aa-83f7-4e89-b6bd-81a5e1d8ca4d", "value": 931840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615892987, "uuid": "a1e52dbe-e7ad-4da9-a0da-f194d89ccaa8", "value": "application/x-tar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892987, "uuid": "f6771b17-3556-4b71-87dc-374d0f9316fb", "value": "New Purchase Order.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2c73e7-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906809, "uuid": "c2a20c18-6796-4ed1-8694-0ffbba6dd8b2", "comment": "Malware payload (AgentTesla)", "value": "36a1598a62e3dc979f0a5af612ea5313", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906809, "uuid": "8032c8ff-c77c-4abf-8fe6-6036964156d5", "comment": "Malware payload (AgentTesla)", "value": "db9adfc3807ddd2dc36e0e95b8960fbb539764d97b3d7607e3096433719a44ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906809, "uuid": "141620ba-12a7-4a88-a1e7-79805a13128d", "comment": "Malware payload (AgentTesla)", "value": "5e31c35d2f2b5be68170a75e0d6294df8e3436ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906809, "uuid": "7718c3ba-d479-4c20-a935-5059ec51a220", "comment": "Malware payload (AgentTesla)", "value": "00243280f17b521b1d00c1399c7c3d1de4fef1951ba3cac487bd6fa7859019beb7802f5b4671ed49c44261efff653a53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906809, "uuid": "e7d323c9-4d49-4e40-a7f1-c3816d5944b7", "value": "E9730FA8901C2C61F0C6E5F6ED45332439B67DE9BD6DC246F926B2C80BA3349C48F597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906809, "uuid": "bad4cde6-5395-493a-9873-93cb5118db16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906809, "uuid": "6df96890-4373-4473-b9c9-299e0da69757", "value": "768:GGPMXw3gRB7KxpkRozg9LOrQwwc7jVcXMoToQk8w0/L3hl:V93gRwIRiELP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906809, "uuid": "51614787-3462-49f3-a296-2f00aa8d0c3f", "value": 80496, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906809, "uuid": "affcf9ee-60eb-4286-a60c-30836741bf0b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906809, "uuid": "b6c63975-84d1-4210-a464-168fc9bf2388", "value": "cmy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895ed6a9-868f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615923660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923660, "uuid": "93ce1005-2518-4567-a779-a4040e407987", "comment": "Malware payload (Loki)", "value": "f4bb1b03c911edf744ae82128823f431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923660, "uuid": "f378afdf-e417-455f-9b37-f1f76c01b088", "comment": "Malware payload (Loki)", "value": "dbb8366c63e0e6b39b91616cdce49a552fb133368ae54fb22d08b3834770ee6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923660, "uuid": "db2f9c0c-d2b1-40b4-9e6c-f1272dedf190", "comment": "Malware payload (Loki)", "value": "e8bb37913571c006879b3780061787e965df4955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615923660, "uuid": "5e237bf0-9ab9-4b96-b348-be322b003336", "comment": "Malware payload (Loki)", "value": "9364c221c1b7bb50777029be4d72756c7e735c4136940a51396cf63572ac58bf2b900855ff0dcf3554f198b4a9d8ea6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923660, "uuid": "704b7335-4235-4394-b74b-5b85e29cb2bf", "value": "2A156B318B4AEA97E07C93B45159860903FDAD562260E7F97CE770E514F2B0E4BF0A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923660, "uuid": "2db1c66f-1047-40f0-987c-fd4683d7d3e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923660, "uuid": "8fb3c1de-5923-4055-bcce-42b817a8bd1c", "value": "12288:H15Xe1iyKU/dOrva1fRvQHJC8M77Asi0MI5Tsg:Te1f/cc648O7nM4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615923660, "uuid": "c89c1b49-0d5f-4aa8-8665-7c463fe8bced", "value": 937472, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615923660, "uuid": "cb1c2938-a8ce-4173-8f3a-ee86d1bcf757", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615923660, "uuid": "63b99ece-52ce-48ad-85fb-5de3a83988b2", "value": "f4bb1b03c911edf744ae82128823f431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1e4b2b-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615922860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922860, "uuid": "284b5675-8cfa-4132-808e-563081a1241b", "comment": "Malware payload (AgentTesla)", "value": "6216c110d404ebb1ab74c7e196eeeb53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922860, "uuid": "7d338d1d-b5b6-4808-a80f-65b775feae5c", "comment": "Malware payload (AgentTesla)", "value": "dc50396c3e2dd0d0d403262453b53abebbda33b32c919bcae92922c0ecaf822e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922860, "uuid": "64a415e1-a0c5-407d-ad00-cf9de29d4f24", "comment": "Malware payload (AgentTesla)", "value": "9c5976ae69eaf99fd276c05aaa172099d0a700ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922860, "uuid": "7d556952-2d2d-4846-8459-377de0e6bd6d", "comment": "Malware payload (AgentTesla)", "value": "e7164186ff452ff45818b1c5f99a0a8c91ca12fa2f9e39d526e161ed52ff549d577f5dfa28a65946eb1a44c0c8726e20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922860, "uuid": "cd11034d-f6c0-4350-a4d6-43720680968a", "value": "05358B21F694AB70F03973711432133053FDAD0A9626E6BE7D4871DA49B5AC186F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922860, "uuid": "6fcd2624-f41e-4316-aa75-b19707f75579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922860, "uuid": "72963344-f62c-4cd8-8cae-f389ef1d9184", "value": "12288:AxvbtKD0ZQvtTiG7cA19N74VfB7CnWaNTYcFzHBsqem5Ppw41:AS0ZQvtFf994VpkWaNTYcFzHBhemz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922860, "uuid": "bcc1dc97-d553-41e9-bee6-4316e52600e0", "value": 1075712, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922860, "uuid": "b3d19e54-7703-475b-b319-721029ab52b3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922860, "uuid": "197f4989-a9c4-41d9-bd1f-77d3c3fcbc64", "value": "6216c110d404ebb1ab74c7e196eeeb53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e48ebf-860c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615867437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867437, "uuid": "55d6ea12-9a49-468d-9932-1178b328d349", "comment": "Malware payload", "value": "db3f270b8533448ccf5f3a2d7d0ba533", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867437, "uuid": "2ec87b09-4456-4bd8-98a9-2fbaf6210509", "comment": "Malware payload", "value": "dcf384bc5bbc2e67ad96fa4e1c1065d0ba7b009abe07617a839bbe5d72e0cd64", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867437, "uuid": "f8a07a97-26a0-4430-b1de-bcf6b0af46db", "comment": "Malware payload", "value": "5dffeab662401604adbd9288eca6a9c51b800e70", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615867437, "uuid": "67750167-d089-42d7-ade5-c50fba6fbcd2", "comment": "Malware payload", "value": "9460c3f08396a53a2f418944520a61f831134f2d3b453e21668684e10c4546b8efe58a04b6cd5c828ce2f9fc3635c517", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867437, "uuid": "d3edbe07-7679-4f3d-9619-f9604dc9881d", "value": "3543029022B0E743111637D174F1DF6E5DE878D86242D47E86C4D865D311EECA239BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867437, "uuid": "f8bfec60-186e-4c82-910a-23a1ec1e9e91", "value": "1536:lK7s/BTB7Kzavwky7eAk3hOW8KtcOh2nnEMG:gg/LYaLU4tb2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615867437, "uuid": "8890337b-3910-496e-aeb1-1ae4f2a3ccc1", "value": 55797, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615867437, "uuid": "ba923d77-8cf3-45fb-bed8-9bcb9a42ddac", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615867437, "uuid": "27a7c473-cba7-49a4-b5a4-33c85a94432a", "value": "modalita_545.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2341f3-8688-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615920576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920576, "uuid": "65fb50c7-3893-4016-8e6b-16bec2fe713d", "comment": "Malware payload", "value": "29b0b7ef04a3e61c80274802902329d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920576, "uuid": "8c979310-113c-403b-8182-36c878a0d173", "comment": "Malware payload", "value": "e0b92aab41d80eae8988509f4fce97bd06ac191f00a2adaeeaceaabc2581301c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920576, "uuid": "179a1beb-fc8b-4af9-b6b3-1578a91edf13", "comment": "Malware payload", "value": "dd92f0da6f172ddffcb6e0c58034061c30d1ecea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615920576, "uuid": "56c96a64-8627-4fcb-9dbc-385905dd61da", "comment": "Malware payload", "value": "c80a1e3f5242805898a44d8ace0d45f96e1e94b30e7c61b021c7762893cdbb969c055d527fdafb4a950b2cefc8c7ba7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920576, "uuid": "56519132-30c4-4640-9c7f-1d1d28d7bf24", "value": "7536F166A8E610F9C6BDE0304156A322B8723CB587353BE72ED066A90775FE8773D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920576, "uuid": "96897466-99a1-4ad2-81c6-f828afd098ec", "value": "49152:wUgUzXnZwyeFAwrp5Cu2dkM9JOuBnpW5EQPmdQQDWh5xzHeYOD4I6yNkqBp6Bw6q:xXnZwysts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615920576, "uuid": "75b616fe-376a-4962-bbc8-abe1d6c83a17", "value": 5180772, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615920576, "uuid": "a6630199-dfa4-4119-b221-d2f6e05f8501", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615920576, "uuid": "eb9d8c28-b177-421a-a90d-ab46abe2313b", "value": "29b0b7ef04a3e61c80274802902329d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7923563-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615918128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918128, "uuid": "82dbf1fe-90f7-4f6d-95d4-ec442bb3a6c3", "comment": "Malware payload (Loki)", "value": "745a78f0c19d8dc8f03f013917520fff", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918128, "uuid": "e77b18c0-41f5-455f-8631-3fd7d2276137", "comment": "Malware payload (Loki)", "value": "e108b280ddc0f0245729cd8070c801d8992c0dcd959b254b21b5806da2d422e1", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918128, "uuid": "78b623d4-11c6-4be6-9942-b3d28139b21a", "comment": "Malware payload (Loki)", "value": "585f3cff5ee80345db5bf0867bd7d33dc8a14d00", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918128, "uuid": "4ee830e3-fa6c-48cc-a16e-685e0300fd5b", "comment": "Malware payload (Loki)", "value": "e82278151d12d49a44112e1945c6efcffa1bd4aee37666f401cb00e4a4f1dc279e3e1049906bd0582b863b12d5df5b14", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918128, "uuid": "7362ce15-9e19-4522-b6e2-dd6ff34047c2", "value": "54C53379A8F15F0AD6ABF8745529C0AC01779D860D91CC1B3336BA79287B270B3E527C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918128, "uuid": "8a5e34cf-0153-4640-9a80-82db8558464c", "value": "49152:+NHhbN056GRLyiEWVg/TSABiYLeKcZxMNcQMgMRtVOIJNk2RpnNF:sHhI68yz+ICppxtVOIJNkOnNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918128, "uuid": "1a14610f-2843-42c9-9d0c-c7888d9f0fe4", "value": 2652160, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918128, "uuid": "056d0af0-ae85-46a6-a4a9-b782a31b19f3", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918128, "uuid": "329b487d-6fba-4ab3-a9ba-4f3ec621712f", "value": "Payment_Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9e0037-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615906751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906751, "uuid": "bbb71ab4-8cf0-4482-bf13-8375e150d376", "comment": "Malware payload (AgentTesla)", "value": "463e5aea0418c61367973beb0162a4e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906751, "uuid": "9da06e0a-999d-4190-96eb-65ded3752a13", "comment": "Malware payload (AgentTesla)", "value": "e1871ec3179d5f074e4fa92f1db9733bfee023d0afe8931e705c203ed1781be6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906751, "uuid": "52821b73-e479-4eae-bc34-c6a5dd6432e8", "comment": "Malware payload (AgentTesla)", "value": "526a7ef7bbc951db6713e13f1ce5ca9413c099fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615906751, "uuid": "24170fee-69e2-470e-8971-9f819cbdc3f8", "comment": "Malware payload (AgentTesla)", "value": "dd826d087fb04ebe95b33bdfb42ab9b3f4dcc266afc914a8b52add663077516760ea1f6551c41c4eeb7dede1f70f2591", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906751, "uuid": "9f7b10eb-5378-4877-8fff-224bb8fcaf8f", "value": "DE256B203EA68039E472DAB74BD661776D596F263B01F4F93E70B3C60633943E9C1229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906751, "uuid": "2bc11655-cfb4-4173-8192-e700fe7229eb", "value": "24576:Sn/DeJehLFI7FTs/NspvftIUZi/xtAEyfss5:Sn/DeJe3IBs/GvfmUZi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615906751, "uuid": "909d8b9d-263b-40fb-9f07-6330e74d1794", "value": 975872, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615906751, "uuid": "c3cde054-3471-4677-8d00-f31dcf94585d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615906751, "uuid": "bcf387c2-0f0e-4549-befd-70b48075d973", "value": "fXYLnSBvpi3nyYW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89cd5a8-8616-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615871851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871851, "uuid": "3249a57a-44ef-427f-828f-510eab5610ce", "comment": "Malware payload (Dridex)", "value": "852d7181aa973e9d13ab0bf7a9ca27d0", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871851, "uuid": "969ec01f-ca39-438f-bb03-82a10f39eb43", "comment": "Malware payload (Dridex)", "value": "e251da4efd144f8611d357f708a4237979e3fe9e7bafb870f3586d5585c4edbb", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871851, "uuid": "ff5970e4-c521-4bdf-b861-de2194d48ada", "comment": "Malware payload (Dridex)", "value": "fe9c73fb2df1801756b90ace1a003869088be741", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871851, "uuid": "e22f3f1e-98ba-4ea1-9a1c-c398fd8ac9c1", "comment": "Malware payload (Dridex)", "value": "d5f50ab00b24f8afbbf6c2c5fa89d02d8e56c86bab6a0ba82b23e01b112361a2c1ba3a0e446fb2c4a1fb8df0c92b4505", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871851, "uuid": "08227a06-d21c-4ff6-84b0-50cf4f8aeb79", "value": "6215DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871851, "uuid": "35fbccac-b512-4883-a160-fc1f5219e353", "value": "8ce5cf6636b690adc707814c2493aa70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871851, "uuid": "896df25a-4977-4d85-a0da-9c827020f30f", "value": "24576:RD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+FmzT:RD/SBiAOOjtW3o+MbLSkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615871851, "uuid": "ee56b842-fb08-4ef6-8c92-0185b94b8b96", "value": 880640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615871851, "uuid": "08106b06-5ad2-475d-be02-5f15068bdb20", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871851, "uuid": "eff42e16-4f5e-4680-b989-fd8d3f0d096e", "value": "e251da4efd144f8611d357f708a4237979e3fe9e7bafb870f3586d5585c4edbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ea0200-867c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615915276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915276, "uuid": "aea241df-c143-4742-915f-e67ce4daaa1f", "comment": "Malware payload", "value": "34f63be24c1cdc956dc59e44b8eda943", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915276, "uuid": "8a5590a5-d76c-494e-af24-b326ae51cffa", "comment": "Malware payload", "value": "e298144464e3128f76d02eb2e1c612810308f9db036babca7fcce04f3d2c77ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915276, "uuid": "2712d429-993d-47a9-a975-65dbc20c2817", "comment": "Malware payload", "value": "be50379ddda76e9c8d3f1221280d669181ddd173", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615915276, "uuid": "3550dadb-3c7a-4ac0-960c-137fc0951f1d", "comment": "Malware payload", "value": "4dba8fbf4f7832039786ad1a42fe18dcbe36ab7b1f14ccd0b8772a8bc7bf1172faa9c07dfc849a96f25ae75759878cfb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915276, "uuid": "8f5ea087-386a-45b6-8403-26261a27731c", "value": "97E38D4170E2C473D57E153808A0E6B24F7E7921CBA499BB27E44B7A4E703D18D3AE76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915276, "uuid": "65859766-5ad0-4592-8ef9-64e469e8a932", "value": "bc2b8fee4f798c5fe410475cfcc1b23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915276, "uuid": "d2563ae6-9b10-4ab6-bfbe-722f5e22d8c5", "value": "3072:Ha4lOrmvdnqGuFtghsizPzd+T5WWYgT0IAIKuuS16NAg0Fu8KWBYtv+AP:Ha47vNPhsiz4T0U0WKuuScAODv+AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615915276, "uuid": "c009e859-d6cf-4423-b970-edac7496038e", "value": 146432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615915276, "uuid": "9b85e4db-52e2-44a5-8168-37f05edf9e91", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615915276, "uuid": "1ab0638e-1aad-40c0-9bd6-4d90a1f27ed1", "value": "msimg32_fk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558d92b9-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615893938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893938, "uuid": "8be556b2-2799-41a4-a6cd-c85827c39d0f", "comment": "Malware payload", "value": "b35254e6334286701fa14c62e44811aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893938, "uuid": "2d29cf0a-5af9-4254-aee6-e1c8ed32de9d", "comment": "Malware payload", "value": "e29870aa850369f97c3e776c425971757008c487c3c38fb5c7857f0c099c7032", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893938, "uuid": "826303ac-386f-4803-bc53-e8b70ea35277", "comment": "Malware payload", "value": "a4e9737ed069ed1295a3b0b3fcaebc25291fc66b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893938, "uuid": "42bf6de5-8442-4a90-ad88-309c794a4a92", "comment": "Malware payload", "value": "54de6eeb61652ba4af3e83d314d528c43d05f1038bb065c3f7ccb8f85a28895d6e6efd2ff5c38163e1fcfde6c8f30314", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893938, "uuid": "eb9dc8ca-c436-4f76-ac30-9338f8187589", "value": "1DE4E0E888859641D80784F64D4BD770339FBD1E99BB840276EFF68D8B6BA874D13243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893938, "uuid": "301a23de-1886-4ea1-9bee-dcb0f48c4cb3", "value": "12288:FI1f+xs/FQffXC1lHRqL2Ae6BrogO+oSeBVU8vgY8xp+WOtpLVr:m1f+2i3qlHRqL2Ae4O+oN49lxp+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893938, "uuid": "ba0e6d2a-d01a-49bb-b744-699fceacaff3", "value": 710656, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893938, "uuid": "fa987f51-f508-43c2-9b7d-c4e72105fc45", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893938, "uuid": "dd8251bc-f3a9-4029-8d64-2c9a2192ac6d", "value": "FP-22-94 Raw material offer request form.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2e8dca-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615884631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884631, "uuid": "7f22308c-758b-4608-b032-0b540e2edc00", "comment": "Malware payload (TrickBot)", "value": "35ee773079b553e228c8cc8ddad09e80", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884631, "uuid": "17b4f8c8-863e-4ee8-bc28-15d61fb3541e", "comment": "Malware payload (TrickBot)", "value": "e2f6ac2c144bf28ac853c5dc3f3c4ce5ff08f42076c1d996c1ebb6362f9e66dc", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884631, "uuid": "7f2a7528-dbd6-4d3e-ac15-8a09a9b60fae", "comment": "Malware payload (TrickBot)", "value": "f485418aaaf6f19e3667aab47d6c2fcb4cb3d545", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884631, "uuid": "b8970e44-8708-490d-bd08-a31d822478a3", "comment": "Malware payload (TrickBot)", "value": "df684b127515f78546990f6855892df928f9c7d30897f3d080fb9b6479acf0982caa67cb73f750f0d64e0b3fad92ca04", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884631, "uuid": "619d3008-73e3-4a59-87d3-0301a9a18f47", "value": "76C4D032F55C4422C4FA1A3318B1FFC7D52DE39C9F62565B71AC0A8C8A648E1AB65F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884631, "uuid": "9cd3fc70-3ed4-4481-ab13-d6b26354cc56", "value": "70c2af83794bb23e5ff45677bfcd4d77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884631, "uuid": "952292ed-3022-40c4-9cd5-f7e6dc03f231", "value": "6144:YWupppqFpnclMKWj3RfUuIOqg6SVAKycH3vKbqZrMWON+n4BdpNZ0jXfcmpxlIkH:7DRUg1VafNrBdpNSQmpPFYgXJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884631, "uuid": "031be710-b133-46e9-807e-37881da95d8b", "value": 560128, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884631, "uuid": "f91dd9f0-4d10-487f-8a25-9bc9cdc01014", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884631, "uuid": "8b14848f-158e-45b1-a023-9dcf38bb3a5d", "value": "SecuriteInfo.com.Trojan.GenericKD.36426529.10317.558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3639554e-864d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615895174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895174, "uuid": "6342c5af-6e92-4a37-b145-62a6624e3ace", "comment": "Malware payload (AgentTesla)", "value": "2afdbb7002683bfab1cd664231754097", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895174, "uuid": "d451e7d5-c672-4bfb-ac26-2470c67360e4", "comment": "Malware payload (AgentTesla)", "value": "e2fe2d1e75e2a0f6e9607f0983b71ab13dacfb2e62e5877bb7a6309463250b77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895174, "uuid": "a0d61a21-78f2-4c6e-a7ea-271df2a6fe30", "comment": "Malware payload (AgentTesla)", "value": "642672d98780c0843031229fcea905b0e2429222", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615895174, "uuid": "657ea272-7a12-45f2-a5af-3289a7abd519", "comment": "Malware payload (AgentTesla)", "value": "188551d7eb48b1afb722433feb195f1abbe0fdc452876eae7348998ddf36f6550292e36008dcf90fbd80e84954a8c6fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895174, "uuid": "b79fbf08-8435-4066-8ff3-a36d27f3be0d", "value": "E6F4F165B5A98923CA3CF4BE04C7517C8B704593FA25E7D71CC628EA02E2BC82D15ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895174, "uuid": "a3b6d809-c3d9-432f-85f5-57dd933468ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895174, "uuid": "519c408e-5808-441c-a5d0-d1b6feacd987", "value": "12288:Q7SsDlTglzmst/xvJ9oEDYSAE+QiN69hvMni6EFCrTA5fDZuN5rhtJNYHeZ:+/0/xBf8SAtQik9dT6OCIdVu7htJe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615895174, "uuid": "1ab9e2b4-5102-462d-87db-88d0012d3e28", "value": 753152, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615895174, "uuid": "7116a43e-a830-4b23-b8ab-1c1b3a5260ba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615895174, "uuid": "37ee0a6b-5576-4278-a2cb-8f42988cb354", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9cd4bf-868d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615922919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922919, "uuid": "6783c034-6073-4619-bb04-3ad294a0f6f7", "comment": "Malware payload", "value": "e00743a06378fdc48df81c57ff27c80c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922919, "uuid": "91d40116-8a8a-49ed-82c5-e3f9e0764808", "comment": "Malware payload", "value": "e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922919, "uuid": "6631b1ee-6c2d-4a6b-ab2c-24d3333b8ff5", "comment": "Malware payload", "value": "644eef3bb78b0e340b2f4977dc0c17b26889603b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922919, "uuid": "ceb3f236-59da-4b0d-9caa-3bb347af377d", "comment": "Malware payload", "value": "185e0cd599efe74f03cdc759f36e633d78720426f9e2194fbab68c2f7ae0561c2e06fe7e91d690756873f9e791606b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922919, "uuid": "cef27907-ed00-4445-906a-5ebaed322866", "value": "A305231299524BB0E0918AB82E7F4175C637FD311438144C3BD99DBD2F6A762EEBCB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922919, "uuid": "619264ec-22fa-43b2-8adb-a8373a2543dc", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922919, "uuid": "885788d6-ea9a-4134-a212-e43c76a13f8d", "value": "24576:4yIYo8isrRt4d0oCoQ5u7d33mBJxl0dUMfYCr:4ym8isVtfoCoQZl0dUMwCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922919, "uuid": "97521c18-7483-43f5-af05-840d8483e644", "value": 818801, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922919, "uuid": "c1970759-915f-4ab1-8273-274ca535c25d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922919, "uuid": "58c3c8f2-5b19-4b76-bf75-49a73d22c105", "value": "e00743a06378fdc48df81c57ff27c80c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc469654-8637-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615886057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886057, "uuid": "eac43e8c-6330-4ab0-b270-458b43bfca4e", "comment": "Malware payload (SnakeKeylogger)", "value": "336b2ce3a07a8eb4f980eba5b1ce5c67", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886057, "uuid": "b3a15d72-5594-46ee-9775-6e83890f6f4a", "comment": "Malware payload (SnakeKeylogger)", "value": "e3c22414835a12c5b73c62f932ae91934a2f97120061f47f3b16139875ce1f38", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886057, "uuid": "3c13b612-a458-4c86-8c3d-3de33263a424", "comment": "Malware payload (SnakeKeylogger)", "value": "11b0b674bd63d16687d5dc5f29e26c38cdd50fdf", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615886057, "uuid": "ba4edcb0-7978-414d-af8b-8d01f5bd08da", "comment": "Malware payload (SnakeKeylogger)", "value": "cfd81ee8025017634e331ecf214c088b6deeccac422047297f1bce9ad1a502ecd41471484c06b70617bf975dc1659e68", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886057, "uuid": "d3b40a87-175f-4589-84b9-03d479fc1cd8", "value": "DB2502266789DA51E1BE9B380870461013F4FE06E713E74E7EA531ED2932BC5973A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886057, "uuid": "9c054590-dcb0-4001-b535-c22582eb8deb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886057, "uuid": "64dd4068-dd1b-4d14-b9b9-cb933b57ff72", "value": "24576:aNG2cWxQw31dTRKJWUi6iUaNKMix/6HCXfdO7ITtt/G1Ladd:YCmQOxxUoKyiXf6If+5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615886057, "uuid": "459d7825-63c6-489c-a7f7-bca2082d33f6", "value": 1028608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615886057, "uuid": "25eaeefe-0256-41b8-833d-9008ce8ada14", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615886057, "uuid": "c885de38-753c-47c3-b794-1d4536d07769", "value": "lol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61c4494-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615890288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890288, "uuid": "28d8388f-5ccf-4354-9c66-e6e7f8ee7afb", "comment": "Malware payload (AgentTesla)", "value": "ecc3c8f1d66f1a1eb564968d4b922f3c", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890288, "uuid": "fc58c866-9be2-4139-afda-c504ed998a16", "comment": "Malware payload (AgentTesla)", "value": "e4ab391fe6300901db884adad9604b27fbc4298001de56b2762ac0421b968ac8", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890288, "uuid": "8c7425a3-c24c-4df4-b781-e3ba772181bc", "comment": "Malware payload (AgentTesla)", "value": "2b6eee44da710f8a4d91d0b5f218188f523ef07c", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890288, "uuid": "f55ead6b-af88-496f-b566-42a214102bb1", "comment": "Malware payload (AgentTesla)", "value": "56679719dece6cf246a99c3c9229567fe7fdc9a5258458616b3a03c4c267fa3d681145ce030a74361d3a8dc4e19b2f34", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890288, "uuid": "d6dba23f-ecf0-457c-b1f1-700df30ac4c2", "value": "7A1533C84BE7486C3C3C668B975B6AE2C803E262079F67BD5EED60051472B0BE075BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890288, "uuid": "ce16d404-9111-4d0a-929a-6a22a9352677", "value": "24576:5E1Pr7s7xpfZR8JBszMidMld0Sf8b/D4MQG+Y7Jn7:5E5r7slhZR+BsQiOn0CIDTh37J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890288, "uuid": "9b0c8c96-f5f2-47da-8fe7-77894cc7ce7d", "value": 957051, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890288, "uuid": "3f9550f2-4f01-43d4-a552-6b4c70eb0a7a", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890288, "uuid": "3c4725b9-c57e-483b-9446-07453fe2c382", "value": "RFQ-SMEC SXATUSG032021.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea393bd-8644-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615891242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891242, "uuid": "33f790e9-acbc-41a2-afaa-8a9bd84e6ad6", "comment": "Malware payload", "value": "16ccf07b3e1df46cbdbb04b4102dca2c", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891242, "uuid": "e5d56ddc-573b-40df-a49c-3e417ad5bdb2", "comment": "Malware payload", "value": "e593b43c468f1c38b1ff688ab87b9c0265692531d981f12a67362ae62f134a51", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891242, "uuid": "877f773d-f801-497e-8b47-ef734b9d4138", "comment": "Malware payload", "value": "e3b05d3d554c0a21630769d8ba0ade598836c019", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615891242, "uuid": "20381dbe-a848-4565-b2a7-ed96b068479c", "comment": "Malware payload", "value": "6dec77f69b3350dd405595c5bebc1f88e3c03897aa69a03245b30ea640aaf25841b8b038ee5d45a0e6b1e1b5a3e2331e", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891242, "uuid": "61478f15-0076-4aac-89fc-9f7822c3de35", "value": "9163B04EA624A579C27EB93C924518E25C4E20D66847F41F35E4BA0879DE1C33BEF63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891242, "uuid": "32b0f2a3-c909-4409-9b64-b8f2d4f1d8a6", "value": "1536:9y2IIJgRJJi76rrLV7BBPa90v2MdWoIK4U/Vdq:9HIIJmHK6rrLXJaEdl9dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615891242, "uuid": "e6d402e9-eccb-4fc3-9af1-91b66e8bc4f1", "value": 68171, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615891242, "uuid": "424ea3a4-dd2f-45df-bc7c-112db158ec89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615891242, "uuid": "a6fabfcb-34e7-42cd-b658-1be0afdd2a37", "value": "tipo_2379.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345870bd-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615890017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890017, "uuid": "f7d8accc-14b9-4d71-9a7b-edbc13f899b9", "comment": "Malware payload (ZLoader)", "value": "c91aa7c80fa2e6fbf094040caeabca14", "object_relation": "md5", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890017, "uuid": "b0df73fd-0451-4158-b196-0f24c0de12c0", "comment": "Malware payload (ZLoader)", "value": "e5af4868fc46a5a675d9e93c4e45b9fef7043fe2263ad0bd9469082c00d74139", "object_relation": "sha256", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890017, "uuid": "c3f475fa-0a85-46b0-a037-bad6ca6d7f97", "comment": "Malware payload (ZLoader)", "value": "aaa87f6e2b6f923df5aa4b92ebe70bb744d1f311", "object_relation": "sha1", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890017, "uuid": "e8620846-2117-4c27-b6af-8b0fe1243cce", "comment": "Malware payload (ZLoader)", "value": "6dbff4209435574c786b130b85e310ab6f9c89d519fc5153059219044b9226bec66601d573c6d79020ba045800d4ac9a", "object_relation": "sha3-384", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890017, "uuid": "bd3089dc-f559-4169-9d01-9333de7e2bba", "value": "28B47E235613D07DD2B7C0BDC10A8BEABD582F212B2E6DE7A7C179942D721D1923C64E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890017, "uuid": "cf6601ee-011f-495c-9404-5084a9b0beca", "value": "8c5f33b5d8ce60f2371ff15687e93705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890017, "uuid": "4660f82f-62db-49cb-9205-0a47d6419bbc", "value": "12288:17qfj889wpMBTNtAdiLClnYB9gGaMSuj029xey5Zg:1h8cqTNtAdiLSYB9DaMSutcy5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890017, "uuid": "d3f1e860-30c7-41ef-8190-466b6bfa4cec", "value": 512512, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890017, "uuid": "05598768-2c66-404b-9dfd-28f880d0d50b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890017, "uuid": "71ed2015-43ac-455a-92d1-c213a6de73a1", "value": "1391343.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f852b6f-8648-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615892988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892988, "uuid": "cc1d9727-3e6d-4d4a-8e5b-af03b8a28ee0", "comment": "Malware payload (AgentTesla)", "value": "af03f7b5dbaf9e05c488ee6c83f355fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892988, "uuid": "b28e475d-54c4-4827-b06b-56808104cb6f", "comment": "Malware payload (AgentTesla)", "value": "e6f7305f0a2731254ca7a3b3487632101ea5fe533a3210c22ab4f34188f9b48c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892988, "uuid": "e56c2d39-2303-4d0e-8915-c0c4d6d4038f", "comment": "Malware payload (AgentTesla)", "value": "2b8a8c503f7e9b9355252f348ac87ade814716de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615892988, "uuid": "08fad13a-f9b0-46dc-b858-7b4eaff019e3", "comment": "Malware payload (AgentTesla)", "value": "072585079401320b023c31f3398cc0a3bb3fbf1140a29f0ece31663ab8985c0c1c743908eec18cb46dc9daae33d52eef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892988, "uuid": "95cd34e7-e58f-47bb-bf55-997e2b697e78", "value": "B41512253B8DA676E03E97341464260003F4BD66EB13D74E7EA630DE6D76B80863B727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892988, "uuid": "a8f242ee-225a-45bb-aaf5-beebebb50ffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892988, "uuid": "a7ec2e25-e4fc-48be-99f8-31b40a8ab54a", "value": "24576:qYwzmGYmA2oBZP1w5ZvogHjZen56xHIZAR:NoE1wvzPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615892988, "uuid": "30ee3cb7-b17e-4b49-b4c9-e5c09223a102", "value": 925184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615892988, "uuid": "f22b14a2-91af-472e-9e83-829b2e505393", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615892988, "uuid": "b34e0bdf-7016-47ee-bfcb-ce76d50b2c2a", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20c904b-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615894952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894952, "uuid": "55ddc71a-d6f3-44d0-9ac7-a325178fb317", "comment": "Malware payload (Loki)", "value": "9c58b065b853f499fe26afebf0da8006", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894952, "uuid": "aff777c3-053f-47e7-85a3-904308050b48", "comment": "Malware payload (Loki)", "value": "e741e062ddcdd05640d7653c3a3df171c8e95877ac787940ff55cc6fac4fb300", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894952, "uuid": "495c515e-ec63-470b-b1ce-76ef3d78524a", "comment": "Malware payload (Loki)", "value": "cd2b6c13ac8f3ea5da9826cc679ccb4067b2c9f8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894952, "uuid": "6378ed6e-0643-4341-85c4-197576b08708", "comment": "Malware payload (Loki)", "value": "4b6e3e1fd25907f11bbd4a9bb0c4ffac1df854847418d09a46a81c14202d457e88165dc027a48fd89607e91e66b2a813", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894952, "uuid": "4901599b-70c5-44b5-8ab3-2d01a833f2f7", "value": "A9F30216EAC098F7C79797710DB89B6AF7B9C313017286134F646EBB3D522C69D08362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894952, "uuid": "26be1dae-3d59-4ce3-95f8-99eb1bb20703", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894952, "uuid": "bff5c70e-d289-4e73-ba4d-87d973adf3b3", "value": "3072:U3jqjLX1DLPcCgbpwMCtjWWJGetPbGGJcu9DyIJKNc1h+Bo8dHiiP+NQvKGa6:UTqjFlopSpJbGGJcGDJ0cqe8dCHNQvKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894952, "uuid": "960b632a-7055-4a3f-82dc-cc1b043e9b85", "value": 159966, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894952, "uuid": "1f7d8bfd-1132-4960-b9cb-bfb67321a0eb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894952, "uuid": "b790e263-c95c-47a1-89d8-6c89c956c590", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.23680.5553.12520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1c54a4-868a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615921568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921568, "uuid": "a92d8baf-b67f-4a5c-98e7-f784e01077f3", "comment": "Malware payload", "value": "46156592c21f895dd0937a5ef80c19f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921568, "uuid": "e8b874c5-5252-4b00-bcc9-59a1eb429939", "comment": "Malware payload", "value": "e7825b34c1ce02cbd46bc627c0bd22ddf421ab656d43aa1507adf62cc6481a25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921568, "uuid": "78eda000-80d7-45e1-a44e-ba4e3320b4c7", "comment": "Malware payload", "value": "3634b66f6561729855fba11b4241fa38a6464cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921568, "uuid": "a760ccf8-6c0b-40be-8381-f5effe8cc759", "comment": "Malware payload", "value": "6dd90ca17931c87e34a257f95e2f6f4e4630233ddc3e24599ed1000b92dfa91186ab0f5ef9c1aec861d6dcc182a626f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921568, "uuid": "60436346-5089-4e26-9f1a-a17087622733", "value": "E0C5AE66A8E600F9C6BEE0348556A32278723CB687353BD32ED426690775FE8773D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921568, "uuid": "93edd891-dc86-409c-8b5b-a39890d62a68", "value": "24576:3F3IZKMRXNAZKkRslPGZpMhI5Zv6Yx2nRn6owc1zJ3bq6u7tS+I6yq4BNyrVw1wK:3F3GRXN4RslPGEhI5ZXG3tKX7x4wGHpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921568, "uuid": "f0337708-bd39-4e69-9dbd-75e178938a3e", "value": 2635091, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921568, "uuid": "c58ab668-9495-4112-ada8-bc7a60445acc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921568, "uuid": "a1e33754-f3c3-4401-8b5d-a6a5fbd38682", "value": "46156592c21f895dd0937a5ef80c19f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77782d31-8641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615890130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890130, "uuid": "0edb67f1-c171-41c8-94f2-0c501c6d876a", "comment": "Malware payload (Loki)", "value": "8405e764f0a78b945946fa247657086d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890130, "uuid": "93a544f0-0c1c-4e96-b131-ffed3929ad4e", "comment": "Malware payload (Loki)", "value": "e7f7bafee06c31b93f5f813d4170108f5d4c1ced17eab3e6ca5a70efe2fdb570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890130, "uuid": "77de22dd-cd00-4c37-9ce2-0c8cae424ba6", "comment": "Malware payload (Loki)", "value": "7f64a5ea5484f90726d6dd59d1c2a3b0d9c2c290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615890130, "uuid": "d04202cb-17ec-4a58-bccb-ef8bf1cb26de", "comment": "Malware payload (Loki)", "value": "49c48c4c0bdf6653fb4adf6e88fed5b3ea4644af9580b60a06379d55c2444a094bae76707377cb50f09ea9a63505e4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890130, "uuid": "fec0c265-00f5-4f67-96ae-e3c6c2300dd5", "value": "74057C21F1F14436D3630A79FC6AA6B97C267EF22B55687336DC79084F34E23EA18152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890130, "uuid": "615abd80-ab34-4c19-96b6-4a017903f6bf", "value": "bb7c1343a3bb5be0ae26320d4f6412fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890130, "uuid": "d4173c80-b274-4a20-9b22-47fdd2074a21", "value": "12288:PcYANRozghz2WTKuOJW38B4br1EGmJWyUlWkT4a5/rlb:P1a2ghz2WTE94idA575/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615890130, "uuid": "2ad18ced-b68e-4189-be1b-dc0bed8e7013", "value": 811848, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615890130, "uuid": "2494f457-d601-460c-b8f0-84ce5d1f9aff", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615890130, "uuid": "01d82419-a32f-4235-b5e4-27c77af9d423", "value": "purchase order PO014328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1820b472-864a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615893835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893835, "uuid": "a54dbb85-f69f-4487-8660-e137ec11fd57", "comment": "Malware payload (SnakeKeylogger)", "value": "f3e856f8b197084a7d4a119d8627ac67", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893835, "uuid": "ddda0e14-38e9-4649-933b-d92a8d6adc19", "comment": "Malware payload (SnakeKeylogger)", "value": "eabf6a7c559daf45d6aabedf7492cbeef34446b63b77352415446298b14e8957", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893835, "uuid": "bf56d766-13cd-46ce-b21f-54c667a8ea21", "comment": "Malware payload (SnakeKeylogger)", "value": "cd61f5924da21750dc53881d53764af42a145801", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615893835, "uuid": "1c39ce30-6e74-4a4a-a417-7483ecb0eec4", "comment": "Malware payload (SnakeKeylogger)", "value": "b4c72588c1674211ac757c9ccd6087e8ed2c32a9e27fe9e0de71be17621e2a1db99501d56a71d770525833e6ee5e5e7c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893835, "uuid": "a3eb37d4-24ae-43de-b4f0-a3a44ae5c3fd", "value": "5D65171127856E28E27A43705835641DD7F9EEB6D338C5BDBE9E328B0B73A4141B3623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893835, "uuid": "8dd478e8-4d66-43c9-a155-34a025d3cb4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893835, "uuid": "99e29cc7-6c26-49a6-b0a7-2cf01e597838", "value": "24576:xQyBpa51mt6VMvyyArQhzPbSOOgZ5iJ1:xxa5MtXvyP0bbSOvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615893835, "uuid": "a21b157d-da67-4b76-bb51-aa86389a9ad2", "value": 1409024, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615893835, "uuid": "58a3a951-78f8-41f6-b729-52d72ceda573", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615893835, "uuid": "ce8f54a0-31bb-4b64-abe0-c793fcf8d5b4", "value": "17776-~1.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a578f5e7-8634-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615884623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884623, "uuid": "3bcbccc5-d434-4a6e-a104-ed2c09978063", "comment": "Malware payload (Gozi)", "value": "5d600596afcd9e9ee6767ca449257581", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884623, "uuid": "be44954d-1740-4d2a-876f-ce86e736b8f7", "comment": "Malware payload (Gozi)", "value": "eb5d21b247b7552956d9ed05df2de0f366835db3977c18291b65fdb876897126", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884623, "uuid": "cf51fcf0-b2fb-4783-a561-2682f8c490d9", "comment": "Malware payload (Gozi)", "value": "c4d359789bdc0066f2ca4b4e383cb18a5d8d2f7f", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615884623, "uuid": "0f3580aa-99de-468b-a201-83efb3a7c174", "comment": "Malware payload (Gozi)", "value": "52ec85627dd65c65399693d652d89c4da1bd277b063c715a3607a198bc6fa25e4cff8f1c5a74c9494ec5fef5ac3d79f9", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884623, "uuid": "0a7ae3b0-9ac6-4d18-96ac-d4b40284121d", "value": "E914BE00B255C4B3E136847ADC52C6FD5BE93C40CF789D63BAD52F2FBE6B1809A25122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884623, "uuid": "e999f2a9-5d47-4d1b-a9c5-90b28611c9a1", "value": "018e55ae3f151d4568e9b73f76c961f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884623, "uuid": "9de6f5c6-bcde-4b11-8294-7665f196d74c", "value": "3072:I1q8ifKGVRxu/xoTiTgn43h+1vNYduj8pyA97Vu1IYJ6PV:Ig8iiGzx2oThNYYj47Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615884623, "uuid": "8af0a5d5-24ff-455e-a8f5-777feecd6924", "value": 202240, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615884623, "uuid": "5ffe0bf7-9575-4aff-9a21-28ce7c779ac1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615884623, "uuid": "38b20775-c812-4238-8635-33d060054dfb", "value": "SecuriteInfo.com.Win32.Kryptik.HJSQ.12709.32696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fdba3d-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615907090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907090, "uuid": "d2f57e21-9e1c-4be5-a6ca-ff225c0d82cf", "comment": "Malware payload", "value": "c82d449a4840ed560c3fd072c6dc2ce8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907090, "uuid": "1035d7f1-231e-4295-b676-292bf7f96d3e", "comment": "Malware payload", "value": "ebd599283e6808517c1f4e2557c65980cdb9ee8e467daf38cac0f15ef2068b2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907090, "uuid": "0297bda1-c14c-4a64-a229-8a2cff8e876a", "comment": "Malware payload", "value": "60374fa6cdc59fa0198cd4793c6650bbbf4493ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907090, "uuid": "d675a087-1cbd-4579-bde6-34f04d39cfc3", "comment": "Malware payload", "value": "d7b50cd68a06cd9c1a18fa692d49b4bb37684a54c1ec204338742a065850b496deace2f90799a2900555e26a66650f8a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907090, "uuid": "339c3967-60af-4cb3-b07b-e5b1b91bfa24", "value": "9345F1D3EE43246AD8EA4973A2FA1E65C3666F3B710C544E898D723D0D331524A1AD2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907090, "uuid": "dcbba9f0-08be-4b1b-a693-4d9b557c96e4", "value": "12288:GTQ/c+L/xJ0Wzmu8cPU3RdJojFzzLsQy7jU:9Lx2jub+Dejxvry7jU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907090, "uuid": "f876e3ce-a8f9-468d-a85d-beb8aeb558f4", "value": 1277952, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907090, "uuid": "7584c1fc-060c-4f2e-bc1a-86b53e9a5d1e", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907090, "uuid": "a3ca54c7-d255-4cdc-b440-388d63fcf67c", "value": "Shipment Document And Guide.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1309d2-8668-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615907050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907050, "uuid": "8e25de92-0097-4482-8b99-fb0846001748", "comment": "Malware payload", "value": "2339e2808f04332c855b03c89dbaac77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907050, "uuid": "b20a67d0-c52d-4541-b55c-149b98f83b69", "comment": "Malware payload", "value": "ed04f2c7fddd7f3edc73f84e897ccaeac26f52efe2255862881c5615d7982837", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907050, "uuid": "3d28af71-ff13-44b8-8151-25b3e2172d38", "comment": "Malware payload", "value": "c5f0374ecfd6a057ee1f4829cff46b676e795cf2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615907050, "uuid": "61de829b-6704-48fa-b90b-91ff08fecc37", "comment": "Malware payload", "value": "aba63280a54a0a4bf9c43b4eacfd2a05ce67987eb8f72fe2680388388d7034c45e2c7448b83c35473d8cf17e904e5479", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907050, "uuid": "aefcc527-4e3c-4362-ba0f-c81725754b11", "value": "D272BE104E34846EE7115078B4813744B7A2365343764B4ADA60E5F8DAFAAFF6F2D70D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907050, "uuid": "0764783d-4d5b-453b-aae5-6aacff1fc4d1", "value": "384:e4qZ95L6H5VuoKM8qmuKSOFaV4wASQDOOWkPsdMvjIs1JrkX8:69kH5kqmuKHaJASQDONSsWrFla8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615907050, "uuid": "40b7d2cf-00b9-480a-9508-9b865c9aa5a8", "value": 17064, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615907050, "uuid": "97392816-8b69-43fa-a7f3-5a511b0e6e13", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615907050, "uuid": "9101055e-4eaf-448d-97c2-d572c686eb43", "value": "REQUEST FOR QUOTATION copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62300abf-8666-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615905985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905985, "uuid": "2dc1f919-3afa-4e78-b5ee-8bb7aa232a1f", "comment": "Malware payload (AgentTesla)", "value": "ab9c72b6f0911d99184f2ae87df9d6fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905985, "uuid": "cb695248-9bd6-4828-bef3-c3ca39656bb8", "comment": "Malware payload (AgentTesla)", "value": "ed29a2786fda6a0499b5fc69fc269f1a18d4eba9ca44c94333dc8d86808cf04b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905985, "uuid": "fbbe6b57-b591-4d4b-90ea-b3087b4087a9", "comment": "Malware payload (AgentTesla)", "value": "ca927c9ac08b4696f874ddbff74159db4d7f614a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615905985, "uuid": "b82e2e7c-dc8f-499a-adf0-bc07e4cc211c", "comment": "Malware payload (AgentTesla)", "value": "e35385db30e0505229f04c5205cce5d681582848cea9402bbf94a44801353e7c5566b6515a550fd6202efa24a9df6557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905985, "uuid": "28bcf38f-9ef4-4c67-b704-2e3a4d4bae41", "value": "C163FAE8DDA944F7D6ACF97581521182E230FB3726145B6B85CF42C3CC56B7328D82AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905985, "uuid": "88ea9a2b-65ad-4427-b654-7ee18a6c8f86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905985, "uuid": "840953d9-a323-4211-8e3d-c95252ead634", "value": "768:fchv9GH2glTvBILgAV1nENiS0oCazK5fi6MeP/22iwFolGflvxdUGflvx/FIwJG1:mv9GH2glTvmLtV1nrZozKdiBm2RwGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615905985, "uuid": "e94d6b22-a3d0-4826-ac3e-bd9cfde8446e", "value": 73216, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615905985, "uuid": "a1b16583-77f0-4116-8611-df4103df6a22", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615905985, "uuid": "f4d5251b-25a3-49d7-9bf4-9f50d3c95723", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.22896.20360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeab3f1-867a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615914456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914456, "uuid": "0795ea1d-7aff-4893-904e-2c37ec593c89", "comment": "Malware payload (Gozi)", "value": "1de9d4f474a4c0c4f5947c3600c4db2c", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914456, "uuid": "bc7af23d-de9d-4307-9f63-8429ca24859e", "comment": "Malware payload (Gozi)", "value": "edc2d20aacb1785d13a3921cfa59fb7296d617dcf88fb82194629954c96c8494", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914456, "uuid": "3b5a468a-c256-405f-8e0f-334398582806", "comment": "Malware payload (Gozi)", "value": "39b49efc2accc383d4c7141e891d2e6581550e68", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615914456, "uuid": "dc1511fd-8feb-41b9-b375-05e70bf3e5fb", "comment": "Malware payload (Gozi)", "value": "174b1abe950c22653f0013ac52a6f03973d13ad3df0c625f0a062f21372a80ee2b5d0e6bae2d194366b5772561bb2d19", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914456, "uuid": "7f87e301-3ed9-4bc9-b88e-ef6e163a4772", "value": "CB65BA5207940BBCF99E0ED9C98F218670F2D4177D6A1248ABF35AE77C37D84A43163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914456, "uuid": "6222dcbe-45ef-435e-b40f-d9eca914b1f9", "value": "24576:yc/AM+84+NfRAwmcxvZ1RWB87cZ24PX/Hh/MEUUG1AXlvU2LDkhq5o8CqW:yc/v+84+NfRAwmcxvZ1RWB87cZ24PX/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615914456, "uuid": "ce3d7400-3cc5-46f9-b8a4-8a2f21969517", "value": 1447653, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615914456, "uuid": "c7cbb635-ef70-4f32-b555-fcf864da182b", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615914456, "uuid": "c9c9bf60-bcbd-422c-9efa-d593a70a17ac", "value": "info_70397.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed57d918-8616-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615871859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871859, "uuid": "1798a9d3-2f25-4dc1-abff-2cd5ef7db4c0", "comment": "Malware payload (Dridex)", "value": "3705a86b2b62f88d00f9cfb3c800bc06", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871859, "uuid": "f05e2ac1-a25e-46e5-9297-91640db58c55", "comment": "Malware payload (Dridex)", "value": "ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871859, "uuid": "d303b5ab-da1f-43b0-89bf-9ab3c9786550", "comment": "Malware payload (Dridex)", "value": "6a84185cb3c9dd38671d68ea6e2ed3548f72c7a6", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871859, "uuid": "89517643-9c97-42db-b56d-b50b8bb9aab9", "comment": "Malware payload (Dridex)", "value": "48fd9c9889fa0a41f6653b25ae278936f7c1b70a2459c4d1c35cd24515ba41a8d578362a045f21e718b8d17f6d7cafab", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871859, "uuid": "fb6107f6-9fcf-4e06-8a90-775e2739506b", "value": "2215DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871859, "uuid": "d8ff1a3f-ea74-4412-994d-2a3890e101d4", "value": "8ce5cf6636b690adc707814c2493aa70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871859, "uuid": "1d321570-7c35-416e-b8be-faced16f1ce0", "value": "24576:BD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+Fmzx:BD/SBiAOOjtW3o+MbLSkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615871859, "uuid": "61aca53a-892a-48ad-8dec-d56e337f851f", "value": 880640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615871859, "uuid": "bed03775-17da-4448-821c-6a38a52d30a2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871859, "uuid": "bdde2cac-a67b-4da1-87ed-48cc3e3090f1", "value": "ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46cdf5-868b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615921729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921729, "uuid": "990bb930-b229-4711-a3b9-1ecb26e84f98", "comment": "Malware payload (AgentTesla)", "value": "c0cb86d7da0efdb4049d80a17a7e9b0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921729, "uuid": "4dffe0e4-58ab-457d-b24c-231327edd4be", "comment": "Malware payload (AgentTesla)", "value": "ee82e645ed478592e2188fa9b7867bef6d61d3c1b4df630d8cdcc07649ebe3d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921729, "uuid": "8d739f66-86fb-49ec-bd66-4562d872982d", "comment": "Malware payload (AgentTesla)", "value": "012008cfee9e1bebc99b1693e9037627349808c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615921729, "uuid": "afa636cf-0462-4082-8e00-2b674facbff5", "comment": "Malware payload (AgentTesla)", "value": "849b1dcd7a7ce8b27dc8c15a9a2dcd55b83f45847c79465d61511b52a52ad6416c96bdf8230f16443c99af98f1c1c796", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921729, "uuid": "e7f0f64f-83eb-4ca2-ae0d-c2e85f4b4ff5", "value": "A905DF203AFE5019F173EFB61FE4B5969EAFB6723707E41D2491038A0723A41DE91639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921729, "uuid": "22c8751b-b934-455f-bcd8-603ee2aa7dd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921729, "uuid": "b58267bd-8b4c-49c7-9b46-67dbd4fe1e4e", "value": "12288:tOVs4iLOWeozd073RcgLRDrRRApivKOmmxNLeRHMs9bNGbfdrPGRAKT:3ehrBRRZv9qHMg58ljGRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615921729, "uuid": "5a554843-cbf6-42c7-a34e-7abe56d7224d", "value": 812544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615921729, "uuid": "34a6cd19-b949-4b60-aaac-728f8d692c2a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615921729, "uuid": "097e24a0-5bfd-4fb2-8307-672d8425374e", "value": "c0cb86d7da0efdb4049d80a17a7e9b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c08134-863b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615887472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887472, "uuid": "3818ad1a-fa39-484e-b111-7051c98cd440", "comment": "Malware payload (Gozi)", "value": "a686e2eb41c6cd5833787ed166e693b8", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887472, "uuid": "19c0e821-2bc6-4ddc-8b8f-70684ae85df1", "comment": "Malware payload (Gozi)", "value": "f1244387fddc12e87fab0ca7d1337581a3b4fc72a9b1c6a82ee90e44d194994f", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887472, "uuid": "05a7c5fd-a737-4076-8de0-7f5ca638bed5", "comment": "Malware payload (Gozi)", "value": "d58fab4de57bc9b368685379861af12f385e3587", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615887472, "uuid": "688b3755-baf8-492b-a6f9-e814770c0bc5", "comment": "Malware payload (Gozi)", "value": "fe106beb64d45538bfd96fc0890a10144bb295c9a2b2e0c1576ba4f6eb71588026f8f55a2f5a88cb7a3278324d3569da", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887472, "uuid": "4d320a9a-09e4-4a2b-9b06-0ba3791cc976", "value": "3D13F1209F202478C59D56701646C32B13A74BC8052BE96687AF6AD0E7C4A46EF377B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887472, "uuid": "286d9f94-ce8c-460f-bbf1-e11d9505963e", "value": "b22573a69d26385784955133514ca000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887472, "uuid": "7e1d6d97-812c-4454-a90b-b458844c65ba", "value": "768:5fZ3XZhUFv/E93DNlYN40ZVpcrpCEl+YMajQImOswUlGva9AdAwG:hZnnBDsNXZzcr/l+Lou0c8NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615887472, "uuid": "42f571df-608a-42d5-9e68-8e9e4fb3848f", "value": 44032, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615887472, "uuid": "3982fb0e-d0ca-41d6-ada1-0bb10dce58d5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615887472, "uuid": "50c7d8a4-01c1-47c9-829e-4cfe3f41d854", "value": "10000000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fcd230-865f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1615902906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902906, "uuid": "6238188f-74c4-4643-9d28-0472aa9872b3", "comment": "Malware payload (IcedID)", "value": "997340ab32077836c7a055f52ab148de", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902906, "uuid": "032ce3bf-e854-412f-846c-44953f9264a8", "comment": "Malware payload (IcedID)", "value": "f175d5883a0958f8ce10c387fef6c6750d26089e7413bf7b9a3767b655e61417", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902906, "uuid": "a50c0467-284a-48ca-9445-65771c1204f1", "comment": "Malware payload (IcedID)", "value": "199045f7af5d7b2df7442c214afc13fbde7b54af", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902906, "uuid": "cdc5009c-cd33-4c1c-95b0-5b8437e01e0f", "comment": "Malware payload (IcedID)", "value": "1757fdf8c43722e98e85e02418246937252f7d3a1708344c5e96d19e66b0c5872215a430da9bcf2558e342f9c15c3662", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902906, "uuid": "455e22c0-5a74-4f52-877a-996206c99718", "value": "78134BCA5A700E23D5312676C5F26F2CC62BB740F74759F7D088B669C9C2090DB369EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902906, "uuid": "9e8ad3c2-2c5e-4086-82e7-559a660d8f20", "value": "2c242ad4a4ada5a092b4cd4c64888b0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902906, "uuid": "27a6c077-4746-447a-9bc6-391e881f5918", "value": "768:1nNm1j0LxiiU0SLtaK5aaSqts0uVUVi42mWhlzS8q8zOhD1:1nN6wAi6ayBFnoUV/3Az9cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902906, "uuid": "970083a2-5dec-4555-b2f1-c5b6111b3202", "value": 44544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902906, "uuid": "eb14053a-d44c-4ef9-8460-f28447c50802", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902906, "uuid": "7068bd0c-1156-41a1-a7a4-08db1a055391", "value": "sample.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329baf60-862c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615880995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880995, "uuid": "2da25fdc-e35e-425f-b328-4bb8b8b5ecdf", "comment": "Malware payload", "value": "76add0b47987c20b66ec8dc8aabba64a", "object_relation": "md5", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880995, "uuid": "f3105552-d214-4be8-bb7c-81af4288ae55", "comment": "Malware payload", "value": "f271be3547d88ddd3eacf099708e900dcc6a580a8ecece460e4d48c552293a64", "object_relation": "sha256", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880995, "uuid": "c672cfe8-edb7-44f2-b0b5-622fe2e2c529", "comment": "Malware payload", "value": "aef75e5b0f225c17af081f65c053e1b8314453e4", "object_relation": "sha1", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880995, "uuid": "8bc87a1f-61fc-438d-b9fd-dd965a80e38b", "comment": "Malware payload", "value": "76a8fc3a6f166cc574968b06490bafb4b0a9de0d2d6e97056227654c6450b20777a01d5642d928a7de4f3ca2d4998a31", "object_relation": "sha3-384", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880995, "uuid": "680b3139-c6d1-4a22-901a-b7895af5d85a", "value": "18C55B22B245653FC4AB2A3A8D37A6589C3FBB7127168C5F56F4088C8F355412A3E74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880995, "uuid": "859b538d-108e-4e36-8ae8-6317be3f31e6", "value": "f871e7b97444b8f61dfcc85dbfa5aa2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880995, "uuid": "0c8cf21e-7504-4496-beb9-f0c8e5341957", "value": "49152:8fePk/M8YxIkZwS70WRYAQsz2n+9BT71oUi:qf2Rnu+v1oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615880995, "uuid": "fb347eb4-78b1-4216-b00b-64477c24534e", "value": 2682456, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615880995, "uuid": "de91bf33-646b-453b-bba2-8bd4906a9fcf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880995, "uuid": "ef7e29f4-2e90-4bf3-8a8d-be30795bb4b4", "value": "f271be3547d88ddd3eacf099708e900dcc6a580a8ecece460e4d48c552293a64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f3b4a5-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615876548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876548, "uuid": "fff2b799-020e-43d6-83d3-753211efe195", "comment": "Malware payload (Formbook)", "value": "85e5e11edc156d185cdee247073240ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876548, "uuid": "46c62341-cfba-47c9-bf30-3680eefb337d", "comment": "Malware payload (Formbook)", "value": "f2815415920f86acc9ab9d6860388772b5c892ccd4ba0cc01bef468dd02c7d19", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876548, "uuid": "22756562-960b-4a70-93e9-3c765857bd98", "comment": "Malware payload (Formbook)", "value": "81de43b0ab4f6e361b84ee2d4dfdb3a3d34dcfec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876548, "uuid": "8268f12f-eed2-400b-9562-f35c4cad2a1a", "comment": "Malware payload (Formbook)", "value": "9f3b416c937b013cf43cb4220b3db33fe69bc4f0131a0eb53ddda134475285503be0ff581e739c8e125af1a3b3123d30", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876548, "uuid": "7e45fc63-d449-47db-80c6-08902ee2279e", "value": "26C523919847AD56E16EC9344789DE540C6BDD382EA1B88C3FFDB3A030B67E01ACB15D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876548, "uuid": "a5baf3aa-0786-4d69-8754-c64bcd99e9b6", "value": "49152:NI0VcL89oln/XSMPLpov08wO5V6kclpQ6pXa98f4NFmQIOG/uVtxpR6Ws1:JudCMPLpoXwPkclpQIK98fAalcL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876548, "uuid": "0ff515c3-0475-4f04-be79-ecaa539ed1dd", "value": 2586112, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876548, "uuid": "484fbeb4-67c4-4b56-bb4e-90890742a315", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876548, "uuid": "d335ef26-d6bc-42ec-a027-e258b4aed6a9", "value": "PALERMO PO4215.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1805ef-8670-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615910543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910543, "uuid": "8903923e-2c6d-47c4-b5fa-b2dae7ea0777", "comment": "Malware payload", "value": "5790aae1b2ecf56f8a8d27f7d5281190", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910543, "uuid": "97d5750e-195c-4903-a320-482492a828c3", "comment": "Malware payload", "value": "f2d3d7a956a523a2294f80c828a51a91bf7115116cef4dbb05335081a9e9e4c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910543, "uuid": "0240cabd-6b14-4fa6-9a12-eccc3b07984b", "comment": "Malware payload", "value": "73b145cf0f6b96d0f915bdb17d2c3c1bff84d125", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910543, "uuid": "9082d062-f693-40d0-b73a-af9e7d99c0d9", "comment": "Malware payload", "value": "331c98e772ac077ca21cc739d5f1d6b4c0291737e0e3b6fdf73cd1f38b08552afc7a87a4cfc3992732e93b5529764a20", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910543, "uuid": "f97e74bc-f8e5-47b9-b636-5e11d1f2f686", "value": "5FF36DA8E9D0CDD4CBCFC9D94A1D7A952022FAB9C6C36C964438F3F50B9267F4A16C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910543, "uuid": "20ebf9c1-3d4e-4e27-b9f1-0171bf32c9cd", "value": "3072:/v6qawZts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8ew:/vSwZts6vVGt/2l8nxpKJTJznhdDT+8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615910543, "uuid": "db282fd5-786d-4393-8a6d-e285d4fd8b57", "value": 167530, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615910543, "uuid": "a49800d2-0c31-46b7-bcb0-8c01ee2d18ec", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910543, "uuid": "b92c3983-2e8b-41dc-a1ef-6d7b3122563c", "value": "2021 15 03 weekly Report.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86df83bd-8610-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615869110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615869110, "uuid": "5f1c7870-7251-460d-a660-3838c44c0e23", "comment": "Malware payload (ZLoader)", "value": "c96139bf98423aaabcdf618081663a40", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615869110, "uuid": "23b54590-8be2-425e-9db4-63aef8a18dd6", "comment": "Malware payload (ZLoader)", "value": "f4fc313fbfeafb3eb383097ff2c9f791cfb0f687a8488b8bc0923e9d693cdc4c", "object_relation": "sha256", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615869110, "uuid": "16931479-c5d4-4688-80e0-401f0ef6b3ad", "comment": "Malware payload (ZLoader)", "value": "f14629ec76888b6a4eb54e5d849a6f34058d7fea", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615869110, "uuid": "a1780061-2835-4739-9167-a9f2a45f04bd", "comment": "Malware payload (ZLoader)", "value": "d239db1dca70d21cac07bbb733f8e1f31c72107de683163deebde97a89698fad8230fdafc2417aaea456af8fc396b645", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615869110, "uuid": "f1b00186-2d79-44b4-867e-c80d130460b3", "value": "F354B592A112B1A4E1543F36E82E457C42E6EEA97F58F08B3C08B3B73F772D12E41559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615869110, "uuid": "60f75c9d-3624-4db1-9008-7ca306288abb", "value": "6144:CcPiTQAVW/89BQnmlcGvgZ7r3J8b5IhJK+nnuU:wbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615869110, "uuid": "c991d829-a638-46a5-a6b3-37bfbe13665e", "value": 280064, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615869110, "uuid": "69be8677-5f61-427e-a6c0-4dd4c6efb50b", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615869110, "uuid": "01111c1d-93f4-495e-bffe-faa9df2b461f", "value": "mal.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed25181-864c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615894839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894839, "uuid": "bc126ae1-3f81-486f-8cf3-9f48a58afb9d", "comment": "Malware payload", "value": "f87fb8959922aebb7848f8c16c28379a", "object_relation": "md5", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894839, "uuid": "3c969713-1d6a-4ed4-98a6-7c6404e3f067", "comment": "Malware payload", "value": "f59ac21f15b889a7573d592e437bc4f66c9ca3c6f6d8078e531cd3590de82235", "object_relation": "sha256", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894839, "uuid": "82d80f22-df2c-473e-830e-6ce3e90f3b48", "comment": "Malware payload", "value": "d440b2afbe9307c37ac5fd60671f5dde094ee225", "object_relation": "sha1", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615894839, "uuid": "440e4db4-9aab-4626-9736-e901681f5303", "comment": "Malware payload", "value": "cd24613c09ae75528c8cacfbc0690b8f1a637916c7f776f984ce149d473d6c05380ab594a584d206cad0352016814c1a", "object_relation": "sha3-384", "Tag": [ { "name": "gov2021", "colour": "#44D15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894839, "uuid": "b91928f5-dd5d-4c9b-ad5f-669eecad9ee4", "value": "384302E2D239CD057281F4B5BED034496764EA98481DBBD61AB30DAD7EF1582EF84C31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894839, "uuid": "7bef1ef8-6dd4-4efa-ac1f-b33f649ec616", "value": "1536:B9YqASMITC2Vk05i8SZUa/5LOXlYLkNE7I2+HGLQz:UQMIW2aYi8uUA5Lbko7+HGLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615894839, "uuid": "9142ea43-3dbb-458a-bcb6-a04327454aa0", "value": 59464, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615894839, "uuid": "208b1e1f-86f1-4d8c-83b7-e8131cc85ca7", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615894839, "uuid": "90d13511-9940-438d-b018-eeb8e27c7639", "value": "dettagli_144.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca56955-862c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615880985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880985, "uuid": "63000766-8788-495d-b756-9c047b74b3a5", "comment": "Malware payload", "value": "4a17a1fb5616495c43526ef8318842c6", "object_relation": "md5", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880985, "uuid": "a5cdb741-e264-4afc-a098-9cb302e4709f", "comment": "Malware payload", "value": "f5e468f144dc51f5c52fd096115a97a81a84a64490c4ba3809fd0e5ce4234c94", "object_relation": "sha256", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880985, "uuid": "dcfefd04-ef36-44e2-9592-5c1cbfd9d15f", "comment": "Malware payload", "value": "0ce45a952d32d70395eece5f4bb46fea64162ca6", "object_relation": "sha1", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615880985, "uuid": "a46d76d9-cbdf-46ca-bf26-dde1fc02685d", "comment": "Malware payload", "value": "6e848ba8beae16bf9d98deb8b90e3a9c2081e80a00074081ed896a81d3e2f61d0a7e5511939d1e9bff0785ab6657f64c", "object_relation": "sha3-384", "Tag": [ { "name": "LEVEL LIST SP Z O O", "colour": "#D1CEC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880985, "uuid": "0f7dcf34-de18-4337-9973-e27aa08f1c85", "value": "76C55B22B245653FC4AB2A7A8D37A6589C3FBB7127168C5F56F4088C8F355402A3E74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880985, "uuid": "19327e29-9622-401e-85be-dd88749b8025", "value": "f871e7b97444b8f61dfcc85dbfa5aa2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880985, "uuid": "58e8cd10-9a1d-439d-be0c-1a0e8d0855f5", "value": "49152:rKe/YbM8YJkQZwSXsORKUMszejatT71hE3:+DaNBSOF1he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615880985, "uuid": "d1454f60-bd84-4bb3-b792-c623caa300d6", "value": 2685016, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615880985, "uuid": "8193249c-f401-49b5-b2bc-243319cc03c9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615880985, "uuid": "1887336f-2a53-4c3c-b60b-6162bfb3aa99", "value": "f5e468f144dc51f5c52fd096115a97a81a84a64490c4ba3809fd0e5ce4234c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc114e41-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615922484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922484, "uuid": "57ce9b19-4928-43e7-aa9f-20ab489f676c", "comment": "Malware payload (GuLoader)", "value": "759104370561b12f07fea800546ab47d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922484, "uuid": "f89092ec-8ae5-4944-8664-7198b2f84460", "comment": "Malware payload (GuLoader)", "value": "f6457a7b94708c66fe1b0a3740fa6b86aad2b1276717e501f2d29ae94a3daecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922484, "uuid": "2ac2ab5e-8fde-4a4b-bd57-f78c8e452a84", "comment": "Malware payload (GuLoader)", "value": "8221bd27c6122f63a5abe2e8e925e139398d12de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922484, "uuid": "314a4892-7193-4af3-bea9-7c151ceb55ff", "comment": "Malware payload (GuLoader)", "value": "d48e79cd9fa8072cce4ae192739d490c6efbb8349492d44048dc2f31449ae522f1d762a44e5572d3eaca47aa51e31d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922484, "uuid": "fc7fb9e0-4c48-415a-8869-2fdf7ff9d415", "value": "AAE34A53B1009C7CD5057470020EEBB97622ECB182909F6770E5BE1BD9BE2C12EE6F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922484, "uuid": "77f45823-960d-4c7b-98ca-9da30986d863", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922484, "uuid": "57b5d882-80b3-474f-b270-e298cf806072", "value": "3072:e7toViYGuhjFWTZgkTccBBhVR6FQ4dYW7t4:ckGuhjQTZgkTccBBhVR6FQ4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922484, "uuid": "8a739495-192d-4e25-a10e-2bed093d4ff5", "value": 151552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922484, "uuid": "287d4abb-d7b5-4d92-90e8-69786272490e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922484, "uuid": "ba7cf100-060f-4712-b440-20498fc00634", "value": "759104370561b12f07fea800546ab47d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14947132-8606-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615864623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864623, "uuid": "f5ce1c09-5d2c-4961-8aa8-3e2e282838b1", "comment": "Malware payload (Gozi)", "value": "2bba9ec2e0dc86ce99edcb310abf3786", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864623, "uuid": "d31d7078-dd3f-4ab7-9d8f-dd19f6c5d92e", "comment": "Malware payload (Gozi)", "value": "f71d3ac993ef4141a41823255510bbc7238989b7421d15fc1d8b1c9a3cd5f641", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864623, "uuid": "57c33d03-56e2-4be6-8e2c-08bb3d656894", "comment": "Malware payload (Gozi)", "value": "e6683d712477887b2c13a8baf5eb52b44d86645c", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615864623, "uuid": "1bbf754a-831c-4e20-8780-c84f12b71b04", "comment": "Malware payload (Gozi)", "value": "86ef75ae1b8ce41bed9ce75b7fc6a5a305ea9f1231e987506b3ae3c1063cc5d2fbea503efa355256342e5cddd2246cfd", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "RigEK", "colour": "#EBCC17", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864623, "uuid": "258b088a-d0bd-49b4-8058-d544f5419683", "value": "7BF39C1172E1C033DB96163148B5C2B11A36FCB58B2556F7BBD43B6A5E31AF28A36343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864623, "uuid": "ea3f9b84-c0c2-4ee1-9104-be88e339de69", "value": "0db5122541c535013699ed54854d9680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864623, "uuid": "441cf13f-bc6f-49f1-afc1-090f9f88bb68", "value": "3072:BjF/tGR9+ATTovkugvc9X82JZxaneA5XgP:NqRkATkLX6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615864623, "uuid": "e3d33e48-d798-4d95-94e4-a05f6da22e5a", "value": 169984, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615864623, "uuid": "800ad42b-7acb-4539-b41f-ad007b5162fb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615864623, "uuid": "81af16ab-ced8-46a4-ac76-583887b5ad85", "value": "DSC_Canon_023945_23.12.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddd7975-8616-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615871887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871887, "uuid": "2fc141a0-3686-4dfb-9ade-4c88eb68ad04", "comment": "Malware payload (Dridex)", "value": "2df0b838e766fa6e91f516dbb0bd34ad", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871887, "uuid": "880d3bc4-227e-4507-959d-954a1bedc646", "comment": "Malware payload (Dridex)", "value": "f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871887, "uuid": "7228fe0f-983b-4339-9517-15d052ea3164", "comment": "Malware payload (Dridex)", "value": "83278ba4321ebc65611b82d4b35e73008020f669", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615871887, "uuid": "2988b1b7-c159-409d-9393-3d8984b8dc94", "comment": "Malware payload (Dridex)", "value": "850648624d1f01e88eefb6e7d062c18586433d19cb3e47126912c98d049a05fcd8077427fc2d8b4114f888e781a8c5a0", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871887, "uuid": "365a24b4-493d-408a-a880-cc0423b61554", "value": "8915DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871887, "uuid": "a32b9711-a14b-4078-8ab8-193b4aed86de", "value": "8ce5cf6636b690adc707814c2493aa70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871887, "uuid": "e3b97afd-a327-484e-9427-48bb5cc825da", "value": "24576:sD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+Fmzk:sD/SBiAOOjtW3o+MbLSkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615871887, "uuid": "c205cb65-0b87-48fd-97d4-faa7205a09a7", "value": 880640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615871887, "uuid": "34960d84-a5d6-4313-a439-9d8e82aad62f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615871887, "uuid": "4b5ae036-353b-4ae8-a7f9-998eac18ba01", "value": "f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb7e045-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615889467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889467, "uuid": "ebdc2498-6749-4d57-94b0-85fde5de9daf", "comment": "Malware payload (Formbook)", "value": "a8a2ee77b4aed98f2dd2c39ee9925077", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889467, "uuid": "dbfc76f5-59c9-425b-8db9-4fe1a55ca91e", "comment": "Malware payload (Formbook)", "value": "f782d415e7975acdf521b8a92ceb1e1f5c51c030dfdfdf5d798ad381003ed1bf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889467, "uuid": "1260864d-cf71-477c-8559-aa58d2551e46", "comment": "Malware payload (Formbook)", "value": "d15baa1899f918657fed2e7dec6ce26e93cfb610", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889467, "uuid": "e181f767-3c6f-45e7-abac-4c0cb5133967", "comment": "Malware payload (Formbook)", "value": "58ed211d8dbb2ed8c10af412f688d60484b5f274f023a2d6364cf7b1e244e0974b266fb95dde95f1d765b069bf31e7b1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889467, "uuid": "3bcedf37-5e7f-41b7-804a-660956266704", "value": "98258B22E6A4AB74F03D73751432133083FDAD069625E6BE7D8831DA49B56C146F3EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889467, "uuid": "76048376-d195-4ee3-a5e6-c34288b00fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889467, "uuid": "07a934f1-ff9f-4df6-81ed-5fc102fee02c", "value": "12288:px7wDKJJUn6d9TVC+yGiyFTEC4V2MXw+gqSMEULT/lACOcaUT1:p7JU6bVbyGECQg+BSMEMTyCFaUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889467, "uuid": "78c10686-f486-4a53-93dc-efc84217dcc7", "value": 1029632, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889467, "uuid": "8f2d498d-6440-46e3-a49e-2e061949e76a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889467, "uuid": "12957683-b22d-4ab6-872e-5856039b5c00", "value": "INVOICE-OVERDUE.jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc8520e-8659-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615900425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900425, "uuid": "753e8a25-79ff-4fd4-b2a4-0f7dc87916b9", "comment": "Malware payload", "value": "350b185fadf373a6b96b586ce7b64619", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900425, "uuid": "b361ca2d-7d1d-4bc0-ac9e-832dbfd6ffe0", "comment": "Malware payload", "value": "f817eb5de77bf218caf1dd21fbb6f71c498ea00c792f806d349616310af0b83e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900425, "uuid": "585c5886-e1ff-4736-ad8e-3aa162d2b955", "comment": "Malware payload", "value": "5fbc052d5c888dfaa692d98358ac67b1a95ec687", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615900425, "uuid": "953cb8bc-a2f2-48cc-a890-848a34bfb463", "comment": "Malware payload", "value": "c34be3f95665bb3e1439cad02261d86b93c523eb0d7dcab39edaf04644ed6f5f4f09025d6e35351781fa304d7e2fd67c", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900425, "uuid": "1de8b415-f016-4372-82c3-d08a2faaddbc", "value": "42A25F417261C62BD5A85A328CDADAFB3736BC419E92831332C4733F6D7A754CE22742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900425, "uuid": "1bae8849-3335-4895-9406-73426ec7b566", "value": "192:5Z7385iyefegx45pW4qALPkvAc1Zdmsi7Mg6gsoyEWXOD8JDdkoat:njXW7tkbZdmsigrgsAW9JZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615900425, "uuid": "6e0d5b99-24e3-411f-8910-b88ac7fe1562", "value": 23040, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615900425, "uuid": "a5bae4f0-d17b-4370-b6d8-240d4782ab49", "value": "application/CDFV2", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615900425, "uuid": "85126e94-dc9c-47c6-84ff-3778e5397d61", "value": "f817eb5de77bf218caf1dd21fbb6f71c498ea00c792f806d349616310af0b83e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdd4eeb-8621-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615876260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876260, "uuid": "8d556328-1153-44fb-8f11-eba4def7edbe", "comment": "Malware payload (SnakeKeylogger)", "value": "303ecb161f333d16b3323ad9f8e239ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876260, "uuid": "4519df6e-ec23-487a-bcf3-f3e01a54c314", "comment": "Malware payload (SnakeKeylogger)", "value": "f8b8baf52ce82465ea49e717204b3c9df9f0771d79ab7493a145895ab0328eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876260, "uuid": "bcd6e2b1-575d-47f4-b311-9e1d845ba17c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8294db5074f89c8ef39ea40147129a39326d1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615876260, "uuid": "3d652c15-9c2f-4bd7-ade8-fa34de53bbe2", "comment": "Malware payload (SnakeKeylogger)", "value": "594cfbc1f76588dcc49caecd3cb2a48deab50e2eb2912b83c09a48cec92244cdb421e93b2c9d4814c00c220d0879b417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876260, "uuid": "cd1b15cd-ddd6-4245-a936-93b4fe7eca8f", "value": "CDC423C2F081A733E863AAB10523DF75F32AEE069960405B5399BF2767774CE5613346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876260, "uuid": "56154192-581a-49bb-8970-cb4c00392da6", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876260, "uuid": "2006ba53-5609-433c-b41a-a2734519accd", "value": "12288:gb2NVem1PfCN/kafn9+Osm3/A+nV/oUFml6y:MOzPwn0uDhJFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615876260, "uuid": "7f8ecec0-44ae-4240-a0eb-4e452d3f8cdb", "value": 558713, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615876260, "uuid": "9b247a14-e8fe-4ac0-b7ee-e89366b4055b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615876260, "uuid": "8e668ffa-f2ba-4ec6-9a68-978aeee99d5f", "value": "SAI400000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9da9e6-8682-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615918133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918133, "uuid": "61b287e0-cab6-483c-be50-9016f4dfcbef", "comment": "Malware payload", "value": "f0b8eb09dfc66ec478239f47630f13c3", "object_relation": "md5", "Tag": [ { "name": "Bodegun", "colour": "#187688", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918133, "uuid": "48aa9c9c-2a35-4444-9625-75d4542b19b6", "comment": "Malware payload", "value": "fb781fce33509eb9489b6877ac7b0411cecdb8c9b8a5e926c2bacd462ae84407", "object_relation": "sha256", "Tag": [ { "name": "Bodegun", "colour": "#187688", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918133, "uuid": "b02c3206-3f92-4af5-a7a7-3c6cf3022631", "comment": "Malware payload", "value": "58cae566c50684971ea663303265d348bd8ecd7e", "object_relation": "sha1", "Tag": [ { "name": "Bodegun", "colour": "#187688", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615918133, "uuid": "a1d3b993-0952-4624-8340-56fa977251ca", "comment": "Malware payload", "value": "a8afe3349ce6de0b017a09ac559624100ad4db9764e259f22e00cef16dc3bc5795f2170f5d0a25d4a3e9fb60ab5886ee", "object_relation": "sha3-384", "Tag": [ { "name": "Bodegun", "colour": "#187688", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918133, "uuid": "db4f5f7e-d2ad-4d98-9235-4f6082cc21f4", "value": "E6F23A0135E08473E4639A7449B0D5A29A3F7D52A7B480DB379C25AE9FB13C08FB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918133, "uuid": "ccf93456-0e64-46cc-bf4d-7f2388733569", "value": "01b629eae07a5afbc423a6a351ad7275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918133, "uuid": "061e0d81-9b7a-4e79-8582-78ab9d8b1ac4", "value": "768:zy1C0vGhVdV3jmPK0cVehCgXJpOYkkCCEDVnnITvII:zy00ezvsPCg5HkVeAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615918133, "uuid": "57e8987e-58d5-454d-9e6f-2c1a0dacf3e7", "value": 36864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615918133, "uuid": "fc408644-cecd-4662-a88c-561eccf3354c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615918133, "uuid": "7df06f2b-605a-472e-9b64-ca28fd080ef1", "value": "fb781fce33509eb9489b6877ac7b0411cecdb8c9b8a5e926c2bacd462ae84407.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3715fdd-863f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615889452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889452, "uuid": "81102725-7a8c-4e1d-8513-82529c6438f4", "comment": "Malware payload (Formbook)", "value": "a07cf3c35dd973d007103a4e739d56f9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889452, "uuid": "497e18cf-e36b-4b8d-a916-c60c31afd928", "comment": "Malware payload (Formbook)", "value": "fbc449086b9a2bdb18ca14fdffa5f062029f5c914f96820b8fc02422c0c45b86", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889452, "uuid": "b2e3b387-41d6-4dab-8791-a3f7ba7f66ac", "comment": "Malware payload (Formbook)", "value": "09cfc4f3edd59244d477f9f22a33e39529832079", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615889452, "uuid": "0c985cd9-e1d8-43c2-ae64-11c53c7e463a", "comment": "Malware payload (Formbook)", "value": "0719eed22730b1a9da8cc20d9810480232659205b0f26b0c1be5290713d38036bb671688afacc4751a9c527a3f063c80", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889452, "uuid": "08ee06d9-7219-4807-811d-6315f6064343", "value": "15B42393BE345FBADA0C5D4B6A3C42CB5A27653C21742099B8B4C163E61D336DEF61C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889452, "uuid": "820a3524-e02e-4c2b-ba06-fa87736c0ff0", "value": "12288:/34zPGFrhp+JaLtTYohyTCmO7g2Fod/6YVZbFmdQR+eskr648DRQE3P6:/34cSsL5pmOM2FooYVNJNLl0mE3P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615889452, "uuid": "26af18c4-962d-4343-8854-045ec9cffe65", "value": 509713, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615889452, "uuid": "4109054d-8ad3-47c2-a603-4b7709cb38db", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615889452, "uuid": "1884efa4-81d8-478b-a0f9-4c5abddd63f6", "value": "INVOICE-OVERDUE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c928af17-8617-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615872228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872228, "uuid": "ef48b678-2251-4203-8302-ea29900aa8be", "comment": "Malware payload (TrickBot)", "value": "190b62c21a3413d44cc73e4098b6987b", "object_relation": "md5", "Tag": [ { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872228, "uuid": "e4d8b88e-3695-4679-9f13-9731e2a86670", "comment": "Malware payload (TrickBot)", "value": "fdc885d4bcbbe9b274c49819801a2a2adfe9cbeee4c1fc509bfc9f385667f1cd", "object_relation": "sha256", "Tag": [ { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872228, "uuid": "f509bfef-77f2-477f-af63-447776929a53", "comment": "Malware payload (TrickBot)", "value": "8498385e9be7054a637f710245f44bc85d935590", "object_relation": "sha1", "Tag": [ { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615872228, "uuid": "0d3b95c1-34ad-48ff-babe-0a6119c371a9", "comment": "Malware payload (TrickBot)", "value": "8692353be8b6452ca93cae5eb964ec74d28ff6adcd6fa2189d85693b75f70660654149e5a5589267de53bab6ccf0fcd3", "object_relation": "sha3-384", "Tag": [ { "name": "mon139", "colour": "#460028", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872228, "uuid": "300dd43f-8f7e-43b7-b9fe-1a0a24501cc2", "value": "32540130A7A65837D49A1B3040B6C736577EAD459AB1834B2FD53E3B3FB23808D1436A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872228, "uuid": "a67d230f-16fc-4476-a518-6975746dc2a1", "value": "10692b69586a6cd6b934d4fc52bc47e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872228, "uuid": "3823b01b-66e3-4095-8720-9b412adba224", "value": "3072:0W5f07yUq2M5cGgs6TjHn+Ki666skl12eFNqw+Q+hXC003NpC/R8O2gUszpi/On1:08R2M9gsD6skaqNDqy0O9O2Nsli/IcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615872228, "uuid": "98600690-ed7d-426f-8adc-b302a81aad48", "value": 291328, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615872228, "uuid": "b534c5fa-f080-4410-89fb-2f67c627b253", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615872228, "uuid": "5029c5a2-db09-45c6-a995-df52bbceb27e", "value": "linas139.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec68891d-868c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615922538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922538, "uuid": "101f4046-71a5-4dfb-aa4d-d40de051fe50", "comment": "Malware payload (GuLoader)", "value": "4c44df8bf80b796ebb3e979519e723c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922538, "uuid": "b2e81b87-0c2e-4720-8446-7e19db7f6697", "comment": "Malware payload (GuLoader)", "value": "fdeb1da0df5e4ff9251597ce8e89060544e87fd7d978e73e7f513db4e4c2f2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922538, "uuid": "83546473-78a4-458a-9261-2e7ae9989c40", "comment": "Malware payload (GuLoader)", "value": "74a62c0a553a7a0beaca31ba9f8e7325c05ece2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615922538, "uuid": "b0afda84-e328-4faf-8047-4e408bff6283", "comment": "Malware payload (GuLoader)", "value": "03a0ef3fb8132d957e66dc9a6abc6817a54dec4fe1c7da46fd775dbd75fb1b3b3868992fe387ddd3844bc77ba1c8dd84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922538, "uuid": "d63ff523-cab8-4ccf-8116-0c38a8511c60", "value": "58E34A1372005C7CDA49B170411EEAB93A26ECB181804F67B6947E6BD9BD2C13DE9F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922538, "uuid": "9dc987fd-9269-4750-82d0-a79f03b255c8", "value": "82f3154e4b314b6810b189c7a61b6a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922538, "uuid": "ab27223e-8710-4b0d-a54a-e02ca312703d", "value": "3072:iyyrsI07I3sOrfjioWyda6bxFEbgR9pp7yKSQpKQym:QH0I3sAji9yda6bXEbgR9pp7yKSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615922538, "uuid": "236fe230-96f9-4b29-b724-4839b7c28040", "value": 151552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615922538, "uuid": "3e077cdb-15cb-4b7e-b6d8-0f6e660b636e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615922538, "uuid": "9f0194cd-f314-41ec-be88-8841781ec90c", "value": "4c44df8bf80b796ebb3e979519e723c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f983a3-8671-11eb-abe1-42010a9c0039", "comment": "Malware payload (GootLoader)", "timestamp": 1615910852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910852, "uuid": "537f39e8-cf76-4555-8b99-aacbcb03e7ac", "comment": "Malware payload (GootLoader)", "value": "4f0f5e2c6bc8d65d14ff201d799824ae", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910852, "uuid": "e3e4d8d6-8c64-4f99-a02c-1acd2d332774", "comment": "Malware payload (GootLoader)", "value": "ff4ad9465d1312e24dff76c47ddb519bc46f501239e5813d4d70ac6bd7c70638", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910852, "uuid": "a856a1da-41fa-4d88-b21b-ddf0198eff37", "comment": "Malware payload (GootLoader)", "value": "eb519d0338c102103d0e8467a5dba55c99a40233", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615910852, "uuid": "c09b0dd8-ddbc-4536-8208-439da71b23dc", "comment": "Malware payload (GootLoader)", "value": "40ce04e3e695d10b42d9ca1026476aa6076923a911652c6f263f866c8ce86e9bf2b03e1626f3ce20f6d4f1649ed3f54a", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910852, "uuid": "fb9da1e2-b70e-4084-a78a-57053369b60d", "value": "6E51A6E5B149E15101073734255FE86CB9B3A949D40ED420D749D7DF28B603D4E27A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910852, "uuid": "480691d8-20ea-4727-b72a-7fc6f19cef5f", "value": "48:M27hDQrbyxd8CROAdiQD0GMFJ0QXtAkiQKXJXWcaiMKjTlLJ/9zhjOquc9+ac03V:5Vwbg8BxHpX4XMAF96qfmaMJ0ncTwy1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615910852, "uuid": "70fcb011-1d8e-4477-9ac5-e5dd57cbcde3", "value": 2939, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615910852, "uuid": "0630ecbe-d5df-4797-87c6-f5039f703235", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615910852, "uuid": "0f3b4506-5e60-4726-8853-386aa0b9620e", "value": "tarifvertrag_chemie_bayern_entgelttabelle.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfb1634-865d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615902297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902297, "uuid": "0bb22fc3-c7dd-4601-b701-f110e61008f5", "comment": "Malware payload (SnakeKeylogger)", "value": "c86d658e947213a3b230342ecc1de152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902297, "uuid": "a19b58d0-5f9b-4f4d-a7ff-ff9650f57988", "comment": "Malware payload (SnakeKeylogger)", "value": "ffec3662128511dd4bf4f888f811db98d6e5ae7764b6acf3cc445bc7f943698e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902297, "uuid": "b54a4466-ef84-4cf3-8dba-e69cefee2074", "comment": "Malware payload (SnakeKeylogger)", "value": "4e0ac8ebcd4f43c333851c41fa2cb647dc7a0ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615902297, "uuid": "4bb56be4-7d0b-4bf7-9b51-420b92d5ff3a", "comment": "Malware payload (SnakeKeylogger)", "value": "d12de71540e08b6151a7aeece9e0f4e6401ac7f7ba1949a3397abf629bd05eb4b0ddcb176f6e3cdf50ed150cf1cb52c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902297, "uuid": "bcfa5561-7458-4033-b157-a587583bf95b", "value": "A0358C12E694AB70F03973754432133183FDAD0A9626E7BD7D8831DA09B56C186F7EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902297, "uuid": "8705eb4b-5ffd-42a5-a1d3-287fb44bfb9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902297, "uuid": "cc63ee91-67ce-4178-8d12-3035db1824b6", "value": "12288:bQ4cKPX54k5v6Dd86gmqAImdcd0MfkFShaA90ysIpSQfiLn7OcS1:95/5v6J8zmqA/pekefeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615902297, "uuid": "ee6d43f1-f62a-4f8f-adc1-6bebca90b3c7", "value": 1116672, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615902297, "uuid": "b3e9d5e0-36e6-4a67-9d6e-f88da62504a7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615902297, "uuid": "69a0582d-8ead-451e-ad14-6c54536bacfe", "value": "FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }